Three years, and opening an email does not count

by Francis Rozange | Sep 8, 2026 | Email Marketing

Abstract 3D render: a glass hourglass whose falling sand is luminous particles

A prospecting database is not an asset. It is perishable stock, and the expiry date is published.

Three years. The French authority’s reference framework on managing commercial activities, adopted by decision of 23 September 2021, sets it for customers and prospects alike, with two different starting points.

Two counters, two starts

For a customer, the framework states that data may be kept for the duration of the commercial relationship, then for three years from the end of that relationship, for example from a purchase, the expiry of a warranty, the end of a services contract, or the last contact from the customer.

For a prospect who has never bought anything, the counter starts at collection: three years from collection by the controller or from the last contact from the prospect.

Note the word governing both formulations: from the person. The contact that resets the counter must come from them, not from you. Your twelve campaigns this year extend nothing.

The sentence that costs the most

The framework adds a clarification of considerable reach: the mere opening of an email should not be considered a contact from the prospect.

Set against what Apple has done to the open rate since 2021, that sentence produces a rare conjunction.

Technically, the open is no longer reliably measurable: it is preloaded by a relay, independently of any human gesture.

Legally, the open does not count as a contact: even measured correctly, it does not extend the retention period.

The trade’s favourite indicator is therefore both false and legally ineffective. Many databases are nonetheless kept alive by reactivation rules based on it.

What counts as a contact from the prospect is an act: a click, a reply, an order, a request, a login to their account.

What happens after three years

The framework does not prescribe abrupt deletion. It opens a door, a narrow one: renewed contact is possible, to ask whether the person wishes to keep receiving approaches.

And it sets the outcome: absent a positive and explicit reply, the data must be deleted or archived.

Silence counts as refusal. That is the exact opposite of the rule most reactivation campaigns apply, keeping by default everyone who did not reply.

Excessive retention is a breach in its own right

Retention is not a secondary matter an inspection would look at last. It is a ground for sanction on its own.

In the decision of 5 December 2024 against KASPR, the authority found, among three breaches, a disproportionate retention period: data was kept for five years from each update, which, for a continuously fed database, amounted to never deleting anything.

The mechanism is worth understanding, because it is widespread: a purge rule indexed on the record’s last modification, in a system that continuously enriches records, is a purge rule that never fires.

The hidden benefit of purging

Deleting addresses hurts. Sales leadership counts database size as an asset, and marketing is judged on volume sent.

Yet purging mechanically improves everything that actually matters.

A three-year-old address that has never done anything is not neutral. Either it no longer exists and produces a bounce, or it has been recycled by the operator and may have become a spam trap, or it belongs to someone who has forgotten who you are and will click the report button.

All three outcomes degrade your reputation, and the third feeds the only number that decides your deliverability. Compliance and performance point the same way here, which is rare enough to be worth noting.

What to do tomorrow morning

Pull the distribution of your database by date of last contact from the person. Not by send date, not by open date: by date of act.

You will get a curve with a long tail, and that tail is your exposure. Count what it weighs, in addresses and in percentage.

Then write the purge rule, with its start date, and automate it. A rule applied once by hand, during an audit, never survives its author.

Finally, if part of that database comes from an acquired list, retention is not the first question: informing the individuals was, and it had a one-month deadline.

Sources

LaFactory works email on the evidence: headers, DNS records, rejection logs. No open rate promises, ever. Get in touch for a deliverability audit.