Key points
- Sending marketing emails to consumers is governed by the GDPR (General Data Protection Regulation) and by Article L. 34-5 of the French Postal and Electronic Communications Code (Code des postes et des communications électroniques, CPCE).
- Opt-in requires the recipient’s prior consent, unlike opt-out, where the user objects to the mailings after the event.
- Under Article 4(11) of the GDPR, consent must be freely given, specific, informed and unambiguous.
- The business must be able to prove consent, for example through sign-up logs or a tick box that is never pre-ticked.
- Article L. 34-5 of the CPCE prohibits concealing the identity of the advertiser and requires every message to give valid contact details so that the recipient can ask, free of charge, for the mailings to stop.
- Non-compliance exposes you to GDPR fines of up to €20 million or 4% of total worldwide annual turnover, and to the administrative fine provided for by Article L. 34-5 of the CPCE; the CNIL (French data protection authority) monitors compliance with these rules.
Unsolicited emails, yet again. You want to spare your customers this nuisance and comply with the rules in force. Understanding opt-in then becomes essential. How do you obtain clear, provable consent? Which obligations must you meet to avoid penalties?
You need concrete, simple information. The GDPR and the Postal and Electronic Communications Code strictly regulate the sending of commercial emails. The slightest slip can be costly. Yet these rules often remain unclear and complex.
This article helps you see more clearly. Discover the criteria for valid consent and the good practices to adopt. Protect your business and respect your contacts’ privacy.
Your goal? To communicate effectively without breaking the law. Your peace of mind depends on mastering these rules. Let’s take this first step together.
The legal framework for opt-in in France
Several texts govern the sending of commercial emails to consumers. Among them, the General Data Protection Regulation (GDPR) and Article L. 34-5 of the Postal and Electronic Communications Code (CPCE) play a central role.
Under Article 6 of the GDPR, consent is one of the six legal bases for processing personal data; it must be freely given, specific, informed and unambiguous (Article 4(11)). For direct marketing by email sent to consumers, Article L. 34-5 of the CPCE requires, in principle, this prior consent.
What exactly is opt-in?
Opt-in is a method by which a user gives explicit agreement to receive commercial communications. Unlike opt-out, where the member unsubscribes after the event, opt-in requires the consumer to express consent before receiving any promotional email.
The concept of proof of consent is also necessary here. You must be able to show that the user actually agreed to receive your messages. This may include keeping sign-up logs or screenshots showing that the consent tick box was ticked.
The criteria for valid consent under the GDPR
For consent to be valid under the GDPR, several criteria must be met:
- Freely given: consent must not be forced or coerced. The user must have a genuine choice.
- Specific: the request for consent must relate to a precise purpose. It cannot be global or vague.
- Informed: the user must be told, in an understandable and accessible way, how their personal data will be used.
- Unambiguous: there must be a clear action by the user showing their consent, such as a tick box to agree to receive commercial emails.
These rules ensure not only transparency with your prospects but also your legal compliance.
A few precautions to take
To meet the legal requirements on consent, here are some practical measures:
- Use clear and concise sign-up forms.
- Include a tick box to collect consent, never pre-ticked.
- Tell the user clearly the purposes for which their personal data are processed.
- Allow the user to withdraw consent easily at any time.
Additional obligations under the French Postal and Electronic Communications Code
Article L. 34-5 of the CPCE supplements the GDPR as regards direct marketing by email. Here are some key points:
Every marketing email must give valid contact details enabling the recipient to ask for the mailings to stop, at no cost other than transmission costs; it is prohibited to conceal the identity of the person on whose behalf the message is sent. Each message must include a simple way to unsubscribe, usually in the form of an unsubscribe link.
Penalties for non-compliance
Failure to meet these obligations can lead to heavy penalties. Under the GDPR, fines of up to €20 million or 4% of total worldwide annual turnover for the preceding financial year may be imposed. The CNIL is the competent authority in France for monitoring and penalising GDPR breaches; it also monitors compliance with Article L. 34-5 of the CPCE and can receive the related complaints.
Article L. 34-5 of the CPCE also provides for an administrative fine, imposed by the administrative authority responsible for competition and consumer affairs, which may not exceed €75,000 for an individual and €375,000 for a legal entity. In decision No. 2026-1210 QPC of 25 June 2026, the Constitutional Council (Conseil constitutionnel) declared this provision unconstitutional but deferred its repeal until 31 October 2027 (a QPC is a priority preliminary ruling on constitutionality).
The legal obligations on sending emails to consumers call for constant vigilance. By taking a proactive approach and putting in place mechanisms to verify consent, you can not only ensure your legal compliance but also strengthen your customers’ trust.
Collection forms, proof of consent, unsubscribe management: a GDPR compliance lawyer reviews your user journeys before a complaint calls them into question.
FAQs on email marketing and opt-in
What does explicit consent mean in email marketing?
What records should I keep to prove consent?
- Sign-up logs
- Screenshots of submitted forms
- Copies of the information given to individuals at the time of collection
