France flips telemarketing to opt-in — the GDPR playbook, again

What happened

France is scrapping the opt-out model for telemarketing. As of August 11, 2026, under the law adopted in 2025 to combat unsolicited commercial calls, businesses can no longer cold-call French consumers unless they have obtained explicit, prior, and specific consent — and can prove it. Le Monde reports the shift applies to phone, SMS, and automated dialers alike, and covers both live agents and prerecorded messages. The previous regime, built around the Bloctel do-not-call registry, is effectively obsolete: rather than asking consumers to raise their hand and say *stop*, the law now requires companies to first get them to raise their hand and say *go*.

The penalties are not decorative. Individual fines run up to €75,000, and corporate fines up to €375,000 per infraction, with the DGCCRF (France's consumer-protection watchdog) empowered to enforce. Consent must be freely given, informed, unambiguous, and revocable at any time — language that will sound extremely familiar to anyone who has read Article 7 of the GDPR. A narrow carve-out remains for calls tied to the performance of an existing contract (your bank calling about your actual account, say), but marketing-adjacent "we noticed you might like…" outreach to a cold number is now illegal by default.

France becomes the first major EU economy to move telemarketing fully to an opt-in regime, and the mechanical parallel to the 2018 GDPR rollout is impossible to miss. Germany already requires prior consent for B2C cold calls under the UWG; France's move pulls the rest of the bloc's center of gravity in the same direction.

Why it matters

If you build software for sales, growth, or customer contact, this is not a French problem — it is a schema problem. The GDPR taught the industry that "we have a lawful basis somewhere" is not a defense; you need a per-record, timestamped, revocable consent artifact you can produce on demand. The French telemarketing law imports that same evidentiary standard into voice and SMS. Every dialer, CRM, CDP, and enrichment vendor now has to answer a question their data model was probably not designed to answer: *for this phone number, on this date, under what specific purpose, do we have documented consent?*

The uncomfortable truth is that most lead-gen pipelines were built for the opposite world. Data brokers scrape, enrich, and resell numbers under a "legitimate interest" fig leaf that has never been tested at trial in the way it's now about to be. When the burden of proof flips, the entire scraped-list economy loses its default lawful basis and has to reconstruct one, record by record. Expect a wave of vendors quietly retiring French datasets, followed by a smaller wave of vendors loudly launching "consented French leads" at 10x the price.

The community reaction on Hacker News (944 points, and climbing) is telling: the top-voted comments are not French users celebrating — they're American and British developers asking why their own regulators can't manage the same thing. The FTC's Do Not Call registry, launched in 2003, is functionally broken; the UK's TPS is only marginally better. Spam volume in the US has arguably gotten worse since STIR/SHAKEN rolled out, because the enforcement mechanism is call-authentication, not consent. France's bet is that you fix the incentive at the source: no consent, no call, no exceptions, big fine.

There is a legitimate counter-argument, and it deserves airtime. Small businesses — plumbers, insurance brokers, local B2B services — genuinely relied on cold outreach as their cheapest acquisition channel. The French government's own impact study estimated the affected telemarketing sector employs roughly 30,000 people. Some of those jobs will not survive the transition, and the political calculus was that the annoyance to 67 million citizens outweighed the disruption to one industry. That's a defensible call, but it's a call, not a free lunch.

What this means for your stack

If your product touches French phone numbers in any commercial context, here is the concrete work:

Consent as a first-class field. Add a `consent_source`, `consent_timestamp`, `consent_purpose`, and `consent_evidence_url` (a link to the signed form, checkbox event, or recorded verbal confirmation) to every contactable record. If your CRM's consent model is a single boolean called `email_opt_in`, it is now legally insufficient in France and — read the wind — probably in Germany, Spain, and Italy within 24 months.

Purpose-scoped consent. "I agree to be contacted" is not enough; consent has to be tied to a specific commercial purpose. This means your consent UI probably needs to be redesigned, not just re-copied. Dark-pattern pre-checked boxes were already illegal under GDPR; they are now criminally reckless.

Revocation plumbing. Every consent artifact must be revocable through a mechanism at least as easy as the one that captured it. If a user consented via a web form, an unsubscribe link in an SMS is fine. If they consented verbally on a call, a mailed letter is *not* — you need an equally frictionless digital path. Wire it into your suppression list in near-real-time, not the next batch job.

Data lineage on enrichment. If you buy leads from Apollo, ZoomInfo, Cognism, or any of the dozens of European enrichment vendors, your contracts need indemnification for consent provenance and your ingestion pipeline needs to record which vendor supplied each French number and under what claimed basis. When the DGCCRF knocks, "we bought it from a reputable source" is not a defense — *you* are the data controller.

Geofencing your dialer. The lazy fix, which many US-headquartered SaaS vendors will quietly adopt, is to simply refuse to dial +33 numbers unless a consent artifact is attached. Expect "France mode" toggles to ship in Outreach, Salesloft, Aircall, and the rest within the quarter.

Looking ahead

The Brussels effect works in one direction: strict European rules become the global default, because it's cheaper to build one compliant product than to fork the codebase per jurisdiction. GDPR did this to cookie banners; France's telemarketing law will do it to consent schemas for voice and SMS. The interesting question is not whether the rest of the EU follows — Germany already has, and Spain is drafting — but whether the second-order effect finally forces American CRMs to stop treating consent as an afterthought bolted onto a contact record. If you're a platform engineer at a growth-stage SaaS, the safest bet is to assume that within three years, "prove consent for this specific outbound contact" will be a table-stakes API call in every serious CRM. Build the schema now and you'll ship it as a feature; build it in 2028 and you'll ship it as a lawsuit response.