The Italian data protection authority (Garante) communicated on the scale of unlawful telephone marketing and recalled the synergies between data protection and consumer protection during a public conference.

During a meeting with consumer associations, the authority revealed having received over 37,000 reports of unsolicited telephone marketing during the first seven months of 2026, more than 170 per day, after recording over 104,000 in 2025. It highlighted the existence of an illegal personal data market fueling these practices. Since 2020, sanctions imposed for these breaches have exceeded €200,000,000. In addition to fines, the authority has ordered the confiscation of illegally acquired databases to prevent their reuse. The Garante also drew attention to other forms of surveillance, such as invisible tracking pixels embedded in emails, which allow the collection of information on message consultation without the recipients' knowledge.

The authority recalled that, according to the Court of Justice, consumer associations can take legal action for GDPR violations without having received a mandate from the data subjects. It emphasized two principles: loss of control over one's data constitutes harm in itself, without a minimum severity threshold, and the action of associations does not require an individual mandate. This two-tier protection system was highlighted: on the one hand, public oversight exercised by the Garante through its investigations and sanctions, and on the other hand, collective action led by associations, which can lead to compensation for consumers. The authority's decisions establishing a violation can thus serve as evidence in the context of these reparations actions.