BBVA Italy: recording an opt-out is insufficient when the sending system never receives it
BBVA received a EUR 5.508 million fine after promotional app notifications continued despite a customer’s marketing objection.
The problem
A preference can be saved correctly in one service while the CRM or delivery queue continues to use an older state.
€5.51m
- Regulator or court
- Italian Data Protection Authority (Garante)
- Jurisdiction
- Italy
- Framework
- GDPR Articles 5(1)(a), 12, 21 and 24
- Decision
- Procedural status
- Administrative fine and compliance order; later appeal status not established
Failed opt-out controls · Opt-outs across devices or services
Case record
- Italian Data Protection Authority (Garante)
- Italy
- GDPR Articles 5(1)(a), 12, 21 and 24
- 3 July 2026
- EUR 5,508,000
- Administrative fine and compliance order; later appeal status not established
- 19 October 2026
Primary record: Garante notice published on EDPB.
What the authority found
The authority’s notice says a customer objected through the bank’s app and contacted customer service, yet promotional notifications continued for seven months. BBVA described a synchronisation failure between internal systems and its CRM unit. Garante notice published on EDPB.
The authority found failures to give effect to the objection and facilitate the exercise of rights. It rejected the argument that the customer should have used a preferred email channel. Garante notice published on EDPB.
Outcome and limits
The authority imposed EUR 5,508,000 and ordered measures to handle requests correctly and promptly, with a report on compliance measures within 30 days of notification. The notice is not evidence of payment or a later appeal result. Garante notice published on EDPB.
Checks for your own systems
These are implementation checks suggested by Inth, not additional findings about the company.
- Follow a test objection from the user interface through the preference store, CRM and delivery queue.
- Check propagation failures, retries and queued campaigns, including notifications already scheduled.
- Make customer-service routes capable of applying the same suppression as the in-product control.
How Inth helps
Code audit can expose changes to reviewed connectors and data flows for inspection.
A web consent record does not prove suppression in a separate CRM or mobile notification service. Inth Consent is not a global marketing-suppression system.
Sources and limits
Source review: 19 October 2026. This is a dated account of the cited authority decision. A recorded fine is not a confirmed payment. Later procedural developments are stated only where the linked record establishes them. Inth wrote the implementation checks; they do not establish legal compliance or replace legal advice.