August 11, 2026: cold calling banned without consent

As of August 11, 2026, France has made B2C cold calling opt‑in by default. Companies must be able to prove consent that is freely given, specific, informed, unambiguous, and revocable before any sales call.

Key facts

The ban stems from Law No. 2025‑594 of June 30, 2025, and Decree No. 2026‑662 of July 23, 2026. The French Consumer Code (Art. L223‑1 et seq.) requires prior opt‑in before calling French consumers, including calls placed from abroad. Non‑compliance may trigger administrative fines of up to €75,000 (natural person) and €375,000 (legal entity) per breach (Art. L242‑16). In cases of exploitation of vulnerability, criminal penalties may reach 5 years’ imprisonment and €500,000 (or 10% of turnover). The Bloctel system will be phased out in favor of opt‑in.

Legal basis and framework

• French Consumer Code — Articles L223‑1 et seq., amended by Law No. 2025‑594; Decree No. 2026‑662 detailing collection, storage, and withdrawal of consent.
• Administrative sanctions under Article L242‑16; alignment with the GDPR: the consent definition mirrors GDPR Article 4(11) and consent is the legal basis for B2C telemarketing in France.

For a broader view of consent duties and record‑keeping, see our page on the GDPR obligations relevant to marketing.

What changes for Luxembourg businesses

• Without valid opt‑in evidence, each call to a consumer located in France is a separate breach, creating major financial exposure.
• Opt‑out practices (do‑not‑call lists, buried clauses, pre‑ticked boxes, bundled multichannel consent) are no longer sufficient.
• Consent must be time‑limited (maximum one year under the regulations), documented (source, date/time, purpose, scope), and revocable “as easily as it was given.”
• Re‑filter ongoing campaigns and leads; require compliant proof from brokers.

If you need to align consumer law and data protection, our certified DPO support can help set up governance, opt‑in evidence, and data cleansing.

Immediate actions to take

• Map and purge: extract French numbers from CRM/CDP, delete those lacking compliant opt‑in proof (purpose “telemarketing,” date/time, source, duration ≤ 12 months), and pause related campaigns.
• Update consent journeys: add a dedicated unticked checkbox (“I agree to be called for marketing purposes”), state the duration (max. 1 year) and provide withdrawal that is as simple as giving consent; log timestamps, system traces, and wording versions.
• Secure your commercial supply chain: require opt‑in proofs and audit rights from call centers and lead brokers; train sales/support/DPO and update the register and retention/deletion policies.

Next steps

Need a rapid marketing compliance health‑check and a data remediation plan? Reach out via our contact page.

Article generated by Luxgap regulatory watch. For tailored guidance on this topic, contact us.