Proving Your Contacts’ Consent: The Compliance Checklist as of August 11, 2026

Updated on September 3, 2026. Sources: Légifrance, DGCCRF, CNIL.

Since August 11, 2026, the burden of proof has shifted: it is now up to the business making the call to demonstrate that it had obtained consent. This is the most direct provision of the August 11, 2026, law on telemarketing, which stems from Law No. 2025-594 of June 30, 2025, which amends Article L223-1 of the Consumer Code.

Decree No. 2026-662 of July 23, 2026, published in the Official Journal on July 25, specifies what a consent request must include and how long the supporting documentation must be retained. This page is a checklist: it lists what must be time-stamped, retained, and made available in the event of an audit. Print it out and check off the items.

Valid Consent: The Six Criteria

Article L223-1 requires free, specific, informed, unambiguous, and revocable consent, expressed through a clear and affirmative act. Specifically:

• Opt-out: Refusal does not deprive the person of the service or quote they requested.
• Specific: The consent applies to a specific item, not to “any commercial communication.”
• Informed: The person knows who will call them and why at the moment they check the box.
• Unambiguous: There is no ambiguity. Any doubt works against you, since the burden of proof is on you.
• Revocable: Consent can be withdrawn at any time, including verbally, even during the call.
• Clear, positive act: neither silence, nor inaction, nor a pre-checked box.

What Your Consent Request Must Include Under the Decree of July 23, 2026

Article R223-1 of the Consumer Code, which stems from the decree, requires that a request be clear and understandable. It lists five mandatory statements, which we detail here in six points. If even one is missing, the consumer is not deemed to have given consent: your form will then not constitute admissible evidence.

1. The Professional’s Identity

The name of the entity making the call must be provided, as well as the name of any third party calling on its behalf. If the data collection is handled by a partner, a comparison site, or an agency, the consumer must know exactly who will be calling. A statement such as “our partners” is not sufficient.

2. The nature of the goods or services in question

Advertise the actual scope of the offer rather than “our offers”: loan insurance, home furnishings, software subscriptions. This scope defines the limits of the call. Selling anything other than what was advertised amounts to making a call without consent.

3. The decision to consent or not

People should be able to say “no” just as easily as “yes”: two visible options, given equal visual weight, with nothing pre-filled. A form that offers only “I agree” does not provide a choice.

4. The consent period

The decree limits the validity to one year from the date of collection, and this duration must be specified in the application. The text expressly rules out any tacit renewal: consent obtained on September 3, 2026, expires on September 3, 2027, and nothing automatically extends it. This is an expiration date that must be maintained in the database.

5. The Right of Withdrawal and How to Exercise It

The request must specify that consent may be withdrawn at any time, and by what means. Article R223-3 establishes a requirement for symmetry: the procedures for withdrawal cannot be more complex than those for obtaining consent. Consent given with two clicks cannot be withdrawn by certified mail.

6. Access to Proof of Consent

One final point, which is most often overlooked: the consumer must be informed that, upon request, they may access proof of their consent. This proof must be provided to them free of charge, on a durable medium, on an individual basis, and within a reasonable time. If you use an online interface, authentication cannot require the creation of a customer account.

What Does Not Constitute Consent

• Terms of Service accepted in their entirety: consent must be specific.
• A pre-checked box: that’s not a positive action.
• A purchased or rented file: The permission granted to a third party is not transferable to you.
• Consent obtained for a different purpose: a roofing estimate does not constitute agreement to an energy service offer.
• Silence, or the fact that he didn’t pull the trigger.
• Signing up for a newsletter: agreeing to receive emails does not mean agreeing to receive phone calls.
• A call made to seek consent: On August 5, 2026, the DGCCRF reiterated that it is not permitted to call a consumer for the purpose of obtaining their consent to receive unsolicited sales calls.
• A pre-written statement or simply continuing to browse a website: neither constitutes a clear affirmative act.

The 12-Point Checklist

1. Segment your database into consumers and business professionals. Article L223-1 applies only to consumers. B2B cold calling remains permissible under certain conditions, based on legitimate interest. Two sets of rules, two approaches.
2. Map out your data collection points (web form, landing page, trade show, incoming call, partner). For each one: Does it result in explicit consent over the phone, or just an email address?
3. Rewrite each request to include the five items listed in Article R223-1, and date the revised version.
4. One checkbox per channel, never pre-checked. A single “I agree to be contacted” checkbox covering email, text messages, and phone calls is not specific enough.
5. Time-stamp each collection: date and time, exact source or URL, form version, and channel. Without a time stamp, you have nothing to present.
6. Keep a record of the evidence, not just a simple “yes.” A Boolean field does not prove that the person read the text: save the exact wording that was displayed. It must remain available to the consumer upon request.
7. Set an expiration date of one year and automatically block the call after that date within the tool—without relying on the sales representative to keep track of it.
8. Record the purpose of the consent and verify that the call stays within that scope. The script must adhere to this scope: call regarding the exact matter the person requested—that is the principle behind calling consenting leads.
9. Process the withdrawal, including verbal withdrawals. If the person withdraws their consent during the call, the agent should record it immediately—not through a ticket processed the following week.
10. Count the calls: a maximum of 4 per consumer over a rolling 30-day period (Article D223-9). Attempts count, even if no message is left: the count is based on the numbers dialed, not on completed calls. And this limit also applies to contacts who have given their consent.
11. Lock in the time slots in the tool: Monday through Friday, 10 a.m.–1 p.m. and 2 p.m.–8 p.m., in the customer’s time zone. Saturdays, Sundays, and holidays are off-limits, except for phone appointments scheduled by the customer for a specific date and time, which you must keep a record of.
12. Appoint a person in charge and conduct a dry run. Pick a random number, ask for proof, and time it. If no one knows where to look, compliance is only theoretical.

One thing needs to be made clear: no software can make a company compliant. It is the organization that ensures compliance: the way you draft your forms, who you call, and what you say. The tool tracks, time-stamps, locks, and retrieves data—it transforms a written rule into a technical constraint. Be wary of claims that promise the opposite.

How long to retain what

Element	Duration	What is it for?
Proof of consent (wording, timestamp, source)	3 years from the date of collection	To respond to an audit and make it available to consumers upon request. Retention is extended only for the purpose of exercising or defending legal rights
Validity of Consent	Up to 1 year from the date of collection	Knowing the date when the call is no longer covered
Call and Attempt History	Rolling 30-day window	Demonstrate compliance with the limit of 4 calls in 30 days

The retention periods for personal data also comply with the rules set forth by the CNIL regarding telemarketing. Keeping data longer “just in case” exposes you to risk without providing any benefit.

Frequency and schedules: what you need to be able to prove

These two rules, established by Article D223-9 of the Consumer Code, are recorded in the same call log. The limit of four calls per consumer over a rolling 30-day period includes all attempts: a number that rings unanswered counts as one call. Many teams count conversations, thinking they’re at two when they’re actually at seven.

Permitted hours are Monday through Friday, 10 a.m.–1 p.m. and 2 p.m.–8 p.m., in the consumer’s time zone. Contact outside these hours is prohibited, including on holidays, and you must be able to provide the exact time of each attempt. Helpful reminder: Bloctel was discontinued on August 11, 2026, and replaced by the opt-in system. Checking an opt-out list is no longer one of your obligations, whereas building a consent-based database is now your responsibility.

Your existing database is not authorized: actual options

A purchased database does not become compliant simply by adding a column labeled “consent: yes.” Consent given to a third party on their own behalf does not cover you; there is no retroactive rectification, and you cannot call these contacts to ask for their consent. What remains possible, in order of reliability:

• Sort out what is actually documented. Part of your database comes from your own forms: if you can find the wording and the timestamp, you have proof. Otherwise, the entry is not authorized.
• Transfer business contacts to the B2B framework, with information provided at the time of collection and a simple, free right to opt out, if the purpose of the solicitation is related to their profession.
• Check the exception to the current contract: solicitation remains permissible with a customer under contract if it relates to the purpose of that contract, including for additional services or services that improve performance.
• Seek consent through a channel that remains open to you, using a form that complies with the five requirements of Article R223-1. The resulting volume will be much smaller than the file size. This is the only justifiable approach.
• Waive the non-recoverable portion. The administrative fine may amount to up to €75,000 for an individual and €375,000 for a legal entity per violation; these penalties are cumulative in the event of concurrent violations, and the decision must be published at the expense of the penalized party. Furthermore, any contract entered into as a result of an unlawful solicitation is void.

And if your business involves energy conservation or the production of renewable energy, adapting housing for the elderly or people with disabilities (Article L223-1), or the personal training account (Article L6323-8-1 of the Labor Code), the question doesn’t even arise: cold calling is completely prohibited in these cases, and consent does not change that in any way. There are two exceptions: the fulfillment of an existing contract, and a follow-up call to a consumer who has personally requested information, within five business days and limited solely to the subject of their request (Article R223-4).

Frequently asked questions

Is consent obtained before August 11, 2026, still valid?

An old agreement—one that does not include the five requirements listed in Article R223-1 and lacks a timestamp—will be difficult to defend, since the burden of proof is on you. The analysis depends on the specific situation: please refer to Decree No. 2026-662 of July 23, 2026.

Will telemarketing be completely banned as of August 11, 2026?

No. It is prohibited to call a consumer for commercial solicitation purposes without prior consent. Marketing between businesses is still permitted under certain conditions; the exception for existing contracts remains in effect (Article L223-1, fourth paragraph), and the press is subject to its own regulations (Article L223-5), though it is still subject to the same time restrictions and call limits.

How can a consumer opt out of telemarketing calls?

They no longer need to register anywhere: without their consent, sales calls are prohibited. If they have given consent, they may withdraw it at any time, including verbally during the call. The procedures are outlined in the DGCCRF’s practical guide.

This article reflects the legal situation as of August 15, 2026, and does not constitute legal advice. Reference:Article L223-1 of the Consumer Code in effect as of August 11, 2026.

On the tooling side. Many of these aspects depend on the system that stores your contacts and triggers your calls: timestamping, one-year expiration, automatic blocking, call attempt logs, and locked time slots. Kavkom’s hybrid CRM brings together contact records and telephony in the same environment, eliminating the need to merge two export files when proof is required. It tracks everything; the decision is yours. Request a demo to see how it works for your specific cases.