Answers to the questions that arise most often, with the article cited alongside wherever the answer follows from a rule.
Questions and answers
Does the law distinguish between calling and emailing?
No. Article 13 of Directive 2002/58/EC sets a single regime for unsolicited communications for direct marketing purposes, and the national transpositions follow it. What varies between Member States is not the channel but the choice the Directive expressly left to national law in article 13(3): whether communications not covered by paragraphs 1 and 2 require consent or merely the absence of objection. In Portugal, the criterion is the recipient: prior express consent for natural persons, opt-out for legal persons, whatever the channel.
Article 13 of Directive 2002/58/EC
Can we market to our own customers without consent?
Within defined limits, yes. Article 13(2) of Directive 2002/58/EC allows a provider to use electronic contact details obtained from its customers for direct marketing, but imposes four cumulative conditions: the details were obtained from the customers themselves; in the context of the sale of a product or service; the marketing concerns the provider’s own and similar products or services; and the customer was given a free and easy means of objecting, both at the point of collection and in every message. If one condition fails, the exception falls away and consent is required again.
Article 13(2) of Directive 2002/58/EC
What happens when someone objects to direct marketing?
Processing for that purpose stops, immediately and without any balancing of interests. Article 21(2) of Regulation (EU) 2016/679 gives the data subject the right to object at any time to processing for direct marketing purposes, including profiling related to it, and article 21(3) provides that the data shall no longer be processed for those purposes. Unlike the general right of objection in article 21(1), no reasons need be given and no compelling legitimate grounds can override it.
Article 21(2) and (3) of Regulation (EU) 2016/679
Will the ePrivacy Regulation replace the current rules?
Not in the foreseeable future. The proposal for a Regulation on privacy and electronic communications was formally withdrawn by the European Commission, with the withdrawal published in the Official Journal in October 2025, on the grounds that no agreement was in prospect and that the proposal had been overtaken by legislation adopted since. Directive 2002/58/EC therefore continues to apply, as transposed by each Member State — which means the divergence between national regimes is durable, not transitional.
Commission communication C/2025/5423
We serve Spanish customers from Portugal. Does Spanish law apply to us?
Very likely. Ley 10/2025 of 26 December applies to undertakings established in Spain or in another State, provided they operate in Spanish territory. It covers providers of services of general interest and all large undertakings — 250 or more employees, turnover above €50 million or a balance sheet above €43 million. It has been fully enforceable since 28 December 2026 and its waiting-time and human-attention requirements are markedly more demanding than the Portuguese ones.
Ley 10/2025 (Spain)
Your question is not here
Put it directly. Recurring questions are added to this page.