The CNIL has published its 2025 sanctions report, revealing a cumulative total of €486,839,500 in fines. While digital giants account for most of this amount (€475 million for two cookie-related sanctions), the 10 decisions targeting commercial prospecting directly concern call centers and sales teams.
Key figures from the CNIL 2025 report
In 2025, the CNIL issued 259 decisions in total:
- 83 sanctions (including 16 by the restricted committee, 67 through simplified procedure)
- 143 formal notices
- 31 reminders of legal obligations
- 2 warnings
The total fine amount — €486.8 million — is driven by two major sanctions issued in September 2025:
- €325 million against a major digital player for cookie and prospecting violations
- €150 million against an online retail site for tracker consent violations
The 10 sanctions targeting commercial prospecting
This is where telemarketing professionals need to pay attention. Ten decisions specifically sanctioned prospecting practices:
The heaviest sanctions
- €900,000 (May 2025) — A web marketing company for consent failures and insufficient proof of consent (CNIL decision)
- €600,000 (July 2025) — Distance selling of furniture for combined cookie/prospecting violations
- €80,000 (May 2025) — A data broker for lack of consent for electronic prospecting
Simplified procedure sanctions
- €17,000 — Data collection via contests with invalid consent
- €15,000 — Energy renovation company for unlawful prospecting
- €10,000 — Training center for non-compliance with right to object
Why call centers are under scrutiny
The CNIL has emphasized that commercial prospecting by electronic means requires the consent of individuals. This principle also applies to sharing data with commercial partners.
The most frequently sanctioned violations in prospecting:
- Lack of consent proof — Unable to demonstrate the prospect actually agreed to be contacted
- Non-compliance with consent withdrawal — Continuing to call after explicit objection
- Consent obtained through dark patterns — Pre-checked boxes, misleading wording
- Excessive data retention — Keeping prospect data beyond 3 years without interaction
Non-prospecting sanctions affecting call centers
Beyond direct prospecting, other sanctions impact the call center environment:
- 16 organizations sanctioned for abusive employee video surveillance — Continuously filming telemarketers is illegal except in exceptional circumstances
- 14 sanctions for security failures — Weak passwords, shared accounts between agents
- 14 sanctions for non-cooperation — Not responding to CNIL requests systematically worsens the sanction
What call centers must remember
1. Consent proof is essential
If you purchase opt-in leads, require timestamped consent proof from your supplier (timestamp, IP, exact text accepted). Without this proof, you're exposed.
2. Objection rights must be processed immediately
When a prospect says "don't call me again," their number must be added to your exclusion list within 24 hours. CNIL sanctions show that delays are systematically penalized.
3. Always cooperate with CNIL
In 2025, 14 organizations were sanctioned solely for ignoring CNIL requests. Not responding to a questionnaire or information request turns a simple audit into certain sanction.
4. Monitor your subcontractors' practices
The CNIL has reminded that subcontractors must process data only on the controller's instructions. If you outsource your prospecting, you remain responsible for your provider's practices.
The most exposed sectors in 2026
Analysis of 2025 sanctions reveals at-risk sectors:
- Energy renovation — Already sanctioned in 2025, sector under maximum surveillance with new August 2026 rules
- Professional training (CPF) — 5 political candidates sanctioned for prospecting, CPF follows the same pattern
- Insurance and health coverage — High call volumes = increased exposure
- Energy brokerage — A penalty liquidation shows strict enforcement of injunctions
How to prepare for CNIL audits in 2026
Based on the 2025 report, here's the compliance checklist for call centers:
- ☑️ Document each lead's origin with consent proof
- ☑️ Maintain an objection register updated in real-time
- ☑️ Train agents on compliant practices
- ☑️ Define retention periods and respect them (max 3 years without interaction)
- ☑️ Audit your subcontractors offshore or nearshore
- ☑️ Prepare a response file in case of CNIL audit
For more details, see our guide on CNIL audits to anticipate in 2026.
