GDPR and Marketing: What You Can Actually Do in France

Ask ten marketers about European privacy law and you'll hear ten versions of the same anxiety: that GDPR makes serious marketing impossible. It doesn't. GDPR marketing in France is a discipline with knowable rules, and once you understand them you can run aggressive acquisition programs without flinching every time the regulator publishes new guidance. We run paid media, SEO, CRM and analytics for French brands every day under these rules, and the honest summary is this: most of what you want to do is allowed. You just have to do it deliberately.

This guide covers what actually matters in practice: consent versus legitimate interest, what the CNIL expects from your cookie banner, how B2B and B2C prospecting differ, email rules, and what consent does to your measurement. Treat it as practitioner guidance, not legal advice. For binding answers, the regulator itself publishes remarkably readable guidance at cnil.fr, and a lawyer should review anything high-stakes.

The two legal bases that matter for GDPR marketing

GDPR lists six legal bases for processing personal data. For marketing, only two come up daily: consent and legitimate interest.

Consent means the person actively agreed, for a specific purpose, after being told what they were agreeing to. The legal standard is "freely given, specific, informed and unambiguous." In practice: no pre-ticked boxes, no bundling ten purposes into one checkbox, and withdrawal must be as easy as giving it. Consent is the strongest basis but the most fragile, because people can revoke it at any time and you must be able to prove you had it.

Legitimate interest means you can process data without asking, provided you have a genuine business reason, the person would reasonably expect the processing, and their rights don't outweigh your interest. You need to document that balancing act. It covers things like fraud prevention, direct postal mail, and, under French rules, a meaningful slice of B2B prospecting.

Here is the trap that catches most foreign teams: cookies and electronic prospecting are governed by a second layer of law, the ePrivacy rules as transposed into French law. That layer often demands consent regardless of how elegant your legitimate-interest assessment is. You cannot drop an advertising pixel on a French visitor's browser under legitimate interest. You cannot cold-email a French consumer under legitimate interest. The balancing test never gets a vote on those questions.

So the practical method is simple. For every marketing activity, ask two questions in order: does the ePrivacy layer force consent here? If not, can I justify legitimate interest and write the justification down? Teams that skip the first question build compliance programs that look impressive and fail on contact with the CNIL.

What the CNIL expects from your cookie banner

The CNIL, France's data protection authority, has been one of Europe's most active regulators on cookies, and its expectations are concrete:

• Nothing non-essential fires before consent. Analytics, advertising, social and personalization tags must stay silent until the visitor says yes. Strictly necessary cookies (cart, session, security) are exempt.

• Refusing must be as easy as accepting. If your first banner layer has an "Accept all" button, it needs a "Refuse all" of equal prominence on the same layer. Burying refusal behind "Manage settings" is exactly the pattern that has drawn the CNIL's most publicized cookie fines against major platforms.

• Continuing to browse is not consent. Scrolling, clicking through, or ignoring the banner cannot be treated as a yes.

• Purposes must be granular. Visitors should be able to accept measurement while refusing advertising, and the banner must say plainly what each purpose does.

• Choices must be provable and revocable. Keep consent logs, and give people a persistent way to change their mind, typically a small floating icon or a footer link.

• Respect a refusal. Re-prompting on every page view to wear people down is treated as a way of invalidating the "freely given" requirement. Store the refusal and leave the visitor alone for a reasonable period.

Two nuances worth knowing. First, "cookie walls" (access only if you accept) are not automatically banned in France; the CNIL assesses them case by case, and paid "consent or pay" alternatives are now common on French media sites. Second, France has a genuinely useful carve-out: audience measurement can be exempt from consent if the tool is configured under the CNIL's strict conditions, essentially aggregate statistics for the site publisher alone, no cross-site tracking, short retention. The CNIL publishes which tools and configurations qualify. More on why that matters for your data below.

Prospecting in France: B2B and B2C are different games

This is where GDPR folklore does the most damage. The rules for reaching out to professionals and to consumers are genuinely different, and conflating them either kills legitimate pipeline or creates real risk.

B2C: opt-in, with one useful exception

Emailing or texting French consumers requires prior consent. Bought consumer lists without documented, specific opt-in are radioactive; "partner consent" collected through a vague checkbox rarely survives scrutiny.

The exception is the soft opt-in: if someone became your customer, you may email them about your own similar products or services without fresh consent, provided they could object when their address was collected and can opt out in every message. This exception is narrower than teams want it to be. It covers customers, not leads, and similar offers, not your whole catalog.

Consumer telephone prospecting is its own minefield — and the regime changed on 11 August 2026. Cold-calling French consumers now requires documented prior opt-in consent (loi n° 2025-594 of 30 June 2025): the old Bloctel opposition list is abolished, consent is valid for a maximum of one year, the burden of proof sits with the caller, and breaches carry administrative fines of up to €375,000 for a company plus the nullity of any resulting contract. B2B calls remain outside this consumer regime.

B2B: an opt-out regime, with conditions

Here is the part that surprises US and UK teams: France does not require prior consent to email a professional. B2B email prospecting operates on an opt-out basis, with three conditions the CNIL applies consistently:

1. The message must relate to the recipient's professional role. You can pitch marketing software to a marketing director at her work address; you cannot pitch her holiday packages.

2. The person must have been informed, when their address was collected, that it could be used for prospecting.

3. Every message must offer a simple, free way to object, and objections must be honored.

Generic company addresses (contact@, info@) identify a legal entity rather than a person, and are treated more permissively still. None of this makes list hygiene optional: you remain responsible for the provenance of any purchased or scraped B2B data, and sloppy sourcing is where enforcement actually bites. But well-run, relevant, honest B2B outbound is legal in France. Anyone telling you otherwise is selling you something.

If prospecting is one piece of a broader French launch, our guide to advertising in France covers the adjacent rules for paid channels, and there are sector-specific regimes (alcohol, health, financial products) that deserve their own diligence.

Email marketing: the short list of dos and don'ts

• Do identify yourself clearly as the sender; disguised prospecting is prohibited.

• Do include a working unsubscribe in every message and process it promptly, not "within 30 days of our next batch job."

• Do keep records: when and how each contact opted in, and what they were shown.

• Do sunset inactive contacts. Long-dormant lists are both a deliverability problem and a data-minimization problem, and GDPR expects you not to hoard data you no longer need.

• Don't pre-tick newsletter boxes or bundle consent into terms of service.

• Don't email consumer leads who downloaded a whitepaper years ago and never consented to marketing.

• Don't treat an unsubscribe as channel-specific silence while you retarget the same person everywhere else; suppression should propagate through your stack.

Consent, analytics, and the measurement gap

Everything above is about what you send. The quieter GDPR story is what happens to what you measure, because some meaningful share of your French visitors will refuse cookies, and every refusal is a session your analytics never sees and a conversion your ad platforms can't attribute.

There are four levers, and mature teams pull all of them:

1. Get the banner right, then optimize it. Within the CNIL's rules there is real room to improve opt-in rates through design, wording, timing and placement. This is normal CRO work applied to consent. When we rebuilt the tracking and consent flow for Les cours de Julie, an online learning platform, the opt-in rate grew sevenfold, tracked conversions rose 34%, and the analytics finally aligned one-for-one with the back office. Consent done properly is not the enemy of measurement; broken consent flows are.

2. Use consent mode correctly. Google's consent mode adjusts tag behavior based on the visitor's choice and, in its advanced configuration, lets Google model conversions from consentless signals. Google now effectively requires proper consent signals from European traffic for its ads measurement and personalization features to work, so a misconfigured banner quietly degrades your campaigns.

3. Consider exempt audience measurement. The CNIL's exemption for strictly-scoped analytics means you can keep a consent-free baseline of traffic and conversion data alongside your consented stack. Many French sites run both: an exempt tool for ground truth, GA4 for depth.

4. Don't fall for the server-side myth. Moving tags server-side improves data quality and control, but it does not remove the consent requirement. A cookie set from your server for advertising is still an advertising cookie.

One piece of recent history explains the French mood here. In 2022 the CNIL ordered several French sites to stop using Google Analytics as then configured, over data transfers to the United States. The EU-US adequacy framework adopted since then eased that pressure, but the episode taught French teams to take hosting and transfer questions seriously, and your French clients or partners will expect you to have answers. Designing a measurement stack that is both compliant and genuinely useful is exactly what a specialist web analytics agency is for.

A practical GDPR marketing checklist

1. Map every marketing data flow: forms, cookies, pixels, CRM syncs, enrichment tools, ad platform uploads.

2. Assign a legal basis to each activity and write the reasoning down, especially every legitimate-interest assessment.

3. Deploy a consent management platform with equal accept/refuse options, granular purposes and consent logs.

4. Verify that non-essential tags actually stay silent before consent. Test it; a large share of "compliant" sites leak tags on page one.

5. Configure consent mode or conditional firing for every ad platform you use.

6. Decide your analytics posture: consented GA4, a CNIL-exempt measurement tool, or both.

7. Audit your lists: provable opt-in for B2C, professional relevance and clean provenance for B2B.

8. Check every template for sender identity and a working unsubscribe, and confirm suppressions propagate across tools.

9. Put data processing agreements in place with your vendors and know where each one hosts and transfers data.

10. Publish a clear privacy policy in French for French users, and have a real process for access and deletion requests. Language is a legal expectation, not a courtesy; our guide to localizing a website for the French market covers what French-language obligations look like in practice.

The famous penalty ceiling (up to €20 million or 4% of worldwide annual turnover, whichever is higher) gets the headlines, but day-to-day enforcement in marketing targets mundane things: banners where refusing is harder than accepting, tags firing before consent, unsubscribes that don't work. All ten items above are fixable in weeks, not years.

Frequently asked questions

Do I need consent to cold-email B2B prospects in France?

No. French rules allow B2B email prospecting without prior consent, provided the message relates to the recipient's professional role, they were informed their address could be used this way, and every message offers an easy opt-out. You remain accountable for where the data came from.

Can I still use Google Analytics in France?

Yes, under current transfer frameworks and with a compliant consent setup. GA4 requires consent for its cookies in France; many teams pair it with a CNIL-exempt audience measurement tool to keep an unsampled baseline for refused traffic.

Does GDPR apply to my US or UK company if we only sell into France remotely?

Yes. GDPR applies to companies outside the EU when they offer goods or services to people in the EU or monitor their behavior, which describes essentially any deliberate French go-to-market. If France is a serious target, the privacy workstream belongs in your market-entry plan alongside the commercial ones; our overview of doing business in France puts it in context.

Is legitimate interest ever enough for advertising cookies?

No. Cookies and similar trackers used for advertising require consent in France, full stop. Legitimate interest can support other processing around your ad operations, but not the trackers themselves.

Make compliance a growth asset, not a handbrake

Companies that treat GDPR as a checkbox get slow legal reviews and broken data. Companies that build consent and measurement properly get cleaner analytics, better deliverability, and campaigns that keep running when the next enforcement wave hits their competitors. If you're entering the French market and want your consent flow, tracking and prospecting engine built right the first time, talk to our team. We do this for French and international brands every week, and we'll tell you plainly what's allowed, what's risky, and what's simply not worth it.