Proof of Consent: What a Call Centre Must Be Able to Show

Why proof has become the central issue#

With the telemarketing reform, which took effect on 11 August 2026, the question is no longer "is this number on an opt-out list?" but "can we show that this person agreed to be called?". The burden of proof rests with the business, and the law also covers calls made by a third party acting on its behalf. The general framework is set out in our guide to the French telemarketing law and its effects in Morocco.

For a Moroccan centre, the consequence is operational: every campaign must rely on a verifiable evidence register, and every call must be traceable to an entry in that register.

What valid consent must contain#

The French Consumer Code and Decree No. 2026-662 set five cumulative requirements:

• A clear affirmative act: ticking an empty box, clicking a dedicated button, answering "yes" to an explicit question. Silence and pre-ticked boxes are excluded.
• Freely given: consent cannot be a condition for buying a product or service.
• Specific and informed: it names the business that will call and the purpose of the calls.
• Recent: it is valid for one year at most.
• Revocable: the person can withdraw it at any time, and the withdrawal must be acted on.

The evidence register: minimum fields#

These records are themselves personal data: access to them must be restricted and their retention governed. They must be kept for at least three years, a period that has to be reconciled with the applicable data protection rules.

Sources of consent and their risks#

One question to put to every list supplier: "Can you send me, for a number picked at random, the complete proof of consent within 48 hours?" A supplier that cannot do so shifts the risk onto the centre and its client.

Collecting consent during an inbound call#

An inbound call is a legitimate source, provided it is explicit. Example wording to adapt, in French for French customers:

« Accepteriez-vous que [Marque] vous rappelle pour vous présenter ses offres d'assurance habitation ? Votre accord est valable un an et vous pouvez le retirer à tout moment en nous le disant ou en écrivant à [adresse]. » ("Would you agree to [Brand] calling you back to present its home insurance offers? Your agreement is valid for one year and you can withdraw it at any time by telling us or by writing to [address].")

The agent records the answer in the CRM, the call recording serves as the record, and the expiry date is calculated automatically. The question must be asked after the customer's request has been dealt with, never as a condition for dealing with it.

Before every call: the checks to automate#

1. Check that proof of consent exists for this number and this brand.
2. Check that the purpose of the campaign matches the purpose consented to.
3. Check that the consent is less than a year old and has not been withdrawn.
4. Where there is no consent, check whether the call falls under an exception (existing contract, press subscription) or is a callback requested less than five working days ago.
5. Check that the sector is not one closed to telemarketing even with consent.
6. Check French calling hours and the cap of four calls in 30 days.
7. Log the check, its result and the identifier of the proof used.

These checks are a matter of privacy by design: they must be built into the dialler, not left to the agent's judgement.

When the consumer asks for the proof#

The decree provides that the proof must be made available to the consumer. The centre and its client must therefore define in advance who responds, within what time frame and in what form: an extract from the register showing the date, channel, brand, purpose and text presented. A quick, clear answer often defuses the complaint; no answer fuels it. It is also a useful indicator of customer relationship quality.

On the Moroccan side: prospecting Moroccan consumers#

For campaigns targeting people in Morocco, Law 09-08 on personal data protection applies. According to the CNDP's (Morocco's data protection authority) fact sheet on prospecting, Article 10 requires prior consent for prospecting by automated calling machine, fax or email, with an exception for products or services similar to those of a previous sale. Every message must offer a free and simple means of objecting. Keeping proof of consent remains the best answer in the event of a CNDP inspection.

Implementation checklist#

1. Define the register template with the fields above.
2. Audit active lists and set aside those without compliant proof.
3. Have list suppliers sign an undertaking to provide individual proof, subject to audit.
4. Rewrite collection forms and scripts: brand, purpose, duration, withdrawal.
5. Connect the automated checks to the dialler.
6. Set the archiving period at three years or more and secure access.
7. Set up the procedure for responding to requests for proof.
8. Document everything for client audits.