France’s data protection regulator has closed its order against Solocal Marketing Services, the company it fined €900,000 in May 2025 for emailing and texting people without valid consent. The decision, dated 17 September, was published by the CNIL on 24 September.
Solocal does not collect its own prospects. It buys them from data brokers, prize competition sites and product-testing sites, then contacts those people by SMS or email on behalf of advertisers. In 2025 the CNIL found that the brokers’ sign-up forms were designed to mislead. Consent gathered that way was neither free nor unambiguous, so Solocal had no legal basis for the campaigns built on it. Alongside the fine, it was given nine months to stop electronic prospecting without valid consent or pay €10,000 for every day it failed to comply.
Solocal met the deadline. It now checks the consent its partners collect for it: software analyses the partners’ sign-up forms and a person reviews the results. The CNIL accepted this, waived the daily penalty and closed the case.
That is rare. Regulators usually say what went wrong and leave the fix to guesswork. Here the CNIL has accepted a specific method for vetting bought data: check the forms where the consent was given, not the broker’s assurance that it was.
The closing note is the part list buyers should read twice. The CNIL says the checks work only if they are applied scrupulously. Solocal stays responsible for every consent its partners collect on its behalf, and could still be liable for a bad form that gets past its controls. Buying a list does not buy you out of the consent problem.
For senders elsewhere in Europe the principle travels. Under GDPR and the ePrivacy rules, consent to email marketing belongs to the business that sends, whoever built the form. A broker’s word is no defence. The CNIL has now said, in effect, that looking at the form yourself might be.
The deliverability case was always simpler. Co-registration data brings spam traps, complaints and people who don’t remember signing up. Most reputable ESPs banned purchased lists long before any regulator did.
