Key takeaways
- Since 11 August 2026, canvassing a consumer by telephone in France is prohibited without prior consent. Article 13 of Law no. 2025-594 of 30 June 2025 rewrites article L. 223-1 of the French Consumer Code, and Decree no. 2026-662 of 23 July 2026 sets out the practical rules. Silence, which used to mean acceptance, now means prohibition.
- Bloctel, the French opt-out register, disappears. An opposition list has no purpose once the principle is reversed.
- The burden of proof rests entirely on the caller. It is no longer a matter of showing the absence of an objection, but of producing a positive, named, dated and documented consent for every number dialled.
- Consent expires after twelve months at most and cannot be tacitly renewed. The proof itself must be kept for three years in digital form. A prospect database becomes a perishable asset that has to be re-qualified every year.
- Oral withdrawal during the call is expressly permitted. A "do not call me again" is enforceable immediately, whether or not it was captured in the CRM. This is the number one blind spot on contact center floors.
- Penalties reach €75,000 for an individual and €375,000 for a legal entity, doubled in the event of repetition, with publication of decisions, nullity of any contract concluded following an unlawful call, and possible accumulation with GDPR fines from the CNIL.
- Your call recordings become the evidence file. They prove your compliance or your breach. In insurance, where recording and two-year retention remain mandatory, that stock already exists and it can be seized during an inspection.
Scope: French law. This article describes the regime applicable in France since 11 August 2026. It does not describe the law of other member states, which remain free, under the ePrivacy Directive, to choose either a consent regime or an opposition regime for voice calls. The French text does, however, have extraterritorial reach: it applies to calls placed from abroad to French numbers, and inspections can target call centers established outside France as soon as they canvass French consumers. A principal operating with offshore floors therefore remains fully exposed.
What changed on 11 August 2026
The French regime for telephone canvassing has switched from an opposition logic to a consent logic. Until 10 August 2026, calling a consumer was lawful in principle, unless that consumer had registered on Bloctel. Since 11 August, the call is unlawful in principle, unless prior and provable consent exists.
The legal foundation rests on two texts. Article 13 of Law no. 2025-594 of 30 June 2025 against all forms of public-aid fraud rewrites article L. 223-1 of the Consumer Code. Decree no. 2026-662 of 23 July 2026, published in the Official Journal of 25 July, sets out how consent is to be collected, kept and withdrawn, rewriting articles R. 223-1 to R. 223-4 and repealing the provisions governing the opt-out register.
The definition of consent is taken from the GDPR: a freely given, specific, informed, unambiguous and revocable expression of will, through a clear affirmative act. A pre-ticked box, an acceptance buried in general terms, or a generic agreement to receive "commercial offers" do not meet those conditions.
The practical consequence weighs more than the change of principle: it is for the professional to prove that consent was obtained under the required conditions. There is no longer a comfortable waiting position in which the absence of complaints stood in for compliance.
The six obligations now borne by the caller
The decree of 23 July 2026 turns a legal principle into very concrete operational obligations. They come down to six points.
| Obligation | What the text requires | What it changes on the floor |
|---|---|---|
| Disclosures at collection | Identity of the professional (and of any third party acting on its behalf), nature of the goods or services, duration of the consent, right of withdrawal and how to exercise it | The collection script must be rewritten and actually spoken, not merely displayed |
| Capped duration | Twelve months maximum from collection, with no tacit or implied renewal | Every consent carries an expiry date; the database must be re-qualified each year |
| Digital proof | Three-year retention: exact content of the request, date and time, identification of the person, nature of the products, agreed duration | An internal note saying "consent obtained" is worthless during an inspection |
| Availability to the consumer | The consumer may request their proof and receive it on a durable medium; authentication cannot consist of creating a customer account | A retrieval journey must exist, with no deterrent friction |
| Withdrawal | At any time, by a means no more complex than that used for collection, oral withdrawal during the call being expressly permitted | A refusal spoken on the phone must reach the system, immediately |
| Days and hours | Framework of article D. 223-9: Monday to Friday, 10am-1pm and 2pm-8pm, never on Saturdays, Sundays or public holidays | Time-slot management becomes a documented control point, not a good practice |
A call outside those slots remains possible in one case only: the consumer has explicitly agreed to be called at a precisely specified date and time, and the professional can evidence it.
A compliant collection wording brings the four disclosures together in a single intelligible sentence: "I agree to be called by [named professional] about [nature of the goods or services], for a period of [twelve months maximum], on the understanding that I may withdraw this consent at any time by [method]." Anything vaguer is open to challenge. Anything longer will not actually be spoken by advisors.
The exceptions, and exactly where they break
The text provides for two exceptions, one sector-specific safety valve and three absolute prohibitions. None of them is as broad as people hope in the meeting room.
The ongoing contract. The call remains lawful if it takes place as part of the performance of an ongoing contract and has a direct connection with the subject matter of that contract. This is the most widely used exception, and the most fragile. The breaking point is drift: a service call that shifts towards an unrelated offer leaves the exception and becomes canvassing without consent. On contact center floors, that drift is culturally encouraged, often rewarded, and rarely measured.
The written press. Canvassing for the sale of newspapers and periodicals escapes the prohibition, but remains subject to the permitted days and hours.
Three sectors are prohibited even with consent: energy renovation and energy-saving works, adapting homes for ageing or disability, and the personal training account (CPF). One safety valve exists: a call back in response to an express request for information from the consumer, within five working days, strictly limited to the goods or services for which they asked to be called.
B2B remains outside the scope of L. 223-1, which targets consumers. Business-to-business prospecting continues to fall under the GDPR (legal basis, information, simple right to object) and, for SMS and email, under article L. 34-5 of the French Postal and Electronic Communications Code. Beware of grey areas: craftspeople, self-employed professionals and micro-entrepreneurs canvassed on a mixed-use product.
Pre-existing databases do not switch over automatically. A file built or acquired before 11 August 2026 is not usable simply because it existed. Old, generic consent does not demonstrate agreement to be called by the named professional, on the category of products concerned, within the last twelve months. And deficient proof cannot be completed retroactively.
What is at stake
The penalty regime combines four layers, and it is their accumulation that creates the real risk.
| Layer | Penalty | Authority |
|---|---|---|
| Administrative | Up to €75,000 (individual) and €375,000 (legal entity) per breach, doubled in the event of repetition | DGCCRF |
| Reputational | Publication of sanction decisions | DGCCRF |
| Civil | Nullity of the contract concluded following an unlawful call, with a presumption of liability for the professional who profited from the breach | Civil courts |
| Personal data | Up to €20m or 4 % of worldwide turnover, cumulative with the administrative fine | CNIL |
Two points deserve particular attention. First, nullity of the contract does not merely strike the call: it destroys the revenue that call produced, along with the commissions paid and the accounting reversals that follow. Second, the presumption of liability of the beneficiary exposes the principal to the faults of its subcontractor or its intermediary, including offshore. Investigative powers also allow unannounced inspections in call centers, including at floors established abroad as soon as they canvass French numbers.
Finally, an unconsented call combined with insistence, pressure or false credentials may be reclassified as a misleading or aggressive commercial practice, which opens the criminal route.
Who enforces, and with which counters
The structural novelty is not only the reversal of the principle: it is the triangulation of regulators around a single criterion, the existence of valid and provable consent. One and the same unconsented call is simultaneously a consumer-law breach, a data processing operation without a legal basis and, if it travels over a poorly authenticated number, a telecoms policing matter.
| Authority | Remit on this text | Concrete lever |
|---|---|---|
| DGCCRF | Lead regulator for canvassing | Investigations, unannounced inspections in call centers, injunctions, administrative fines, publication of sanctions |
| CNIL | Validity of consent, data brokerage | Recommendation of 12 March 2026 clarifying the new framework, inspections, injunctions with penalty payments, GDPR fines |
| Arcep | Numbering, authentication and call filtering | Number ranges dedicated to canvassing, caller number authentication mechanism, administrative investigation opened in early 2026 into number-holding operators |
| ACPR | Insurance and banking | Duty to advise, recommendation 2024-R-03, on-site and desk-based inspections, published named sanctions |
| AMF | Financial investment advisers | Inspections and sanctions on banking and financial canvassing |
| Trade federations | Code of good practice provided for by L. 223-1, made public | Compliance with the code will become a factor in assessment during inspections |
The counters that will trigger inspections are public, and they are already pointing in one direction.
| Indicator | Value | Reading |
|---|---|---|
| SignalConso reports, all grounds (2025) | 461,936 | Record volume |
| Of which telephone canvassing (2025) | 113,926, first national ground | 27,974 in 2023, a fourfold increase in two years |
| DGCCRF fines, all subjects (2025) | €202m, record year | Of which around €11m on telephone canvassing |
| DGCCRF inspections on canvassing (2024) | About 6,300 establishments, 270 sanctions, about €3.5m | Baseline for the first assessment of the new regime |
| Number spoofing reports to Arcep | Over 19,000 in 2025, against 531 in 2023 | The expected technical circumvention of the law |
These figures are the official thermometer of the reform. A marked fall in the SignalConso counter in 2027 will be read as success; a plateau will trigger a tightening. Either way, the companies named in reports will form the inspection queue.
The regulatory calendar stacking on top
11 August is not an isolated event. It sits within a sequence that, for regulated sectors, runs through to 2027.
| Date | Text or event | Effect |
|---|---|---|
| 31 December 2025 | ACPR recommendation 2024-R-03 enforceable | Documented and personalised duty to advise for all insurance distributors |
| 1 January 2026 | Arcep measures on number authentication | Masking of French mobile numbers that cannot be authenticated when calls come from abroad, minimum 45-day delay before a number is reassigned |
| 12 March 2026 | CNIL recommendation | Confirms and details the consent framework for canvassing |
| 1 June 2026 | Ordinance no. 2026-2 and Decree no. 2026-3 of 5 January 2026 | Transposition of EU Directive 2023/2673 on distance marketing of financial services |
| 2 August 2026 | AI Act fully applicable | Frames the use of analytical AI, requires human oversight and transparency |
| 11 August 2026 | Law no. 2025-594 and Decree no. 2026-662 | Mandatory prior consent, end of Bloctel |
| 1 January 2027 | Two-step telephone sales generalised for financial services | Written confirmation of the offer before any signature |
One insurance-specific point is often misread: the ordinance of 5 January 2026 rewrote article L. 112-2-2 of the French Insurance Code, removing the two-step sale rules introduced in 2021, while maintaining the obligation to record pre-contractual telephone communications and to keep them for two years. In other words, the recording obligation remains, the two-step sale returns in another form on 1 January 2027, and the stock of recordings stays enforceable throughout.
The blind spot: oral withdrawal spoken during the call
This is the quietest provision of the decree, and the one that will generate the most breaches. Withdrawal of consent may be expressed orally, during the call. It is enforceable the moment it is spoken. It requires no formality, no letter, no ticked box.
Yet on a contact center floor, a significant share of those refusals never reaches the system. The reasons are ordinary, which is exactly what makes them systemic:
- the advisor is at the end of the conversation, under handling-time pressure, and the disposition codes offered in the tool do not exactly match what was said;
- the refusal was voiced in the middle of the call rather than at the end, and was then covered over by the rest of the exchange;
- the individual interest of the advisor or of the floor is not to burn a record that can still be called back;
- the refusal was expressed at a subcontractor, and the feedback loop to the principal is asynchronous, when it exists at all.
Every untraced refusal mechanically manufactures a subsequent unlawful call. And the scissor effect is brutal: the proof of that breach is your own recording. An inspection has nothing to reconstruct. It listens to the conversation in which the refusal was spoken, then looks at the call logs.
No written procedure protects against this risk, because the risk arises from the gap between the procedure and the actual conversation. The only effective control is to compare two sets: withdrawals actually voiced in calls, and withdrawals recorded in the CRM. The gap between them is the number one risk indicator of the new regime. Today it is unknown in almost every organisation, because nobody listens to enough calls to calculate it.
The proof is already in your recordings
The new regime moves the center of gravity of compliance: from an obligation to act towards an obligation to prove. And the raw material of that proof already exists, in bulk, in a resource most companies retain without ever using.
In regulated sectors it is not even optional. In insurance, recording pre-contractual communications and keeping them for two years remain mandatory. Those files can be seized during an inspection. They contain the proof of what was said, including everything nobody ever listened to.
It is a double-edged weapon, and it should be stated plainly: a recording proves compliance just as readily as breach. The only variable is who listens to it first. Today, in a typical organisation, manual quality control covers 2 to 5 % of conversations. In other words, in 95 % of cases the company has no idea what its own piece of evidence contains.
AI-powered conversational analysis changes that equation, not by adding a layer of surveillance, but by making an already-constituted stock readable. It allows a shift from a listened sample to an exhaustive review, and produces, call by call, a timestamped record of what was actually said. On this point, see our article on sales compliance in regulated sectors, and our complete guide to quality monitoring in call centers.
The nine points to check on 100 % of calls
The text translates directly into criteria that can be verified inside a conversation. Here is the minimum scorecard that any organisation calling consumers should apply, whatever its tooling.
| # | Control point | What triggers it |
|---|---|---|
| 1 | The advisor identifies themselves and identifies the professional on whose behalf they are calling, from the opening | The whole law rests on a named professional |
| 2 | They state the nature of the goods or services concerned | Mandatory disclosure under the decree |
| 3 | Where consent is being collected, they state the duration, twelve months maximum | Mandatory disclosure under the decree |
| 4 | They indicate the possibility of withdrawing consent and how to do so | Mandatory disclosure under the decree |
| 5 | They can answer the question "where did you get my number?" | Direct indicator of how solid the consent chain is |
| 6 | Any refusal or withdrawal expressed orally is acknowledged, with no attempt to recover after a clear refusal | Oral withdrawal is enforceable immediately |
| 7 | For a call based on an ongoing contract, the subject stays directly connected to that contract | Exit from the exception in case of commercial drift |
| 8 | For a call back in a prohibited sector, the subject stays limited to the original request, within five working days | The only safety valve for energy renovation, home adaptation and the CPF |
| 9 | No aggressive practice: insistence after a refusal, pressure on the decision, false credentials, false urgency | Risk of reclassification as a misleading or aggressive commercial practice |
These nine points are expressed in plain language because they are verified in plain language. In Raisetalk, an evaluation grid is written in the words of the business, by the compliance officer directly, with no technical configuration. Each criterion produces a score and, above all, the conversation excerpt that justifies it. It is that traceability by example, rather than the overall score, that gives a report its value in an inspection. To go further into the evaluation mechanics, see our overview of AI quality monitoring.
The indicators to put in place now
Telephone prospecting dashboards were built for a regime that no longer exists. The answer rate, long the king of production reporting, loses its status as a directing indicator: it measures the ability to reach people, at a moment when the question has become the ability to reach them lawfully. Outsourcers themselves acknowledge the shift towards conversion rate on consented leads, post-call NPS and twelve-month retention. A useful calibration point: the conversion rate of an unqualified outbound campaign was already stuck between 1 and 2 % before the reform.
Here are the indicators that replace the old ones, and what they reveal.
| Indicator | Target | What it reveals |
|---|---|---|
| Share of outbound calls backed by valid, unexpired consent | 100 % | Raw exposure to sanction risk |
| Gap between oral withdrawals detected and withdrawals recorded in the CRM | 0 | The structural leak in the system, invisible otherwise |
| Median delay between an oral withdrawal and its effective application | Under 24 hours | The organisation's ability to react in time |
| Share of collections containing the four mandatory disclosures | 100 % | The legal quality of the consent collected |
| Share of "ongoing contract" calls that drifted off subject | As low as possible | Involuntary exit from the exception |
| Consents expiring within 30, 60 and 90 days | Actively managed | The re-consent pipeline, which conditions next year's activity |
| Rate of compliant consent capture on inbound calls | Rising | The main lawful source feeding the database |
| Compliance with days, hours and frequency | 100 % | The simplest control to produce, and the first one requested |
The seventh indicator deserves a word. Because consent expires after twelve months and is not tacitly renewed, the inbound call becomes the strategic resource of outbound canvassing. Every inbound conversation, every service call, every contact linked to an ongoing contract is a lawful opportunity to collect or renew consent. Organisations that start measuring this capture rate now will have a usable database in twelve months. The others will discover their problem when their file has expired.
Where to start
The right sequence is not to redesign everything, but first to establish a factual baseline of what is actually being said in your calls.
- Choose a pilot scope: one campaign, one team, or one call reason with high consumer volume.
- Analyse one month of conversations on that scope with the nine-point scorecard, to obtain a starting picture rather than an impression.
- Calculate the withdrawal gap: how many refusals were spoken, how many reached the CRM, and how long it took. That is the figure that triggers decisions.
- Fix the propagation chain first, before touching the scripts. A perfect script on a leaking chain protects nothing.
- Rewrite the collection script around the four disclosures, and verify through analysis that it is actually spoken, not merely circulated.
- Set up the expiry pipeline at 30, 60 and 90 days, and measure the capture rate on inbound calls.
- Document: keep, for each period, a timestamped report of the compliance level observed and of the corrective actions taken. In an inspection, demonstrating an active control system counts as much as the raw result.
On capturing every call upstream of that chain, see our article on SIPREC recording from your telephony infrastructure. On reporting the findings, see AI summaries and PDF report exports.
One clarification that is not a detail. Analysing 100 % of conversations to prove that a control system works is not the same thing as monitoring employees, and the two do not fall under the same legal regime. The AI Act, fully applicable since 2 August 2026, classes the evaluation of people at work among high-risk uses. The line to hold is simple: measurement bears on the process and on compliance with legal obligations, the decision remains human, and analysis serves coaching rather than sanction. See our approach to hybrid analysis, automatic and manual.
Key terms
- Opt-in: a regime in which prospecting is lawful only after the prior agreement of the person. It replaces opt-out in France since 11 August 2026.
- Opt-out: a regime in which prospecting is lawful as long as the person has not objected. That was the logic of Bloctel.
- Bloctel: the French telephone canvassing opposition list, in force since 2016, abolished on 11 August 2026.
- Consent (within the meaning of the GDPR and L. 223-1): a freely given, specific, informed, unambiguous and revocable expression of will, through a clear affirmative act.
- Withdrawal of consent: revocation by the person, at any time, by a means no more complex than that used for collection. Oral withdrawal during the call is permitted.
- Durable medium: a medium allowing the person to store the information so as to be able to refer back to it later, without alteration. A customer account that has to be created is not one.
- DGCCRF: the French consumer protection and fraud control authority, lead regulator for telephone canvassing.
- SignalConso: the public platform through which consumers report breaches, and the main entry point for DGCCRF inspections.
- CNIL: the French data protection authority, competent on the validity of consent under the GDPR.
- Arcep: the French electronic communications and postal regulator, competent on numbering and call authentication.
- Caller number authentication mechanism: the system imposed on operators to verify the authenticity of the calling number and to block or mask unauthenticated calls.
- Nullity of the contract: retroactive cancellation of a contract concluded following a call made in breach of the law.
Find out what your calls actually contain
- Try it for free: app.raisetalk.com/try
- Contact us: www.raisetalk.com/contact
11 August 2026 does not make telephone canvassing impossible in France: it makes it either provable or unlawful, with no state in between. The organisations that come through the reform unharmed will not be the ones with the best-written procedures, but the ones that know what their conversations actually contain: where consent was properly collected, where a refusal was spoken without being heard, where a service call drifted away from its subject. That material already exists, it is recorded, and in regulated sectors it is even retained by law. The only question left is who listens to it first.
Sources
- Law no. 2025-594 of 30 June 2025 against all forms of public-aid fraud, article 13, rewriting article L. 223-1 of the Consumer Code.
- Decree no. 2026-662 of 23 July 2026 on the collection, retention and withdrawal of consumer consent for telephone prospecting purposes.
- French Consumer Code, articles L. 223-1 to L. 223-7, version in force on 11 August 2026.
- DGCCRF, telephone canvassing rules applying to companies. SignalConso figures and inspection volumes from the DGCCRF 2025 annual report.
- CNIL, telephone prospecting outside automated calling systems, and recommendation of 12 March 2026.
- Arcep, consumer protection, number authentication and spoofing reports.
- Ordinance no. 2026-2 of 5 January 2026 on distance marketing of financial services, rewriting article L. 112-2-2 of the French Insurance Code.

