GDPR for AI calling
An AI call uses personal data like any other call. The rules are the same: a lawful basis, an honest first sentence, and an objection honoured at once.
This is not legal advice
This guide quotes the law and the regulators’ own pages and says where they are silent. It cannot tell you whether your campaign is lawful: that depends on who you call, where your list came from and what you say. For a decision that matters, ask a solicitor (UK) or an advogado (Portugal). Every source below was read on 4 October 2026; laws and guidance change, so check the date before you rely on it.
Two laws at once
A marketing call uses personal data (a name, a number, a recording), so data-protection law applies: UK GDPR with the Data Protection Act 2018 in the UK, and the GDPR in the EU. The phone-marketing rules (PECR in the UK, the ePrivacy rules in each EU country) sit on top. You have to satisfy both.
A lawful basis, such as legitimate interests
For B2B calls, legitimate interests (Article 6(1)(f)) may be available after a written assessment. Recital 47 says direct marketing “may be regarded as carried out for a legitimate interest”: may, not is. You weigh your interest against the person’s, write the assessment down, and keep it.
In the UK, the Data (Use and Access) Act 2025 added a list of “recognised legitimate interests” (in force 5 February 2026). Direct marketing is not on that list; it remains an ordinary legitimate interest that needs the balancing test.
In Portugal, the data-protection authority (CNPD) says the marketing law (Lei 41/2004) overrides legitimate interests for calls to individuals: you need their prior consent. See the Portugal guide.
The right to object is absolute
Article 21(2) and (3): a person can object to direct marketing at any time, and then their data “shall no longer be processed for such purposes”. No balancing test, no exceptions. Article 21(4) says the right must be “explicitly brought to the attention” of the person at the latest at the first communication.
What to tell people, and when
If you got the number from somewhere else (a directory, Google Maps, a bought list), Article 14 says the privacy information must be given at the latest at the first communication. On a call that means: who you are, why you are calling, where you got their details, and that they can say no to further calls, and, during that same call, the rest of the required information or a clear way to get it there and then (a layered notice: the key points said on the call, plus where to read the full notice). How to do this for your own calls is a question for a data-protection adviser.
An opening that covers the basics
“Hi, it’s Cass, the AI assistant at [business]. I found your restaurant on Google Maps and I’m calling about [reason]. If you’d rather we didn’t call again, just say so and we won’t.”
Data you keep
- Where each contact came from, and when.
- Your legitimate-interests assessment (or the consent record, in Portugal).
- Every objection, applied to every channel.
- How long you keep recordings and transcripts, and why.
In FoxEra Calls
Each lead keeps the file or search it came from. A “don’t call me” heard on a call stops further calls to that number, and STOP replies or the opt-out link in texts and emails opt the person out. Archived and do-not-call contacts are never contacted. You can archive contacts instead of deleting them.
Sources (read 4 October 2026)
- GDPR (Regulation (EU) 2016/679) on EUR-Lex (read 4 October 2026)
- UK GDPR (as amended), legislation.gov.uk (read 4 October 2026)
- ePrivacy Directive 2002/58/EC, Article 13 (read 4 October 2026)
- CNPD Diretriz 2022/1 on direct marketing (read 4 October 2026)
Related guides
Frequently asked questions
Can I use legitimate interests for B2B cold calls?
In the UK it may be available after a written balancing test (Recital 47 says direct marketing may be a legitimate interest), and PECR still applies to the call. In Portugal the CNPD requires prior consent for individuals. Other EU countries set their own phone-marketing rules, which we have not covered here.
When must I tell people about their right to object?
At the latest at the first communication (GDPR Article 21(4)).