AI agent to find customers: what you can automate and where GDPR stops you (the project I turned down)

A sales AI agent can do almost all the back office work that finding customers takes: picking the right companies, updating the CRM, telling your callers whom to call and when. It cannot give you the right to call mobile numbers taken from a contact enrichment service without marketing consent. That is why I turned down a month-long project.

In October 2026 I had a nineteen-minute discovery call with a company that sells services to large enterprises. The contact came in through the form on our website, with a clear request: a partner to build an AI agent for the sales process. It was work I would have liked to do, and the person writing had already decided to move. At minute 18 we said goodbye without a project, and the reason matters to anyone who wants an agent to help them sell.

What can an AI agent automate to find customers?

The project I was asked for is a good example because it is complete. The agent was meant to become the single interface of the sales back office, on top of a CRM with about 12,000 contacts by the client's estimate. Here are the steps, with my take on each:

Four steps out of five were doable, and I told him so. Connecting an AI agent to the CRM is work we already do, call minutes can be attached to the right person and company, and a periodic check for job changes is a textbook agent task: it wakes up, checks, reports. If you want the full picture of what already exists for salespeople, I lined it up in AI assistants for salespeople.

The problem was step three: a service that finds managers' mobile numbers, sometimes personal ones, and about which neither of us could say whether it kept the consent of the people concerned. I put it like this: "it is not a grey area, it simply cannot be done" without marketing consent. I also told him on what condition I would have said yes: numbers from a service that records consent.

His answer was as honest as mine: in the way they sell, the phone is the channel that works, and without the numbers the project lost its point. My no was not to the whole project, it was to one line. Except that, for him, that line was the project.

Can you call mobile numbers found by a contact enrichment service?

No, not without each person's marketing consent. In Italy, a mobile number found online or bought from a list provider does not become usable for marketing just because it exists: the Italian data protection authority, the Garante privacy, has written that the presence of data in public lists or in freely accessible sources, such as websites or social networks, does not authorise its use for promotional purposes (Garante privacy, decision of 17 May 2023).

The risk does not stay with whoever sells the numbers: it reaches whoever uses them. For the Garante, consent given to the first collector does not cover later transfers (Garante privacy, decision of 16 January 2025). The fines of the last two years show it:

Sales calls with a human operator are governed in Italy by article 130 of the Privacy Code (Normattiva, Legislative Decree 196/2003, art. 130), and since 2022 the national do-not-call register also covers mobile numbers (Normattiva, Presidential Decree 26/2022). But the register is the list of people who said no: it does not make lawful a number you should not have had in the first place.

Here you find what the decisions say and how I made mine: this is not legal advice, and your specific case needs a lawyer.

How do you do lead generation with an AI agent without breaching GDPR?

The answer is not to give up the agent: it is to change where the numbers come from and let the agent work on what you are entitled to use. In practice:

1. Take contacts only from sources that can prove each person's marketing consent, and spot-check it. That is what the Garante asked of those who buy lists: free and specific consent, and spot checks on the data received (newsletter of 30 May 2025, cited above).
2. Check the do-not-call register every month and before every campaign. In Italy it is an obligation for anyone making sales calls, with or without a human operator (Normattiva, Law 5/2018, art. 1, paragraph 12). An agent can do this very well.
3. Give the agent the contacts that are already yours: whoever fills in the form on your website, the people you meet at events, your existing customers. Qualifying them as soon as they arrive is one of the five AI agent use cases I have actually put to work.
4. Record where every number comes from. If tomorrow someone asks how you got their mobile number, the answer must be in the CRM, not in the memory of whoever built the list.

Why did I say no to a month of work?

This no cost me about a month of work: that is my own estimate of what it would have taken to build the agent he described and put it into production. For a company our size a month is not a detail, and pretending it is would make this article less true.

It was not only ethics, and I say so because that is how it went. On the call I gave him the other reason too: I work with Italian bar associations, and in November I have three talks at three different ones. If word got out that I build agents that call numbers collected without consent, the problem would be mine, and it would be one of reputation. Here values and reputation pushed in the same direction. It happens more often than you think: a value held consistently also becomes what the market knows about you.

The first value in our charter is People First: before the systems come the people. In this story the people were not on the call. They would have been the managers receiving, on their personal phone, a call from someone they had never given their number to. In the charter we put it this way: when you get AI and data wrong, "the damage lands on someone who was not in the room".

I do not judge people who sell through cold calls: it is how many companies have always worked, and the person who called me was direct and fair from start to finish. But an agent I build carries my name inside the process, and the clients and partners I choose say who I am.

What is a company values charter for?

A company values charter is there to decide in advance what you will say no to, even when saying yes pays. Our Company Values Charter has eight values, from People First to territorial renewal. So far it could be anyone's charter. Two things make it useful.

The first: each value has a test that the people working with us can run from the outside. For data ethics the test is this: for every part of the project that uses AI you must be able to see three lines, which tool, which data leaves, who approved it. If one is missing, we do not start. On this call the second one was missing: the data, and where it came from.

The second: a section called "What is not negotiable for us", with a subtitle that explains why the charter exists: "A values charter matters only if it also helps us say no". Shortcuts on ethics and privacy are on that list.

What it gives us, in practice:

• fast decisions. I already knew which question to ask, where the contacts come from and with what consent, and at minute 13 I had the answer. No proposal to write, no week of negotiation to reach the same point;
• a no that is not personal. I did not have to improvise a position: it was already there, written and public;
• clients and partners who resemble us. Whoever reads the charter and does not recognise themselves does not call us, and whoever has not read it meets it at the first question, as on this call;
• a rule for agents too. The charter binds me, our collaborators and the AI agents working for the company. An agent has no ethics of its own: it has the rules you write for it.

The backlash is just as concrete: you lose revenue, your market shrinks, and sometimes you look rigid to someone asking for something plenty of others do. It applies to clients and to partners: I would rather have none than work with people who put profit before people. A value that has never cost you anything is not a value, it is a description.

How do you write a company values charter that holds?

A values charter that holds is written from what you have already turned down, not from how you would like to look:

1. Start from the noes you have already said. The reason you turned down a job is your real value. If a value has never made you give anything up, remove it or rewrite it.
2. Give every value a test that can be checked from the outside. "We put people first" is something nobody can verify. "Ask us for the names of the people we listened to before proposing the solution" is.
3. Write the list of what you do not do, even when paid. It is the part that works hardest.
4. Use it on the first call, not after the proposal. On a request for a sales agent, my first question now is where the contacts come from, and with what consent.
5. Publish it. A charter in a drawer helps you decide. A public charter works even when you are not there: whoever reads it and does not recognise themselves does not write to you.

I closed the call by leaving him the public link to a connector I had already released, so another supplier can use it for the part of the project that could be done. No commitment on either side. We parted with no hard feelings and no door left ajar. The network of clients and partners you have is made of the people who accepted your conditions: if you want it to resemble you, write down first what you will say no to.

Frequently asked questions

Can you use an AI agent to find customers and still comply with GDPR?

Yes, if the agent works on contacts you are entitled to use. It can pick companies, update the CRM, qualify the leads coming from your website, check the do-not-call register and tell your callers whom to call and when. It cannot make lawful a number collected without consent: if the mobile numbers come from a service that cannot prove each person's marketing consent, the problem stays yours even if the agent does the work.

Can I use a service that finds managers' mobile numbers to call them for sales?

Only if the service can prove it holds those people's marketing consent, and you check that consent before calling. The Italian Garante privacy has written that data found in freely accessible sources is not, for that reason, usable for promotional purposes (decision of 17 May 2023), and in 2025 it fined both a provider of lists enriched with mobile numbers and the agencies that used them. A specific case needs legal advice.

What is a company values charter?

A company values charter is a public document that states how a company works and what it does not do, even when it would pay. To be useful it needs three things: values written in concrete terms, a test for each one that clients and partners can run from the outside, and an explicit list of what is not accepted. A charter that has never made you turn down a client describes how you would like to look: it does not help you decide.