AI Voice Agents in France: CNIL, End of Bloctel & Cold Calling Compliance (2026)

AI Cold Calling in France: 2026 Overview

France treats unsolicited telephone marketing as a high-risk activity. Three layers of regulation overlap whenever an AI voice agent dials a French number: the Code de la consommation (consumer code, articles L223-1 and following on demarchage telephonique, rewritten from 11 August 2026), the General Data Protection Regulation enforced domestically by the CNIL, and the EU AI Act (Regulation 2024/1689), whose Article 50 transparency obligations apply from 2 August 2026.

Two government bodies do most of the enforcement work. CNIL handles GDPR breaches, illegitimate processing of personal data, and call recording violations. The DGCCRF (Direction generale de la concurrence, de la consommation et de la repression des fraudes) handles consumer code violations, including the prior-consent rule and the demarchage hour rules (and, until 11 August 2026, Bloctel). Both have taken visible action against telemarketing operators in the last three years.

For background on how France compares to other European markets, see our country-by-country GDPR cold calling guide and our AI caller disclosure laws by country overview.

What Does CNIL Require for Voice AI?

The CNIL is France's independent data protection authority, founded under Loi Informatique et Libertes (Law No. 78-17 of 6 January 1978). For AI voice agents, CNIL expectations follow GDPR but add specific French interpretations:

• Lawful basis under GDPR Article 6. CNIL distinguishes between B2C (where prior consent is the safer route, given the consumer code overlay) and B2B (where legitimate interest under Article 6(1)(f) can apply, provided a documented Legitimate Interests Assessment supports it).
• Information to the data subject (Articles 13-14 GDPR). Callers must identify the controller, the purpose, the lawful basis, retention period, recipients, and the data subject's rights, at the start of the call.
• Right to object (Article 21 GDPR). The AI must recognise opt-out language and immediately stop processing for prospecting purposes.
• Data minimisation and retention. CNIL recommends 3 years from last contact for prospect data and tighter limits for call recordings (typically 6 months for quality assurance).
• DPIA for large-scale automated processing. Voice AI campaigns at any meaningful volume usually qualify under CNIL DPIA criteria: systematic monitoring, large-scale processing, innovative technology.

“The use of artificial intelligence systems must comply with the GDPR. Innovation and protection of fundamental rights are not opposed - they reinforce each other when companies build accountability into their systems from the start.”

Prior Consent Since 11 August 2026 (End of Bloctel)

Until 11 August 2026, France ran an opt-out system. Bloctel, the national do-not-call list established by the Loi Hamon of 17 March 2014 and operational from 1 June 2016, let consumers register their numbers, and every professional canvassing consumers had to scrub its lists against it before calling. That regime has ended: Articles L223-3 and L223-4 of the Code de la consommation, which set up the Bloctel list, are repealed since 11 August 2026.

The Prior-Consent Rule

Since 11 August 2026, Article L223-1 of the Code de la consommation, as amended by Article 13 of Law No. 2025-594 of 30 June 2025, prohibits telephone canvassing of a consumer who has not given prior consent. The consent must be free, specific, informed, unambiguous and revocable, given by a clear positive act, and the professional must prove it. Decree No. 2026-662 of 23 July 2026 sets the details: consent is valid for one year at most, with no tacit renewal, proof is kept for three years, and the consumer can withdraw at any time, including orally. Scrubbing a list against Bloctel is no longer enough: without prior consent, a cold canvassing call to a consumer is not allowed.

Who the Rule Covers

• B2C numbers: fully covered. Every canvassing call to a consumer needs prior consent, whether or not the number was ever on Bloctel.
• B2B numbers: the consumer-code consent rule targets consumers; B2B prospecting stays governed by GDPR (lawful basis, information, right to object). Sole proprietors who use a single line for personal and professional purposes may be treated as consumers, so treat them as B2C.
• Contracts in progress: a company can still call its own customers when the call relates to a contract in progress.

What Counts as a Violation

A canvassing call to a consumer without valid, provable prior consent, where no exception applies, breaches Article L223-1. Breaches of the consumer-code canvassing rules carry administrative fines imposed by the DGCCRF (Code de la consommation, article L242-16); check the current amounts on Legifrance.

Loi Naegelen and the 2023 Reform

The Loi Naegelen (Law No. 2020-901 of 24 July 2020) tightened cold calling rules across the board. It was reinforced by Decree No. 2022-1313 of 13 October 2022 (Article D223-9 of the Code de la consommation), which entered force on 1 March 2023. Together they introduced three structural changes to demarchage telephonique for calls to consumers:

• Calling hours restricted to weekdays only. Saturday, Sunday, and public holiday calls are now prohibited for cold prospecting (the previous Saturday morning window was removed).
• Daily windows fixed. Calls are permitted only Monday to Friday, between 10:00 and 13:00 and between 14:00 and 20:00.
• Frequency cap. No more than four solicitation calls to the same consumer within 30 calendar days. If the consumer refuses during a call, no new call for 60 calendar days from that refusal.

The rewritten Article L223-1 also refers to a decree for calling days, hours and frequency, and allows a call outside those hours when the consumer explicitly chose the date and time. Check the text in force before calling.

The renovation, energy-efficiency, and CPF (compte personnel de formation) sectors received additional restrictions: cold calling for these activities to consumers is essentially banned (Loi 2020-901 article 9 and Loi 2022-1158).

Calling Hours and Frequency Limits (2026)

Below is the rule set for calls to consumers under Decree No. 2022-1313, mapped for AI dialer configuration. The rewritten Article L223-1 refers to a decree for days, hours and frequency, so check the text in force before calling.

The frequency limit is per person, not per number, and tracking is the controller's responsibility. CNIL has signalled that operators relying on multiple sub-contractors must aggregate the call counts across all of them; siloed counters that allow a 5th call from a different vendor are a compliance gap.

GDPR Article 6 Lawful Basis for Cold Calls

A French AI cold call processes personal data in at least three ways: it dials a phone number, it records the conversation, and it stores the resulting transcript or CRM note. Each of those processes needs a lawful basis under Article 6 GDPR.

Consent (Article 6(1)(a))

The route for B2C, and since 11 August 2026 a requirement before any canvassing call to a consumer (Article L223-1): a prospect explicitly opts in via a web form, lead magnet, or event registration. Consent must be specific, informed, freely given, and as easy to withdraw as it is to give. Pre-ticked boxes are invalid (CJEU Planet49 ruling, C-673/17, confirmed by CNIL).

Legitimate Interest (Article 6(1)(f))

The route generally relied on for B2B prospecting in France. The European Data Protection Board 2025 guidelines on legitimate interest require a documented three-step test: legitimate purpose, necessity, balancing of rights. For voice AI, the balancing test must address the additional intrusiveness of an automated system: targeted business roles only, professional numbers only, easy opt-out, immediate suppression.

Contract (Article 6(1)(b))

Available when calling existing customers about their existing contract (renewal, payment, service issue). It does not cover cross-selling unrelated products, which falls back to consent or legitimate interest.

EU AI Act and CNIL Disclosure Rules

Article 50 of the EU AI Act requires that natural persons interacting with an AI system are informed of that fact, in a clear and timely manner, unless it is obvious from the context. For a voice AI cold call, the context is rarely obvious - prospects routinely assume they are speaking to a human - so explicit disclosure is required.

CNIL issued how-to sheets on AI and GDPR in 2024 and updates them periodically. Their position on conversational AI agents is consistent with the AI Act: identify the system as AI at the start, allow the person to ask for a human, and document how this disclosure is operationalised.

What "Disclosure" Looks Like in Practice

• First sentence of the call: the AI introduces itself, names the company on whose behalf it calls, and states it is an automated voice assistant.
• Repetition on request: if the prospect asks "am I speaking to a human?", the AI must answer truthfully and without evasion.
• Escalation route: the prospect must be able to request a human operator; the AI either transfers or schedules a callback.
• Logged disclosure: the controller should be able to evidence, per call, that disclosure occurred.

For deeper coverage, see our dedicated guide on EU AI Act transparency requirements for AI callers.

Recording Consent and Data Retention

France applies a two-party consent model to call recording. The legal grounding sits in article 226-1 of the Code penal on the protection of private communications, complemented by Article 5(1) GDPR (lawfulness, fairness, transparency).

In practice, an AI voice agent must:

• Inform the prospect at the beginning of the call that the call may be recorded, the purpose of the recording, and the retention period.
• Obtain a clear verbal "yes" before recording starts, or offer the option to continue without recording.
• Log the consent decision with the call metadata.
• Honour deletion requests under Article 17 GDPR.

Retention Periods Recommended by CNIL

• Prospect contact data: 3 years from last contact (last call answered, last interaction).
• Call recordings for quality assurance: typically 6 months, longer only with documented justification.
• Compliance audit logs: up to the limitation period for the relevant regulatory action (often 3-5 years).

Automated deletion is the only safe approach at any meaningful volume. Manual purges miss the schedule and create breach exposure.

Fines, Sanctions and Recent Enforcement

French enforcement against telemarketing operators has accelerated since 2021. The actions cluster around three patterns: consumer-code canvassing violations (under the Bloctel regime until 11 August 2026), GDPR breaches around prospect data and consent, and recording without disclosure.

Recent CNIL and DGCCRF Actions

• SOLOCAL MARKETING SERVICES, EUR 900,000 (CNIL, December 2021). The CNIL sanctioned SMS for sending unsolicited prospecting messages without valid consent and breaches of cookie rules. The case shows CNIL's willingness to fine seven figures even when the offending channel was electronic prospecting rather than voice.
• FREE MOBILE, EUR 300,000 (CNIL, December 2022). CNIL fined Free Mobile for failing to honour the right of access and the right to object, both directly relevant to telephone prospecting opt-outs.
• HUBSIDE.STORE, EUR 525,000 (CNIL, March 2023). CNIL fined Hubside.Store for telephone canvassing using prospect data collected without valid consent, plus illegal data transfers.
• DGCCRF canvassing campaigns. The DGCCRF reports annually on canvassing enforcement, under the Bloctel regime until 11 August 2026, including hundreds of administrative fines totalling several million euros across the energy renovation, insurance, and CPF sectors.

Maximum Theoretical Exposure

• GDPR fines: up to EUR 20 million or 4 percent of global annual turnover, whichever is higher (Article 83 GDPR).
• Consumer code fines: administrative fines imposed by the DGCCRF for breaches of the canvassing rules, including the prior-consent rule (article L242-16); check the current amounts on Legifrance.
• Criminal exposure: recording without consent under Article 226-1 Code penal carries up to 1 year imprisonment and EUR 45,000 fine for natural persons.
• Reputational and contractual: CNIL public sanctions are published by name, and most enterprise procurement frameworks treat them as material.

B2B vs B2C: Where the Rules Diverge

French law draws a meaningful B2B / B2C line, narrower than many vendors realise.

Two practical traps: first, French sole proprietors (auto-entrepreneurs) routinely use the same number for personal and professional purposes - treat it as B2C and call only with prior consent. Second, CNIL has stated that calling hours rules in the consumer code reflect a public order norm that any reasonable controller should respect even in B2B contexts; calling French managers at 21:30 is a defensible bad idea.

Compliance Checklist for Voice AI Vendors

Before deploying an AI voice agent against a French prospect list, work through this checklist. Most CNIL and DGCCRF actions trace back to one or more of these points being missing.

1. Lawful basis documented per campaign. Consent records for B2C, signed Legitimate Interests Assessments for B2B.
2. Prior-consent records for consumers. Since 11 August 2026, call a consumer only with prior consent you can prove: record when and how it was given, treat it as valid for one year at most, keep the proof for three years and honour withdrawal at any time. Scrubbing against Bloctel no longer applies.
3. Calling-hours guard in the dialer. Hard-coded windows (Mon-Fri 10-13h, 14-20h Europe/Paris), public holiday calendar, automatic pause.
4. Frequency cap. Centralised counter per natural person, not per number, aggregated across all sub-contractors. 4 attempts per 30 days hard limit, and no new call for 60 days after a refusal.
5. AI disclosure script. First sentence identifies the AI, the company, and the purpose. Recorded and auditable.
6. Recording consent flow. Verbal opt-in before recording starts; non-recording fallback path; consent decision logged.
7. Right-to-object detection. AI recognises French opt-out language ("ne m'appelez plus", "je ne suis pas interesse", "retirez-moi de votre liste") and immediately suppresses the contact.
8. Data Processing Agreement (Article 28 GDPR). Signed with every sub-processor, EU/EEA data residency where possible, breach notification clauses, deletion-on-termination clauses.
9. Retention policy automated. Recordings deleted on schedule, prospect data deleted at 3 years from last contact unless lawful basis to retain longer.
10. DPIA on file. Updated when call volume or AI capabilities change materially.
11. Audit trail. Per-call logs of disclosure, consent, opt-outs, and call timing. Reviewed quarterly.

How AINORA Approaches French Compliance

AINORA builds its outbound voice product around the assumption that France is the strictest market it operates in, and therefore the baseline against which other markets configure. The compliance posture is not a marketing feature - it is the operating constraint on every campaign. AInora does not make cold prospecting calls to consumers.

• Calling-hours guard by default. Campaigns targeting French numbers respect Mon-Fri 10-13h and 14-20h Europe/Paris with the public holiday calendar applied automatically.
• AI disclosure on the first turn. The voice agent identifies itself as an automated assistant, names the calling entity, and offers a human escalation route - in line with EU AI Act Article 50 and CNIL guidance.
• Two-party recording consent. Recording only starts after a clear opt-in; a non-recorded path is always available.
• Frequency cap and centralised suppression. Per-person counters, immediate opt-out propagation across all campaigns, audit log of every suppression.
• Data location. Data is stored on servers in Germany and Finland. In the standard setup, calls are processed in the EU and the US under GDPR (EU-US Data Privacy Framework, standard contractual clauses). A full-EU setup is available on request.
• Retention controls. Configurable per controller, defaulting to 6 months for recordings and 3 years for prospect data, in line with CNIL guidance.

None of this replaces the controller's own duty to hold and prove prior consent for consumer calls, document the lawful basis, run a DPIA, and keep its CRM clean. AINORA provides the call-layer controls; the legal basis remains the responsibility of the company running the campaign.