What Changed
- CNIL's Restricted Committee formally closed the injunction issued against SOLOCAL MARKETING SERVICES via deliberation SAN-2026-012 on 17 September 2026.
- SOLOCAL MARKETING SERVICES avoided a daily penalty payment of €10,000 by instituting automated analysis and human verification of third-party consent forms within nine months.
- CNIL warned that direct marketing entities remain legally accountable for invalid consents gathered by primary collectors, even when internal compliance verification systems are in place.
The French Data Protection Authority (CNIL) Restricted Committee announced on 24 September 2026 that it has officially closed an injunction previously issued against SOLOCAL MARKETING SERVICES. The decision follows the company's implementation of compliance measures to verify consent collected by its third-party data collection partners.
On 15 May 2025, CNIL imposed a fine of €900,000 on SOLOCAL MARKETING SERVICES for breaches of the French Postal and Electronic Communications Code (CPCE) and the General Data Protection Regulation (GDPR). The company acquires prospect data from data brokers and publishers of contest or product testing websites ("primary collectors") to conduct SMS and email marketing campaigns for advertiser clients. CNIL found that misleading collection forms used by data brokers prevented users from giving free and unambiguous consent under the GDPR.
Alongside the fine, CNIL issued an injunction ordering the company to cease electronic commercial prospecting without valid consent within nine months, under a periodic penalty payment (astreinte) of €10,000 per day of delay.
By deliberation SAN-2026-012 on 17 September 2026, CNIL determined that SOLOCAL MARKETING SERVICES had demonstrated compliance within the specified timeframe. The company established verification procedures combining automated analysis of data collection forms with human review to assess consent validity collected by primary partners. CNIL concluded that these measures, if applied strictly, allow the company to verify valid consent. Consequently, CNIL decided not to collect the periodic penalty payment and closed the injunction.
CNIL emphasized that despite implementing these controls, SOLOCAL MARKETING SERVICES remains fully responsible for the validity of consents collected on its behalf. The company may still face liability if non-compliant forms bypass its internal controls.
Who May Be Affected
Data brokers, direct marketing firms, advertiser clients, and primary data collectors operating in France and across the European Union.
Cross-Border Context
Enforces GDPR and national e-privacy obligations (French CPCE Article L. 34-5) regarding third-party consent verification for commercial prospecting across the EU.
What to check next
- Examine CNIL Deliberation SAN-2026-012 of 17 September 2026 and Deliberation SAN-2025-001 of 15 May 2025 on Légifrance.
- Review organizational protocols for auditing third-party consent forms and lead generation streams under EU GDPR standards.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.