On 25 June 2026, the French Constitutional Council declared three paragraphs of Article L.34-5 of the postal and electronic communications code unconstitutional, the very article prohibiting email marketing without prior consent.
The news travelled fast, and in a false form: no, marketing without consent has not become lawful.
What exactly was struck down
Decision no. 2026-1210 QPC, handed down on a question referred by Orange, covers the sixth, eighth and penultimate paragraphs of Article L.34-5, in the wording resulting from the law of 24 July 2020 on telephone canvassing.
Those paragraphs do not carry the prohibition. They organise enforcement.
The ground for the ruling fits in one sentence: those provisions allowed three separate authorities to sanction the same breaches with administrative fines of the same nature, aimed at protecting the same social interests. The Council found this a breach of the principle of necessity of penalties, guaranteed by Article 8 of the 1789 Declaration.
Three authorities, one set of facts, three possible fines. It is that cumulation that falls.
What remains fully in force
The prohibition itself, in paragraph I: direct marketing by electronic mail using the contact details of a natural person who has not given prior consent remains prohibited.
The existing customer exception, in paragraph II, with its cumulative conditions.
The GDPR in its entirety: legal basis, notice to individuals, retention period, absolute right to object in marketing.
And the authority’s power to sanction on those grounds, which it exercised ten times in 2025 for marketing-related facts.
A company marketing without consent therefore gained nothing on 25 June 2026. It merely stopped facing three fines instead of one.
Repeal is deferred to 31 October 2027
The Council did not make those paragraphs disappear immediately. It deferred their repeal to 31 October 2027, a classic technique giving the legislature time to rewrite the provisions without creating a gap.
In the meantime a transitional reservation applies: parallel proceedings before several of those authorities, for the same facts, may not be brought.
What the legislature will do before then is uncertain. The simplest route would be to designate a single competent authority. We do not know, and we will refrain from predicting: the fate of the ePrivacy Regulation, withdrawn after eight years of negotiation, is a reminder of what forecasts are worth here.
The lesson, for anyone who reads headlines
“The Constitutional Council strikes down the article governing email marketing” is an accurate headline and a misleading piece of information.
A statute is not a block. A single article can carry a prohibition, its exceptions, its penalties and the allocation of powers between authorities. Striking down the allocation of powers does not touch the prohibition.
Verification takes two minutes: open the decision, read the operative part, identify the paragraphs covered, then read those paragraphs in the code. We did it, the source is below, and nobody needs an intermediary to do it again.
It is the same discipline we apply to every figure circulating in this trade: the source, or nothing.
What to do tomorrow morning
Nothing in particular. That is the main value of this decision to you.
If your compliance rested on the prohibition itself, it is intact. If your management asks whether “the L.34-5 ruling” changes anything in your practices, the answer fits in one sentence: it concerns the cumulation of proceedings between three authorities, not the rules you must follow.
And note the date of 31 October 2027 in your monitoring. By then a new enforcement scheme will have been written, and that is when it will need rereading.
Sources
- Conseil constitutionnel, decision no. 2026-1210 QPC of 25 June 2026, Société Orange SA
- Conseil constitutionnel (25 June 2026). Press release on decision no. 2026-1210 QPC
- French postal and electronic communications code, Article L.34-5
- CNIL (9 February 2026). Bilan des sanctions et mesures correctrices 2025
LaFactory works email on the evidence: headers, DNS records, rejection logs. No open rate promises, ever. Get in touch for a deliverability audit.
