Italy fines Tim 9.5 million euros for privacy and telemarketing violations

Italy's data protection authority has fined Telecom Italia (Tim) 9.5 million euros for numerous privacy and telemarketing violations. The penalty targets abusive call centers operating on behalf of Tim, which used unauthorized phone numbers to illicitly gather user data. Customers believed they were speaking with authorized Tim agents.

The investigation originated from approximately 7,000 complaints in 2025 regarding unwanted promotional calls made for Tim. The authority noted that these calls often used unregistered or spoofed numbers, frequently targeting individuals listed on the public registry of objectors.

“

the illicit scheme with which the agencies operated, starting from the receipt of unwanted calls on lines regularly registered with the Rpo by telephone operators who, disguising the caller number (spoofing), propose the activation of Tim offers or services.

Tim's justifications, including adherence to a code of conduct, were deemed insufficient by the authority. The Garante emphasized that Tim remains obligated to oversee its partners and ensure data protection measures are applied throughout the telemarketing chain. The authority also found Tim systematically failed to comply with data subject rights, including slow or absent responses to requests for access, deletion, and opposition. Furthermore, Tim's unsubscription procedures were found to be overly complex and sometimes non-functional.

In addition to the fine, Tim must revise its lead generation processes, strengthen controls over its sales network, and update its procedures for handling data subject rights. The authority's investigation revealed an illicit scheme where agencies used spoofing to make calls, then sent customers a link to a partner website to request a callback. This generated a seemingly legitimate call flow and contracting process.

“

the authority has found the company's justifications insufficient: adherence to a code of conduct does not exempt the data controller from the obligation to supervise the work of its partners and to verify the effective application of data protection measures along the entire telemarketing supply chain.