SMS is a particularly effective direct marketing channel. That is also why it is strictly regulated: a message lands directly on its recipient’s personal phone. Before launching a campaign, you need to know the rules that apply in France.
This article summarises the main obligations, which come from the GDPR and the French Post and Electronic Communications Code (article L34-5), as presented by the CNIL, the French data protection authority.
Consumers (B2C): prior consent is mandatory
To send a commercial SMS to a consumer, you must have obtained their prior consent. This is the « opt-in » principle.
This consent must be:
- freely given: the person must not be forced into it, for example to access a service;
- specific: it covers receiving commercial messages by SMS;
- informed: the person knows who will contact them and why;
- unambiguous: it results from a positive action, such as ticking a box. A pre-ticked box does not count as consent.
In practice, on your forms (sign-up, order, competition, loyalty card), add a dedicated box that is unticked by default, for example: « I agree to receive offers from [your brand] by SMS ».
The existing customer exception
There is a useful exception: you may send commercial SMS to your own customers without specific consent, provided three conditions are met:
- the person is already a customer (they have bought a product or service from you);
- your messages concern similar products or services to those they bought;
- they were informed, when their number was collected, of this use and could object to it simply and free of charge.
This exception does not cover prospects, products unrelated to the original purchase, or offers from your partners.
Businesses (B2B): information and the right to object
SMS prospecting aimed at professionals follows a more flexible regime. Prior consent is not required if the message is related to the recipient’s profession. Offering point-of-sale software to a restaurant owner, for example, falls within this scope.
The professional must nevertheless have been informed of the use of their details and be able to object at any time, simply and free of charge.
Be careful: a business mobile number is often also its holder’s personal number. When in doubt, apply the most protective rule.
What every commercial SMS must contain
Whoever the recipient, every prospecting message must:
- clearly identify the sender: the name of your company or brand, for example as the SMS sender name;
- offer a simple, free way to unsubscribe: the well-known « STOP » mention, for example « STOP to 36xxx ».
Every opt-out request must be handled promptly, and the number excluded from your next sends. A professional sending platform manages this opt-out list for you: that is one of the benefits of using a dedicated tool rather than a phone.
Transactional SMS are not prospecting
Not all SMS fall under these prospecting rules. Transactional or service messages accompany an existing relationship:
- order or appointment confirmations;
- dispatch or delivery notices;
- appointment reminders;
- verification codes (OTP);
- security alerts or information about a contract.
They do not require marketing consent, provided they remain purely informative. As soon as a confirmation SMS includes a promotion, it becomes a commercial message again and the prospecting rules apply.
Data: retention, proof and security
The GDPR also sets rules for managing your contact list.
- Retention period: the CNIL recommends keeping a prospect’s data for no more than three years from when it was collected or from the last contact initiated by them (click, reply, purchase). After that, ask them whether they want to keep receiving your messages, or delete their data.
- Proof of consent: keep the date, the source (form, shop, competition) and the wording shown at collection. In the event of an inspection, it is up to you to prove consent.
- Bought or rented lists: they can only be used if the people agreed, when their details were collected, that they could be passed on to partners for SMS prospecting. Ask your supplier for that proof.
- Security and processors: your SMS provider processes your data on your behalf. It must offer sufficient guarantees, set out in a data processing agreement.
Bloctel and SMS: don’t confuse the two
Bloctel is the French opt-out list for telephone canvassing, in other words phone calls. It does not apply to SMS. This is not a loophole: commercial SMS to consumers are already subject to prior consent, a stricter rule than an opt-out list.
Good practice that goes beyond the law
Complying with the law is the minimum. For your campaigns to be well received:
- Send at considerate times: during the day and on weekdays. The profession’s codes of conduct recommend avoiding sends in the evening, at night, on Sundays and on public holidays.
- Limit the frequency: a few useful messages a month are better than constant pressure, which drives opt-outs up.
- Keep your promises: if you collected a number for service alerts, don’t turn it into a promotional channel.
- Clean your list regularly: invalid numbers, contacts inactive for a long time, people who have opted out.
What happens in case of a breach?
Breaches of the prospecting rules can be penalised by the CNIL. Under the GDPR, fines can reach €20 million or 4% of annual worldwide turnover. Beyond the financial risk, an unsolicited SMS does lasting damage to a brand’s image.
In summary
| Situation | What you need |
|---|---|
| Commercial SMS to a consumer | Prior consent (opt-in) |
| Commercial SMS to an existing customer, for similar products | Information at collection and the option to object |
| Commercial SMS to a professional, related to their job | Information and the right to object |
| Transactional SMS without promotion | No marketing consent |
| Any commercial SMS | Identified sender and STOP mention |
The SMS Reflex platform includes opt-out (STOP) management and lets you track every send. Discover our plans or contact us to prepare a compliant campaign.
This article presents the general rules that apply in France. It does not replace legal advice tailored to your situation.
