Andy Garcia · freelance dev
FRENES
Back to the blog
Sales & Privacy

France Made Consumer Sales Calls Opt-In on August 11. Consent Now Expires Within a Year.

October 19, 2026 7 min read

On August 11, 2026, France flipped the default on sales calls. Since that day, a business may not phone a consumer to sell a good or a service, directly or through a third party calling on its behalf, unless that consumer agreed beforehand. Bloctel, the national list where consumers had to register to stop such calls, is over. The DGCCRF, France's consumer protection authority, says it in one line: the reform "met fin au dispositif Bloctel".

On October 19, the CNIL, the data protection authority, put online the replay of the webinar it ran with the DGCCRF on September 24. Two months in, the questions are practical ones.

I am CTO of a LegalTech, and I built BidForge, an AI that reads French public tender files for small businesses. Most of the people I build for sell to someone. So I read the texts on Legifrance rather than the summaries: article L. 223-1 of the Consumer Code as rewritten by article 13 of the law of June 30, 2025 "against all fraud on public aid", and decree 2026-662 of July 23, 2026, published in the Journal officiel on July 25. Paragraph III of article 13 and article 5 of the decree both set the same date: August 11, 2026. Unless left in French, quotes from the texts below are my translations.

What struck me is that the decree reads like a spec for a database table.

What changed on August 11

The new L. 223-1 bans calling a consumer "who has not expressed prior consent" to commercial prospecting by phone. Consent is defined as "free, specific, informed, unambiguous and revocable", given "by a clear positive act". And the burden is explicit: it is up to the business to prove that consent was collected under those conditions.

Two exceptions survive. A call made while performing a contract in progress, related to its object, including offers of complementary products or services. And prospecting for newspapers, periodicals and magazines (L. 223-5).

One family of calls is banned even with consent: services, equipment or works to adapt homes to ageing or disability, to save energy or to produce renewable energy. The DGCCRF adds the CPF, the personal training account, to the list. A detail that is easy to miss: since July 2, 2025, article L. 223-8 already extends the energy renovation and home adaptation ban to messaging services, email and social networks.

The decree reads like a schema

Article R. 223-1 lists what a consent request must contain. Five items: the identity of the business and of any third party calling for it, with the nature of the goods or services; the proposal to accept or refuse calls; the period, which "cannot exceed one year" from collection; the right to withdraw at any time, and how; and the right to access the proof. Consent cannot be renewed tacitly.

The same article says when there is no consent at all: if one of the five items was not given or is missing from the proof, if the call falls outside the consent period or the allowed hours, or if there was no clear positive act. A pre-written statement on a document does not count. Neither does "simply continuing to browse a website".

R. 223-2 is the storage spec. The business keeps, in digital form, the information shown, the date and time of consent, and any out-of-hours slot the consumer agreed to. It keeps them three years from collection, longer only to exercise or defend its rights in court. On request, it hands the proof over free of charge, on a durable medium, individually, within a reasonable time. It may do that through an online interface, but access cannot require creating a customer account. That last line is a product decision already made for you.

R. 223-3 closes the loop: withdrawal can be no more complex than collection, and it can be oral.

Read as a developer, that is a table: the consent text as shown (versioned), the company and product scope, granted at, expires at (at most one year later), an optional agreed slot, withdrawn at, and how. Plus two rules the dialer must enforce: no call after expiry, and no silent extension.

The older rules, which now bite harder

Hours and frequency predate the reform. Article D. 223-9, amended by the decree, allows calls Monday to Friday except public holidays, from 10:00 to 13:00 and 14:00 to 20:00, in the consumer's time zone, and no more than four calls or attempts per consumer in thirty calendar days per business, including through a third party. The DGCCRF FAQ, dated September 17, says the limit has applied since March 1, 2023, counts voicemails and missed calls, covers all of a person's numbers, and runs on rolling days. What is new: a consumer can explicitly agree to a precise date and time outside those slots, and that call still counts toward the four.

L. 221-16 still requires the caller to state its identity and the commercial nature of the call at the start. After the call, the offer must be confirmed on paper or a durable medium, and the consumer is bound only once they have signed and accepted it on a durable medium. What the reform added to that article on August 11: if the consumer objects, the caller must end the call without delay and not contact them again.

Two older lines of L. 223-1 matter more now. Any business that profited from unlawful calls is presumed responsible unless it shows it did not cause the breach, and the FAQ says outsourcing the calls, in France or abroad, changes nothing. And any contract concluded after an unlawful call "is void".

Article L. 242-16 caps the administrative fine at 75,000 euros for an individual and 375,000 euros for a company per breach, and as a rule the decision is published at the sanctioned party's expense. The DGCCRF's consumer note puts it as up to 75,000 euros "per call" for an individual. Abuse of weakness through phone canvassing carries up to five years in prison and a fine of up to 500,000 euros or 10% of turnover, according to the DGCCRF.

Calling businesses is a different regime

L. 223-1 protects consumers. For business prospects, the CNIL says calls can rest on the caller's legitimate interest when the subject relates to the person's profession. Its example: a call presenting software to a company's IT director. The person must be informed, for example when the number is collected, and be able to object simply and for free. For numbers bought from third parties, you have to make sure that information was given. The CNIL recommends a checkbox in both cases, and a pre-ticked box is prohibited for consent.

What the texts do not settle

The CNIL's own page says it will be completed by an FAQ written with the DGCCRF. Until then, some edge cases are open. The pages I read do not address a sole trader reached on a personal mobile.

Nor did I find a transition rule for consent collected before August 11. My reading, not the regulators': since R. 223-1 says there is no consent when one of the five items is missing from the proof, a list without those items on file is not a list you can call.

And none of the pages I read reports a sanction under the new regime yet. For now, the size of the risk is a legal cap, not a track record.

What I would do this week

Split the call list into consumers and business contacts. For every consumer number, find the proof. No proof, no call.

Collect consent where you already meet people: at purchase, in the shop, on a form, the examples the DGCCRF gives. Not by calling them. Its consumer note, dated August 5, is blunt: "Il n'est pas possible d'appeler un consommateur pour obtenir son consentement au démarchage téléphonique." You cannot call someone to ask whether you may call them.

Use an unticked checkbox, separate from the terms and conditions (the CNIL says accepting the terms cannot suffice), scoped to your company and your products, and store the exact text the person saw.

Put the expiry date and a rolling thirty-day counter, keyed on the person rather than the number, in the CRM, and make the dialer refuse the call. Agents should not have to remember a statute.

If a call centre or a lead seller works for you, ask for the proofs before the first campaign. The presumption of responsibility lands on you.

If you sell energy renovation or home adaptation, phone, email, messaging and social prospecting are closed. Outside a contract in progress, what remains is calling back after an explicit request, within five jours ouvrables (business days as French law counts them, Saturdays included), about the products asked for only, with proof of the request kept three years (R. 223-4).

Bloctel asked consumers to protect themselves. The new regime asks the seller to prove, person by person, that someone said yes within the last twelve months. That is a data problem before it is a sales problem.

Sources

A project like this one?

I design and deploy products like this. Let's talk.

Let's talk