It is the most used provision in French marketing law, and the most badly read. It is called the customer exception, or soft opt-in: an existing customer may be contacted without prior consent.
The sentence is true. What most companies file under the word “customer” is not.
The text, and its cumulative conditions
The European basis is Article 13(2) of the 2002 directive. Its French transposition is Article L.34-5 of the postal and electronic communications code, paragraph II, which permits marketing by electronic mail if the recipient’s contact details were collected from them, in compliance with data protection law, in the context of a sale or a provision of services, and if the direct marketing concerns similar products or services provided by the same natural or legal person.
Four conditions, and they are cumulative. One missing, and the exception falls.
The contact details were collected from the person themselves. Not from a partner, not from a broker, not on a third-party site.
In the context of a sale or a provision of services. This is the condition that eliminates the most situations, see below.
Similar products or services. Provided by the same natural or legal person.
A simple, free right to object, offered at the time of collection, then with every send.
Creating an account is not a sale
The CNIL is explicit, and its example is one every online retailer meets: the exception cannot be relied on where no sale or provision of services has taken place, including where the customer has created an online account.
It supports this with a sanction decision whose reasoning it restates: the mere creation of an account does not mean there will be any eventual order of products or services from the company.
An account created, a form filled in, a quote requested, a white paper downloaded, a cart abandoned: none of those gestures is a sale or a provision of services. None opens the exception.
The practical consequence is brutal for the most widespread e-commerce scenarios. An abandoned cart reminder to someone who has never bought anything from you, and who has not consented to receiving your messages, rests on no basis at all. We draw that conclusion from the letter of the text and from the CNIL’s published position on account creation: it is not written that way, it follows from it.
Similar, or not
The text says “similar products or services”. Neither the directive nor the code gives a definition, and no quantified test exists.
The logic is that of reasonable expectation, which the GDPR sets out in Recital 47: does the person, given their relationship with you, expect to receive this approach?
A customer who bought a pair of shoes expects to receive offers on shoes. They do not expect your partner’s insurance offer, nor your new car rental business. In case of doubt, the expansive reading is the one that argues badly.
The right to object, with every send
This is where legal compliance meets deliverability mechanics.
The text requires an objection offered at collection, then with every message. The GDPR, in Article 21, makes that objection absolute in marketing: it need not be justified and is not balanced against anything.
And the mailbox providers require, on their side, a precise technical mechanism with a 48-hour deadline. Both requirements point the same way, and the stricter in practice is the one that is not legal.
The case of non-commercial marketing
A second, distinct exception exists for non-commercial marketing, notably charitable. It also rests on legitimate interest, with the same requirements of prior information and a simple, free objection “with every send”.
So it exempts nothing essential: a charity soliciting donations must inform and allow objection, exactly as a company does.
What to do tomorrow morning
Open the definition of your “customers” segment in your sending tool and read the rule that populates it. In most installations we see, that segment includes accounts created without a purchase, and sometimes quote requests.
Rebuild it on the sole criterion in the text: a sale or a service actually delivered. The segment will shrink, often by a third.
For the population that drops out, there is no workaround, there is work: obtain consent, or move to the professional regime if the approach relates to the person’s profession, which requires a business address and a coherent subject.
And check the date: three years after the end of the commercial relationship, the question no longer arises, because the data should no longer be there.
Sources
- French postal and electronic communications code, Article L.34-5, paragraphs I and II
- Directive 2002/58/EC of 12 July 2002, Article 13(2)
- CNIL (updated 10 June 2026). La prospection commerciale par courrier électronique, SMS-MMS et automate d’appel
- Regulation (EU) 2016/679 (GDPR), Recital 47 and Article 21
- CNIL, decision no. 2021-131 of 23 September 2021. Référentiel relatif aux traitements de données à caractère personnel mis en œuvre aux fins de gestion des activités commerciales
LaFactory works email on the evidence: headers, DNS records, rejection logs. No open rate promises, ever. Get in touch for a deliverability audit.