Originally published at ictcrm.com
Italy's data protection authority has fined BBVA €5,508,000 because one customer's marketing opt-out never reached the system that sent the marketing. The choice was recorded, a sync between internal systems and the CRM unit failed, and promotions kept arriving for seven months. If your CRM software holds consent in one place and sends from another, this is the case to read.
The European Data Protection Board published the summary of the decision on 9 October 2026. The Garante, Italy's regulator, made the final decision on 3 July 2026. Three days after the BBVA summary, the EDPB published a second Italian decision, a €16.7 million fine against the telecoms operator Wind Tre, which turns on the same failure at a much larger scale.
What happened at BBVA
A customer of BBVA's Italian branch switched off marketing in the bank's mobile app settings. He then repeated the objection to Customer Service. The promotional notifications kept coming anyway, from October 2025 to May 2026, at least ten of them.
BBVA's explanation is the part every CRM owner should notice. The bank said the customer's choice had been recorded correctly, but "a technical failure prevented synchronisation between its internal systems and the Customer Relationship Management unit responsible for sending commercial communications". In other words, the opt-out existed. It just lived in a system the marketing didn't read.
Two more findings made it worse.
The channel argument failed. BBVA argued the customer should have used the dedicated email addresses listed in its privacy policy. The regulator rejected that. He'd objected through the app and through Customer Service, and controllers "cannot disregard a valid request merely because it was not submitted through a preferred channel".
Front-line staff gave the wrong answer. Customer Service told the customer the promotional pop-ups in the app couldn't be switched off. BBVA later showed that they could. The regulator counted that as a failure of the bank's technical and organisational measures.
The fine covered breaches of GDPR Articles 5(1)(a), 12, 21 and 24. BBVA was also ordered to put measures in place so rights requests are handled correctly and without undue delay, and to report back within 30 days. When setting the amount, the regulator noted that the case concerned one person, ran for seven months and involved contact data used for marketing. BBVA's fixes counted in its favour. A previous relevant infringement counted against it.
Wind Tre: the same failure, at scale
The Wind Tre decision, final on 5 June 2026 and published by the EDPB on 12 October, started from numerous complaints. People kept receiving promotional contacts after objecting, or without having given valid consent. Some found contracts and services activated without their knowledge. The regulator found weak controls over Wind Tre's sales network and said the company's systems couldn't reliably stop unlawful processing or act quickly on people's requests.
The list of breached articles is longer here, including Article 25, data protection by design and by default. Alongside the €16.7 million fine, Wind Tre is banned from further processing of personal data obtained without consent and must tighten how it controls its sales partners.
Put the two cases side by side and the pattern is plain. Neither regulator cared much that a choice had been written down somewhere. They cared whether it reached every system that contacts people, and how fast.
Why CRM setups lose opt-outs
The BBVA failure isn't exotic. It's what happens in most stacks where marketing grew up next to the CRM rather than inside it. A typical company has:
a CRM where sales and service log customers and their preferences
a separate email platform with its own unsubscribe list
a dialer or call center tool with its own DNC list
an SMS gateway that handles STOP replies on its own
an app or website with a preference centre
Each one has its own idea of who said no. They're kept in step by nightly imports, middleware or someone's spreadsheet. When the sync works, nobody notices. When it breaks, nothing errors out. Messages just keep sending, and the first alert is a complaint to a regulator.
Agents are the other weak point. A customer says "please stop calling me" on a sales call, and the agent sets a disposition or writes a note. Whether that note becomes an objection that the email and SMS tools respect depends entirely on how the systems are wired.
What a sound opt-out looks like in CRM software
The fix isn't a better sync job. It's having fewer places where an objection can live. Here's what we'd check.
One record per person, read at send time
An objection should sit on the contact record itself, with when it arrived, through which channel, who or what logged it, and when it took effect. Every outbound channel, whether that's dialer, SMS, email or app, should check that record at the moment it sends, not from a copy taken last night.
Every way in counts
The regulator was clear that the customer picks the channel. App settings, a reply to an email, a STOP text, a ticket, a keypress on an automated call or a sentence to an agent all count. Map each one and check that it ends up in the same record.
Measure the time to take effect
GDPR doesn't give a fixed number of hours for honouring a marketing objection, but "promptly" clearly doesn't mean seven months. Track the gap between when an objection arrives and when the last message to that person went out. If you can't measure it, you can't defend it.
Train the people who answer the phone
BBVA's Customer Service told a customer something false about the app. Front-line staff need a short script: how to record an objection, what it stops, and how long it takes. If they don't know, they'll guess, and a regulator will read the guess as your policy.
Hold partners to the same record
Wind Tre's problem ran through its sales network. If resellers, agencies or outsourced call centers contact people for you, they need to work from your suppression record, not their own lists, and you need logs that show it.
How ICTCRM handles it
ICTCRM is built on ICTContact, so the CRM and the contact center are one platform. Voice, SMS and email campaigns run from the same system that holds the contact records. That doesn't make compliance automatic, but it removes the sync step that failed at BBVA, because there's no separate marketing tool to feed.
A few specifics, all covered in the contacts guide:
Each contact has an activity timeline that shows calls, faxes, SMS and emails in one place, including delivery events such as Unsubscribed and Spam complaint. You can see what a person received after they objected.
Move Selected to DNC adds numbers to your DNC list and removes them from Contacts, so they drop out of the groups that campaigns dial.
The contact filter can flag numbers listed in DNC before a campaign starts.
Voice campaign types offer Action on DNC, which lets the person called press 9 to be taken off the list. The campaign types guide lists where it appears.
Because ICTCRM can be self-hosted, those logs sit on your own server, which helps when you need to show a regulator what happened and when. We covered the wider privacy picture in CRM data privacy and the 2026 state laws.
Whatever CRM you use, run the test in the diagram above. Opt a test contact out through each way in, then try to reach it through each way out. Any message that lands is a gap, and it's far cheaper to find it yourself.
Frequently asked questions
Why was BBVA fined €5.5 million for one customer?
The Italian regulator found that BBVA didn't honour a marketing objection correctly or in time, rejected its argument about the channel used, and found its staff gave wrong information. One customer and seven months were factors in the amount, as were BBVA's fixes and a previous infringement.
Does GDPR let a company require opt-outs through one specific channel?
Not according to this decision. The regulator said controllers must make rights easy to exercise and can't ignore a valid request because it didn't arrive through their preferred channel.
How fast must a marketing opt-out take effect?
GDPR doesn't set a fixed number of hours. The BBVA order requires requests to be handled correctly and without undue delay. Seven months of continued messages was clearly too long.
Does this apply to companies outside Italy?
The decision is Italian, but the rules it applies, GDPR Articles 12 and 21, apply across the EU and to any business marketing to people in the EU. US state privacy laws have their own opt-out rights too.
Is an integrated CRM enough to stay compliant?
No. It removes the sync gap between separate tools, which is the failure in the BBVA case, but you still need the right processes, staff training and regular testing.
Top comments (0)