Since January 1, 2023, commercial messaging platforms in France have not been permitted to send marketing SMS from numbers beginning with 06 or 07. Those are the standard French mobile number prefixes, the numbers that French recipients associate with calls and messages from real people. For commercial SMS, those numbers became unavailable to business platforms. Organizations that set up their French SMS program before that date and have not updated their routing since may be sending from numbers that are no longer permitted for commercial use.
Business SMS in France operates under GDPR, enforced by the CNIL (Commission nationale de l'informatique et des libertés), and under Article L.34-5 of the French Postal and Electronic Communications Code, which governs electronic direct marketing. For B2C marketing, prior explicit consent is required before sending. Commercial platforms must send from shortcodes or commercial-specific numbers, not from standard 06 or 07 mobile numbers. Marketing SMS is prohibited between 8 PM and 10 AM, and all day on Sundays and public holidays. The CNIL is currently one of the most active data protection enforcement authorities in the European Union.
France is the entry point for organizations expanding European operational programs from the UK or planning multi-market programs that span Europe. The compliance framework feels familiar to teams already operating under UK PECR, because both deaarive from the same EU ePrivacy Directive and GDPR. But the operational differences, the 06/07 number rule, the CNIL's enforcement posture, the Sunday prohibition, and specific B2B consent nuances, create practical divergences that matter.
France's SMS compliance environment involves two main authorities operating in parallel. ARCEP (Autorité de régulation des communications électroniques et des postes) is the telecom regulator, overseeing network operators, number assignment, and technical standards for electronic communications. CNIL is the data protection authority, enforcing GDPR and the French data protection framework for marketing communications.
Article L.34-5 of the French Postal and Electronic Communications Code is the specific provision governing electronic direct marketing by SMS. It draws on the ePrivacy Directive, which each EU member state implemented into national law with country-specific variations. France's implementation requires prior consent for B2C marketing and includes an existing customer soft opt-in exception for similar products and services, parallel in structure to the UK's PECR soft opt-in rule.
CNIL has consistently ranked among Europe's most active privacy regulators, regularly issuing high-profile enforcement actions against organizations that misuse personal data for marketing, rely on invalid consent mechanisms, reuse data from loyalty schemes without adequate consent, or purchase marketing lists without verifying the validity of the consents in those lists. France is not a market where informal consent practices carry low enforcement risk.
ARCEP operates the number authentication system (Mécanisme d'Authentification des Numéros, MAN) for voice calls, and its broader anti-spam and consumer protection mandate shapes how French carriers treat commercial messaging traffic. Carriers also facilitate reporting through 33700, France's national platform for reporting fraudulent or unwanted SMS, which affects sender reputation even for campaigns that are technically compliant if they generate high complaint rates.
Until January 1, 2023, commercial messaging platforms could send marketing SMS from standard mobile numbers beginning with 06 or 07. From that date, ARCEP prohibited commercial canvassing platforms from contacting individuals using those prefixes.
The rationale is straightforward from a consumer protection perspective: 06 and 07 numbers are the prefixes French consumers associate with calls and messages from people they know. Commercial platforms using those numbers to send marketing messages were exploiting that association to create a false sense of personal contact. The ban forces commercial SMS to originate from numbers that recipients can clearly identify as business or commercial traffic.
For organizations that configured a French SMS program before 2023 using 06/07 numbers, the program is now sending from a non-permitted number type. The fix is to migrate to a short code or a commercial-specific number type through a French-authorized provider.
What does that change in practice? Instead of a message arriving from:
06 12 34 56 78
which looks like a personal mobile, the message now arrives from a short code such as 38050 or a commercial number in a non-personal prefix range. French recipients have become familiar with this format precisely because the 2023 rule enforced the distinction. A message arriving from an 06 or 07 number today is more likely to trigger suspicion than before, because recipients know commercial platforms are not supposed to use those prefixes.
This changes how recipients interact with the sender field. A short code clearly signals a business communication. For programs where two-way replies matter, such as operational check-ins, acknowledgment workflows, or opt-out via reply, the short code configuration needs to be set up with two-way capability through the provider. Recipients cannot call a short code back as they would a personal number, which is worth accounting for in any program that also uses voice follow-up.
For new programs entering the French market, the 06/07 rule is a setup requirement rather than a transition problem. Short codes are the standard and the configuration process starts there.
Four carriers serve the French market: Orange, SFR, Bouygues Telecom, and Free Mobile. MVNOs operating on these networks, including NRJ Mobile, Syma Mobile, and Lycamobile, carry meaningful subscriber volume. Programs targeting urban demographics or younger audiences should ensure their routing covers MVNO subscribers.
For organizations already running SMS programs in another EU country, France shares the GDPR foundation but diverges in specific operational ways that matter.
What stays the same: GDPR applies. Consent records are required. Opt-out must be honored. Data subject rights, storage limitation, and purpose limitation principles are consistent across EU member states.
What changes with France specifically: Commercial SMS cannot originate from 06/07 numbers, requiring short code or commercial-specific provisioning. Sunday sends are prohibited. French public holidays are prohibited. The CNIL has its own enforcement priorities and interpretation posture distinct from other national DPAs. The B2B legitimate interests nuances follow French CPCE implementation. The 33700 spam reporting platform affects sender reputation in France specifically.
Teams adding France to a program already running in Germany, the Netherlands, or Spain often assume the GDPR compliance work covers France fully. It does for the data layer. It does not cover the CPCE provisions, the 06/07 number requirement, or the Sunday and public holiday restrictions. Those are French-specific operational requirements that sit above the shared GDPR foundation.
For B2C marketing SMS in France, the GDPR standard for consent applies in full. Consent must be freely given, specific, informed, and expressed through clear affirmative action. Pre-ticked boxes, consent bundled inside general terms and conditions, and consent implied from account creation or website visits do not meet the standard.
The CNIL has been explicit in its guidance: the creation of an account does not constitute implicit consent to receive marketing SMS. In the absence of a purchase, an organization cannot rely on the existing customer soft opt-in exception. A website visitor who creates an account but has not completed a transaction has not established the commercial relationship that would support the soft opt-in, and therefore needs explicit consent before receiving marketing messages.
The soft opt-in exception that does apply in France follows the same logic as the UK PECR soft opt-in: an existing customer who bought or negotiated a purchase, whose details were collected at that time, can receive marketing SMS about similar products or services from the same organization, provided they were given a clear opt-out at the time of collection and in every subsequent message. The CNIL distinguishes carefully between contacts who have made purchases and contacts who have merely registered an account, and the exception does not extend to the latter category.
Consent records must document the date, source, and mechanism of opt-in for each contact. The CNIL places the burden of proof on the organization to demonstrate that valid consent existed at the time messages were sent. Organizations should retain sufficient records to demonstrate valid consent while complying with GDPR's storage limitation principle, which requires data not be kept longer than necessary for the purpose for which it was collected.
France follows the EU-wide principle that direct marketing to business contacts in a professional capacity can in some circumstances be justified under legitimate interests as a lawful basis, rather than requiring explicit consent. This creates meaningful flexibility for programs targeting professional contacts within a B2B context.
The legitimate interests basis requires a balancing test: the organization's interest in contacting the recipient must be weighed against the recipient's rights and reasonable expectations. For professional contacts in roles where receiving business communications is a normal part of their function, and where the content relates clearly to their professional responsibilities, the balance typically favors the sender. For contacts where the commercial interest outweighs the professional connection, or where the individual is acting more as a private person than in a professional capacity, the legitimate interests basis is weaker and consent becomes necessary.
The range of B2B contexts where this applies in France is broad. Venue and event operators managing supplier relationships. Manufacturers coordinating component deliveries with distributors and freight partners. Utilities managing contractor networks for infrastructure maintenance. Logistics and freight companies coordinating drivers, depot managers, and customs contacts. Suppliers sending operational updates to wholesale and trade buyers. For each of these, the content relates to the recipient's professional function and the contact is receiving communications in their business capacity. Documentation of the legitimate interests assessment, including a record of why the balance favors the sender for each contact segment, is still required.
French commercial SMS is subject to the following schedule restrictions:
Permitted: Monday through Saturday, 10:00 AM to 8:00 PM local time Prohibited: Before 10:00 AM and after 8:00 PM on any day Prohibited: All day Sunday Prohibited: All day on French public holidays
France has 11 national public holidays, and some regions and overseas territories observe additional local holidays. Programs running national or near-national campaigns need a public holiday calendar built into their scheduling logic. For programs running around major live events, concert series, or retail moments that coincide with long weekends or national holidays, the scheduling impact is material: Bastille Day (July 14), All Saints Day (November 1), and the Christmas-New Year stretch all create blackout periods that can fall mid-campaign.
Transactional and operational messages that do not constitute commercial prospecting are generally outside the scope of these marketing restrictions. A ticket purchase confirmation, a delivery notification, an account alert, or a staff dispatch message can be sent outside commercial hours without violating Article L.34-5. The restriction targets commercial prospecting specifically, not all business SMS.
For organizations coordinating staff, contractors, or operational teams in France, the compliance picture shifts substantially from the B2C marketing framework. Messages between an employer and employees, or between a commissioning organization and its professional contractors, arising from an employment or commercial service relationship are not commercial prospecting under Article L.34-5 and are not subject to the same prior consent requirements.
France has specific industries where operational SMS is particularly relevant and where the operational communications distinction matters most. SNCF and rail operations coordinating maintenance crews and station staff. Airport and ground services teams managing turnaround operations at CDG, Orly, and regional airports. Hospital systems and healthcare groups coordinating shifts, on-call schedules, and urgent gap-fill across large nursing and clinical staff pools. Municipal services coordinating maintenance, waste management, and public works teams across departments. Utilities managing field technician dispatch for network maintenance and emergency response. Manufacturing plants coordinating production shifts and logistics across supplier and distribution networks. These programs involve communications with individuals in their professional capacity, and they proceed under the employment or contractor relationship without the full B2C marketing consent architecture.
Two-way SMS capability works across French carriers, making reply-based acknowledgment workflows, opt-out capture, and interactive operational coordination fully functional. Unlike some markets where standard A2P two-way SMS is unavailable, France supports the full range of interactive workflow design.
BYOC architecture applies in France for the same reason it applies in every other market in this series. France introduces one more country-specific routing and consent layer. Everything else stays the same: the workflow, contacts, consent history, delivery logs, and suppression records are exactly where they are. Only the French connectivity is added, along with the scheduling logic that respects the Sunday and public holiday restrictions. For an organization running programs in France alongside the US, UK, Australia, or LATAM, adding France is a configuration step, not a platform rebuild.
For organizations operating in both the UK and France, the compliance frameworks are related but not identical. Both derive from the same ePrivacy Directive and GDPR foundation. But the UK post-Brexit now operates under UK PECR and UK GDPR as distinct domestic frameworks, while France operates under EU GDPR and the French CPCE. The soft opt-in rules are structurally similar but the CNIL's enforcement posture differs from the ICO's. The 06/07 ban has no UK equivalent. The Sunday prohibition applies in both markets in practice.
For channel decisions in France, the knowledge base guide on channel selection covers how to sequence SMS alongside other channels for a European audience. France has meaningful smartphone penetration and WhatsApp adoption, but SMS remains the guaranteed-delivery channel and the standard for transactional and operational programs.
Why can't I use a standard French 06 or 07 mobile number to send commercial SMS? Since January 1, 2023, ARCEP has prohibited commercial canvassing platforms from sending marketing SMS from numbers beginning with 06 or 07. Those prefixes are associated with personal mobile phones in France, and commercial platforms were prohibited from using them for business messaging. Commercial SMS must originate from short codes or commercial-specific number types provided by French-authorized carriers.
What consent is required for B2C marketing SMS in France? Explicit, freely given, specific, and informed consent under GDPR. Pre-ticked boxes, consent bundled inside account registration, and consent implied from website visits do not satisfy the standard. The CNIL distinguishes clearly between contacts who have made purchases and those who have only created accounts: the existing customer soft opt-in applies to purchasers, not to all registered contacts.
Is B2B marketing SMS regulated the same way as B2C in France? Not exactly. Professional contacts in a business capacity can in some circumstances be contacted under legitimate interests as a lawful basis, without requiring explicit marketing consent. The key factors are whether the content relates clearly to the recipient's professional function and whether the contact is acting in a professional rather than personal capacity. Documentation of the legitimate interests assessment is required.
What are the restricted hours and days for commercial SMS in France? Commercial SMS may not be sent between 8 PM and 10 AM. Sunday sends are completely prohibited. Sends on French public holidays are also prohibited. France has 11 national public holidays. These restrictions apply to commercial prospecting messages, not to transactional or operational messages arising from an existing relationship.
Does GDPR apply to my organization if I am based outside France or outside the EU? Yes. GDPR applies to organizations processing the personal data of individuals located in the EU regardless of where the organization is established. Phone numbers are personal data. Organizations sending marketing SMS to French recipients must comply with GDPR and Article L.34-5 regardless of where they are headquartered.
Can I still use SMS for appointment reminders and delivery notifications in France? Yes. Appointment reminders, delivery notifications, account alerts, and service updates that relate directly to an existing service relationship are operational communications rather than commercial prospecting. They are generally outside the scope of the time and day restrictions in Article L.34-5, meaning they can be sent outside the 10 AM to 8 PM window and on Sundays when operationally necessary. GDPR still applies to how the phone number is collected and used, and the message should clearly identify the sender.
Talk to our team about building SMS program for France and across your European and global markets from one platform.