[Enforcement library](/enforcement)

# BBVA Italy: recording an opt-out is insufficient when the sending system never receives it

BBVA received a EUR 5.508 million fine after promotional app notifications continued despite a customer's marketing objection.

## Key facts

- **Regulator or court:** Italian Data Protection Authority (Garante)
- **Jurisdiction:** Italy
- **Framework:** GDPR Articles 5(1)(a), 12, 21 and 24
- **Record date:** 2026-07-03
- **Procedural status:** Administrative fine and compliance order; later appeal status not established

BBVA received a EUR 5.508 million fine after promotional app notifications continued despite a customer's marketing objection.

Italian Data Protection Authority (Garante) · GDPR Articles 5(1)(a), 12, 21 and 24 · Decision: 3 July 2026

## The problem

A preference can be saved correctly in one service while the CRM or delivery queue continues to use an older state.

- The problem
- Case record
- What the authority found
- Outcome and limits
- Checks for your own systems
- How Inth helps
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Authority | Italian Data Protection Authority (Garante) |
| Jurisdiction | Italy |
| Law | GDPR Articles 5(1)(a), 12, 21 and 24 |
| Decision date | 3 July 2026 |
| Recorded fine | EUR 5,508,000 |
| Procedural status | Administrative fine and compliance order; later appeal status not established |
| Source review | 19 October 2026 |

Primary record: [Garante notice published on EDPB](https://www.edpb.europa.eu/news/italian-dpa-fines-bbva-eur-5-508-000-for-failing-to-respect-a-customers-objection-to-direct_en).

## What the authority found

The authority's notice says a customer objected through the bank's app and contacted customer service, yet promotional notifications continued for seven months. BBVA described a synchronisation failure between internal systems and its CRM unit. [Garante notice published on EDPB](https://www.edpb.europa.eu/news/italian-dpa-fines-bbva-eur-5-508-000-for-failing-to-respect-a-customers-objection-to-direct_en).

The authority found failures to give effect to the objection and facilitate the exercise of rights. It rejected the argument that the customer should have used a preferred email channel. [Garante notice published on EDPB](https://www.edpb.europa.eu/news/italian-dpa-fines-bbva-eur-5-508-000-for-failing-to-respect-a-customers-objection-to-direct_en).

## Outcome and limits

The authority imposed EUR 5,508,000 and ordered measures to handle requests correctly and promptly, with a report on compliance measures within 30 days of notification. The notice is not evidence of payment or a later appeal result. [Garante notice published on EDPB](https://www.edpb.europa.eu/news/italian-dpa-fines-bbva-eur-5-508-000-for-failing-to-respect-a-customers-objection-to-direct_en).

## Checks for your own systems

These are implementation checks suggested by Inth, not additional findings about the company.

- Follow a test objection from the user interface through the preference store, CRM and delivery queue.
- Check propagation failures, retries and queued campaigns, including notifications already scheduled.
- Make customer-service routes capable of applying the same suppression as the in-product control.

## How Inth helps

Code audit can expose changes to reviewed connectors and data flows for inspection.

A web consent record does not prove suppression in a separate CRM or mobile notification service. Inth Consent is not a global marketing-suppression system.

## Sources and limits

- [Garante notice published on EDPB](https://www.edpb.europa.eu/news/italian-dpa-fines-bbva-eur-5-508-000-for-failing-to-respect-a-customers-objection-to-direct_en)

Source review: 19 October 2026. This is a dated account of the cited authority decision. A recorded fine is not a confirmed payment. Later procedural developments are stated only where the linked record establishes them. Inth wrote the implementation checks; they do not establish legal compliance or replace legal advice.