The article frames France's move as a direct response to the failure of Bloctel, which registered 6 million numbers yet still left most French adults receiving unwanted calls weekly. The government concluded that opt-out is structurally broken and that flipping the default to explicit, per-company, per-purpose consent is the only workable protection.
Argues the story's real significance for developers isn't French cold-calling culture but that a major economy has made opt-in the legal default for a whole channel. The compliance burden lands on the software that dials, texts, and logs — meaning CRMs, sales-engagement tools, and dialers now have to model per-company, per-purpose, revocable consent as a first-class primitive.
By surfacing the Le Monde piece to HN's front page (862 points), the submitter highlighted the enforcement teeth: DGCCRF fines up to €75,000 for individuals and €375,000 for companies per finding, plus public naming of offenders. The implicit argument is that this level of penalty — not the rule change alone — is what differentiates this regime from Bloctel's toothless opt-out.
As of today, August 11, 2026, France has made unsolicited commercial telephone calls illegal by default. The law, passed in 2025 and taking effect this week, replaces the country's long-troubled Bloctel opt-out registry with a flat opt-in requirement: a business may only cold-call a French consumer if that consumer has given explicit, prior, and freely revocable consent — for that specific company, for that specific purpose.
The default has flipped: from 'you may call anyone who hasn't blocked you' to 'you may call no one who hasn't invited you.' The rule covers voice calls, SMS, and automated dialers. Consent given while signing up for one service does not transfer to a parent company, a subsidiary, or a partner. B2B calls to professionals are carved out, as are calls tied to the performance of an existing contract (your bank calling about your actual account, for example), and journalistic or polling outreach. Everything else — energy switching, insurance, home renovation, the entire cold-outbound economy — now requires opt-in.
Enforcement sits with the DGCCRF, France's consumer-protection authority. Penalties reach €75,000 for an individual and €375,000 for a company per finding, and the agency can publish the names of offenders. Le Monde reports that Bloctel, which at its peak carried some 6 million registered numbers, never really worked — surveys consistently showed the majority of French adults still received unwanted calls every week, and enforcement actions were rare relative to complaint volume. The government's read was that opt-out was structurally broken, so they scrapped it.
For developers, the interesting part isn't the sociology of cold-calling in France. It's that a G7 country just made opt-in the legal default for an entire outbound channel, and the compliance surface lands squarely on the software that dials, texts, and logs. If you ship a CRM, a sales-engagement platform, a call-center product, an SMS API, a dialer SDK, or a lead-gen tool with any French user or French recipient in scope, the rule applies to you as much as to the caller.
This is the third time in a decade the EU has quietly moved a marketing channel from opt-out to opt-in, and every time the industry claimed the sky would fall and every time it didn't. GDPR did it for behavioral tracking in 2018. The ePrivacy enforcement wave did it for cookies in 2020-2022. France is now doing it for voice. Germany already had a de facto opt-in regime under the UWG; Spain moved in 2023. The direction of travel across the bloc is not subtle, and it would be a mistake to treat this as a French quirk rather than a preview.
The technical implications are more interesting than 'add a checkbox.' Consent has to be auditable, per-purpose, and revocable, which means real schema work: a consent event needs a timestamp, a source, a scope (which legal entity, which product line, which channel), a proof artifact (the form as rendered, ideally hashed), and a revocation trail. Most CRM data models still treat consent as a boolean on the contact record, which is roughly the maturity level of storing passwords in plaintext. Expect a wave of retrofits, and expect the vendors who already did this work for GDPR Article 7 to have a substantial head start.
The community reaction on Hacker News, where the story hit 862 points, was overwhelmingly positive and almost entirely from people who don't live in France — the classic 'we want this too' response that has followed every EU privacy regulation since 2016. The more grounded French commenters flagged the obvious risk: enforcement. Bloctel died because nobody prosecuted violations at scale. If the DGCCRF doesn't materially step up, opt-in becomes opt-out with extra paperwork. The €375,000 ceiling and the naming-and-shaming power suggest they intend to actually use it, but the first year of enforcement data will tell.
If you touch outbound telephony or SMS with any EU exposure, three things are worth doing this quarter. First, model consent as a first-class entity, not a flag. A `consents` table with `(subject_id, controller_id, purpose, channel, granted_at, revoked_at, proof_ref)` gets you 80% of the way there and covers you for the next round of ePrivacy tightening, not just France. Twilio, MessageBird, and Vonage already expose consent-aware APIs; if you're rolling your own dialer, this is where to start.
Second, geo-gate at the dialer, not at the campaign. The moment a lead's phone number resolves to a French country code (+33) or a French mobile prefix, the outbound path should require a consent lookup before the call connects, and the log should record which consent record authorized it. Doing this at campaign-config time is fragile — a single mislabeled list and you're on the DGCCRF's docket. Doing it at the socket-open layer costs a millisecond and is provable in an audit.
Third, expect your customers to ask for a 'compliance mode' toggle. Sales teams using your tool will not read the law; their legal departments will, six weeks late, and will demand a feature that blocks non-consented French dials by default with a signed audit trail. Ship it before they ask. The vendors who treated GDPR as a feature rather than a nuisance — OneTrust, Segment's consent APIs, Cookiebot — turned regulation into a moat. There is a similar opening here for whoever builds the reference outbound-consent SDK for the JavaScript and Python dialer ecosystems.
The interesting question isn't whether other EU countries follow — they will, probably within 24 months, because the political economy of banning cold calls is roughly the same as banning robocalls in the US, and the US did that (weakly) with the TCPA decades ago. The interesting question is whether AI voice agents get folded in. The law as written covers automated dialing, which arguably captures the current generation of Retell, Bland, and Vapi-style outbound voice bots. If the DGCCRF reads it that way — and there's no reason to think they won't — the entire 'AI SDR' category has a compliance problem in France starting today, and the same problem is coming everywhere else the moment a regulator notices. Worth reading the statute, not the press release.
This is a great move by France, but most of the rest of the world does not suffer from the telemarketing scam hell that Americans do.I am a US citizen living overseas. I have a US cell number that is only used for 2FA for US financial institutions. No one else has that number. I get more scam calls
My pet peeve is that a full class A attestation is still not a requirement in 2026. The US FCC won't do it. I have no hope from the current administration. However, perhaps France is in a unique position to implement this. The idea is that all calls that have a domestic caller ID will be requir
Kudos to France. But the problem isn't telemarketing calls. It's the wholesale grab-fest of phone numbers from every.damn.nook.and.crany of the US soil. Hospitals, Car dealers, dentists, vets, brokerages, title offices... literally EVERY one of them is leaking YOUR information to everyone
> On the other hand, France's new law has raised concerns in Morocco, where Employment Minister Younes Sekkouri, said in March that between 40,000 and 50,000 jobs were at risk in the country’s call centers. Sekkouri said the French market accounts for more than 80% of revenue in the sector.N
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
Great idea!Telemarketers have ruined the phone network for me. I haven't answered an unknown call for the past 10 years, which sometimes means I miss important ones. 99.9% of all calls are an attempt to get money, and the 0.1% that's a dentist appointment, a friend that changed numbers or