CNIL Clears Solocal on Email Consent, Skips €10K Daily Fine

A giant colored "Yes" button. A tiny opt out link buried in body text. That was the consent flow behind millions of marketing emails and text messages sent by Solocal Marketing Services, and in May 2025 the CNIL decided it did not count as consent at all. Sixteen months later, the regulator says the company has fixed the problem. The way it got there is a template for anyone who buys leads.

Key Takeaways

• The CNIL's restricted committee closed its injunction against Solocal Marketing Services by a deliberation dated September 17, 2026, published on September 24, 2026, according to the CNIL's notice.
• Solocal was fined €900,000 on May 15, 2025 for running email and SMS prospecting on consent collected through misleading data broker forms and for failing to prove that consent.
• The 2025 order gave Solocal nine months to stop prospecting without valid consent or face a €10,000 penalty for every day of delay.
• Solocal complied by combining automated analysis of partner collection forms with human review, and the CNIL imposed no additional penalty.
• The decision confirms that a company sending marketing email is responsible for the consent its data suppliers collect, not just for its own forms.

What Did the CNIL Originally Fine Solocal For?

The CNIL fined Solocal €900,000 because the consent behind its email and SMS campaigns was neither free nor unambiguous, and because the company could not prove it had consent in the first place. The details are set out in the CNIL's May 2025 sanction summary.

Solocal did not collect most of its prospect data itself. It bought it from data brokers, contest sites, and product testing platforms, then ran email and SMS campaigns for advertiser clients. Some records were also passed to clients for their own telephone or postal marketing.

The committee found two breaches:

• Defective consent under Article L.34-5 of the French Postal and Electronic Communications Code. On the broker forms, the button to accept prospecting was larger, colored, and placed prominently, while the option to refuse was minimized and blended into surrounding text. Solocal relied on those forms without checking them.
• No proof of consent under GDPR Article 7. Solocal could not document that people had agreed to have their data transferred. For one major supplier, consent records were unavailable for 17 months before Solocal stopped using that data.

The CNIL said several million people were affected and weighed that scale, Solocal's market position, and the financial benefit it drew from the breaches when setting the amount.

Why Did the CNIL Close the Injunction?

The CNIL closed the injunction because Solocal put a verification process in place within the nine month deadline. According to the closure notice, the company now combines automated analysis of its data broker partners' collection forms with human review to confirm that the consent they gather is valid.

The restricted committee found those measures satisfactory and closed the order without liquidating the €10,000 daily penalty. The European Data Protection Board also carried the original decision, so the closure completes a case that other EU authorities have already seen.

Analysis: The Daily Penalty Was the Real Lever

Most coverage in 2025 focused on the €900,000 headline. The penalty clause mattered more. At €10,000 a day, Solocal would have matched the entire original fine after 90 days of noncompliance. A one time fine can be booked as a cost of doing business. A meter that keeps running cannot.

The closure also tells compliance teams what the CNIL accepts as a fix. It did not demand that Solocal stop buying leads. It demanded that Solocal inspect the forms where those leads were created. That shifts the unit of audit from the contract with the broker to the actual screen a person saw when they clicked "Yes."

The same design problem, a loud accept button and a quiet refuse link, is the pattern we covered in how dark patterns trick you into email consent. The Solocal case shows a regulator treating that design as a legal defect in the downstream sender's database, not only the broker's.

What This Means for Your Inbox

If you have ever entered a contest or signed up for a free product test and then started receiving marketing email from brands you never heard of, this is the pipeline. Your address was collected once and then resold to companies like Solocal, who mailed you on behalf of advertisers. The CNIL's position is that each sender in that chain needs consent it can actually prove.

France has a track record here. Earlier this year the CNIL sanctioned a retailer for sharing 10.5 million customer emails with a social network, and it has also issued guidance on consent for email tracking pixels. Together they point in one direction: in France, an email address is not a free resource once it leaves the form where you typed it.

For readers, the practical step is simple. When a signup form makes "Yes" huge and "No" hard to find, treat it as a data sale, not a newsletter.

What Should Compliance Teams Do Now?

Compliance teams that buy or rent prospect lists should audit the consent evidence behind them before a regulator does. Based on the CNIL's findings, a practical checklist looks like this:

• Review the actual collection screens. Capture each supplier's form and check whether accept and refuse options are equally visible.
• Demand consent records on request, not on promise. Solocal's 17 month wait for one supplier's records was itself called a failure of diligence.
• Stop using data you cannot evidence. Quarantine records from any supplier that cannot produce proof quickly.
• Automate, then verify by hand. The CNIL accepted automated form analysis paired with human review. Pure automation was not what closed this case.
• Track onward transfers. If you pass prospect data to clients for phone or postal marketing, the consent must cover that transfer too.

Looking Ahead

The Solocal file is now closed, but the brokers whose forms caused the problem were not the subject of this decision. The CNIL's closure notice puts the verification burden on the buyer. Expect lead buyers across France to start asking their suppliers for screenshots, timestamps, and form versions, because the alternative is a running meter.