BBVA Fined €5.5M in Italy for Ignoring One Customer's Opt Out

The customer did everything right. He turned off commercial notifications in the BBVA app. He wrote to customer service on October 2 and again on December 9, 2025. The promotions kept coming anyway, at least ten of them, until May 2026.

Italy's Garante per la protezione dei dati personali answered with decision no. 613 of September 3, 2026: a €5,508,000 fine against Banco Bilbao Vizcaya Argentaria's Italian branch. The case involved a single person and nothing more sensitive than contact data. For anyone who runs a marketing stack, that is exactly why it matters.

Key Takeaways

• The Garante fined BBVA's Italian branch €5,508,000 in decision no. 613 of September 3, 2026, for violating GDPR Articles 5(1)(a), 12, 21 and 24.
• BBVA recorded the customer's objection in its internal systems, but the opt out never synced to the CRM team that sends commercial messages, so at least ten promotional notifications went out between October 2025 and May 2026.
• The Garante rejected BBVA's argument that the customer should have written to the rights or DPO email addresses in its privacy policy, holding that a valid objection made through the app and customer service cannot be ignored.
• A customer service agent told the complainant that only email communications could be adjusted and that app pop ups could not be removed, which the Garante found inaccurate.
• BBVA must report the technical and organizational fixes it has made within 30 days of notification of the decision.

What Did BBVA Do Wrong?

BBVA kept marketing to a customer who had validly objected to direct marketing, and then gave him wrong information about how to stop it. The full timeline in the Garante's decision runs like this:

• October 2 and December 9, 2025: the customer objects to marketing through customer service, after already setting the opt out in the app.
• December 10, 2025: customer service replies that only email communications can be adjusted, that the app is the same for every customer, and that he can simply ignore the pop ups.
• March 11, 2026: he files a complaint with the Garante.
• May 13, 2026: after the regulator's information request, BBVA corrects his profile and the notifications stop.
• September 3, 2026: the Garante adopts the decision.

The decision was first announced in the Garante's newsletter no. 551 of September 11, 2026, and the European Data Protection Board summarized it on October 9.

Why Didn't the Sync Failure Defense Work?

Because a technical failure explains a violation; it does not excuse one. In its defense brief of July 22, 2026, BBVA argued the problem was "un difetto tecnico di coordinamento di sistemi interni puntuale e isolato" (a one off, isolated defect in coordinating internal systems). The customer's choice, it said, was correctly recorded in the bank's systems. It simply never reached the CRM unit responsible for sending commercial communications.

The Garante turned that argument around. Saying the objection was recorded but not applied, it wrote, "equivale a confermare che la Società non ha dato seguito alla richiesta" (amounts to confirming the company did not act on the request), despite the customer having correctly exercised his right to object. The regulator also noted that after the second complaint in December 2025, BBVA already had everything it needed to run the same internal checks it eventually ran only in May 2026.

The legal anchor is Article 21(3) of the GDPR: where a person objects to processing for direct marketing, "the personal data shall no longer be processed for such purposes." There is no balancing test and no legitimate interest override, unlike objections to other kinds of processing. The text speaks of purposes, not channels or systems.

Can a Company Insist You Object Through a Specific Email Address?

No. A company can offer preferred channels, but it cannot ignore an objection that arrives through another reasonable one. BBVA complained that the customer had only contacted customer service, without using the rights mailbox or the DPO address listed in its privacy policy. The Garante replied that those indications cannot "autorizzare il titolare ad ignorare manifestazioni di volontà" (authorize the controller to ignore expressions of will) that the person had correctly made through the app settings and to customer service.

It went further: the in app setting was the bank's own standard procedure, so the later calls to customer service were "un di più," an extra confirmation of a choice already properly expressed. The regulator leaned on the EDPB Guidelines 01/2022 on data subject rights, which state there are no specific format requirements for a request, and on Article 12, which obliges controllers to facilitate the exercise of rights.

Why Is the Fine So Large for One Complaint?

The fine scales with the company, not with the number of people harmed. The Garante itself rated the intensity of the violation as low: seven months, one data subject, contact data, negligent rather than intentional conduct. It then noted that BBVA's turnover exceeds €500 million and that the cap is 4% of worldwide annual turnover, following the method in the EDPB Guidelines 04/2022 on calculating fines.

Two aggravating factors pushed it up. First, medium responsibility for not training customer service properly. Second, a prior decision: in provvedimento no. 413 of July 10, 2025, the Garante had already found BBVA's late reply to an access request unlawful. The mitigating factor was that BBVA fixed the problem while the investigation was running.

Put the numbers side by side. With at least ten unwanted notifications, the fine works out to at most about €550,800 per notification. Under Italian law BBVA can also settle by paying half, €2,754,000, within the appeal window, which still leaves roughly €275,000 per notification. Most coverage leads with the headline figure; for compliance teams the bigger signal is that a low intensity, single complainant case still produced a seven figure fine once the controller's size and a repeat finding on rights handling entered the calculation.

What This Means for Your Inbox

The most revealing line in the case is the customer service reply that "si possono regolare solamente le comunicazioni tramite email" (only email communications can be adjusted). Many companies treat each channel as its own consent silo: an unsubscribe link for email, a toggle for push, a keyword for SMS. Article 21(3) does not care about the plumbing. Object to direct marketing once, and the objection should reach every channel that markets to you.

That matters because marketing email is often run by a separate email service provider with its own suppression list. If the CRM, the push platform and the ESP do not share one source of truth, an opt out can die in the gap exactly as it did at BBVA. We covered a smaller version of the same failure when a Romanian company kept sending marketing emails after opt out requests, and California's record CCPA case showed Disney failing to apply opt outs across its services.

The same regulator is also tightening the rules on what marketing emails do once opened. Its guidelines on email tracking pixels, provision no. 284 of April 17, 2026, require prior consent for pixels that measure open rates, with a six month compliance window that runs from the April 29 Gazette publication and closes at the end of October 2026. Read together, the two actions say that both whether you get marketing and how it watches you are now enforcement priorities in Italy.

What Should Compliance Teams Check Now?

Test whether a single objection actually stops every marketing message, end to end. The Garante's order asks BBVA for technical and organizational measures that let rights requests be handled "senza ingiustificato ritardo ed in modo corretto" (without undue delay and correctly). A practical checklist drawn from the case:

1. Map every marketing channel. List each system that can send promotions: email service provider, push and in app messaging, SMS, telemarketing vendors, and ad audiences built from customer lists.
2. Use one suppression record. Store the objection once, keyed to the person, and have every sending system read from it rather than keeping separate unsubscribe lists.
3. Monitor the sync. Alert when an objection recorded in the core system has not appeared in the CRM, ESP or push platform within a set time. BBVA's objection sat unsynced for months.
4. Accept objections from any reasonable channel. App settings, replies to customer service, chat and email all count. Route them into the same record instead of redirecting people to a DPO mailbox.
5. Train frontline staff. The aggravating factor here was an agent saying pop ups could not be switched off. Give scripts that name every opt out route.
6. Audit with seeded accounts. Opt test customers out, then check for any promotional message on any channel over the following weeks.
7. Answer within one month. Article 12(3) requires a reply to rights requests without undue delay and at the latest within one month.

What Can Customers Do If Marketing Will Not Stop?

Keep evidence and escalate to the regulator. This complainant won because he could show the dates of his objections and the notifications that followed. If you are in the EU, the steps are simple:

• Object in writing through any channel the company offers, and keep screenshots of app settings and dated copies of messages.
• Screenshot every marketing message that arrives after your objection, with its timestamp.
• If nothing changes within a month, file a complaint with your national authority. The EDPB list of national data protection authorities links to each one.

The Garante is not slowing down on marketing cases. On October 12, the EDPB posted another Italian decision, a €16.7 million fine against Wind Tre for unlawful telemarketing. For companies, the BBVA lesson is narrower and harder: recording a no is not enough. The no has to reach every system that sends.