Italy’s data protection authority, the Garante, has fined BBVA’s Italian branch €5.508 million after a customer kept receiving promotional messages despite opting out through the bank’s app and telling customer service to stop. The decision, published 3 September 2026, turns on a straightforward problem: the customer’s marketing preference never reached the systems doing the sending.
The customer objected to promotional messages through the BBVA app and raised the same objection with customer service on 2 October and 9 December 2025. Marketing notifications continued anyway, until May 2026. The Garante counted at least ten unwanted promotional notifications over that seven-month stretch.
BBVA told the regulator the opt-out had been recorded correctly inside the bank’s own systems but never synchronised with the database used by its CRM team to manage commercial sends. The bank called it an isolated technical coordination issue, limited to one customer.
An opt-out that didn’t travel
The Garante wasn’t persuaded that the technical explanation let BBVA off the hook. The bank argued the customer hadn’t used the dedicated addresses listed in its privacy policy for exercising data protection rights. The regulator disagreed: a company can’t ignore a clearly expressed objection just because it arrived through a different, equally legitimate channel. The customer had used the app’s own settings and then repeated the objection to customer service, itself the bank’s first point of contact.
Worse, on 10 December 2025 BBVA’s customer service told the customer that the in-app promotional pop-ups couldn’t be turned off and could simply be ignored. BBVA later fixed the customer’s profile and stopped the notifications within weeks of the Garante’s enquiry, which rather undercut that answer.
The authority found breaches of GDPR Articles 5, 12, 21 and 24: fairness and transparency, the duty to facilitate and respond to rights requests, the right to object to direct marketing, and the general duty to have adequate organisational measures in place. BBVA has since said it fixed the synchronisation fault and added technical, organisational and training measures.
What it means for marketing operations
One customer’s complaint, but the lesson travels. Capturing an opt-out is the easy part. It then has to propagate to every system capable of firing a campaign: CRM, app, email platform, call-centre scripts, the lot. A preference centre that says no while a downstream system still says yes hasn’t delivered an opt-out at all.
The Garante rated the severity of the underlying infringement as low. The €5.508 million figure came instead from BBVA’s turnover (above €500 million), inadequate customer-service training, and a prior Garante decision against the bank in July 2025 over a separate slow response to an access request. BBVA also got some credit for fixing the fault once the investigation was under way.
Consent and suppression data are operational data. If they can’t move reliably across the stack, the compliance problem doesn’t stay inside the preference centre.