SpainLey Orgánica 3/2018 (LOPDGDD), Advertising Exclusion Systems (Article 23)
Ley Orgánica 3/2018, de 5 de diciembre, art. 23
In force since .
A commercial messages rule binding public and private bodies.
- Obligation class
- Data subject rights, Prohibition
As of .
What it requires
- Before you carry out direct marketing communications, consult the advertising exclusion systems that may affect your action and exclude from the processing the data of the people who have expressed their opposition or refusal; consulting the systems on the list published by the competent supervisory authority is enough (Article 23(4)).
- You need not consult the systems for a person who consented, under Ley Orgánica 3/2018, to receive the communication from you (Article 23(4)).
- When a person tells you they do not want their data processed to send them commercial communications, inform them of the existing advertising exclusion systems, which you may do by referring them to the information the competent supervisory authority publishes (Article 23(3)).
What this law does
Article 23(1) makes lawful the processing of personal data whose purpose is to avoid sending commercial communications to people who have expressed their refusal or opposition to receiving them. It allows general or sectoral information systems to be created by the associations and bodies referred to in Article 40(2) of Regulation (EU) 2016/679 that have high representativeness, in which only the data indispensable to identify the people concerned are included.
These systems may also include preference services through which people limit the commercial communications they receive to those from certain companies. Article 23(3) requires a controller, when a person tells it they do not want their data processed to send them commercial communications, to inform them of the existing advertising exclusion systems.
Article 23(4) requires anyone who intends to carry out direct marketing communications to consult first the advertising exclusion systems that may affect their action, and to exclude from the processing the data of the people who have expressed their opposition or refusal. Consulting the systems included in the list published by the competent supervisory authority is enough to meet that duty.
The consultation is not necessary when the person has consented, under the Organic Law, to receive the communication from whoever intends to send it. Final provision 4 of Ley 10/2025, de 26 de diciembre, rewrote article 23(1). Ley 10/2025 entered into force on .
When LexLint raises it
When your app profile says your app sends automated outreach.