France requires the consent of the person being recorded. Under Article 226-1 of the Code pénal, capturing the words of a person spoken in private without their agreement is a criminal offence — punishable by up to a year in prison and a €45,000 fine.
France hosts major B2B events across pharma, aerospace, luxury and technology, and it has one of Europe's most active data-protection regulators in the CNIL. If your team records booth conversations at a French show, the process needs to be deliberate.
Not legal advice. This summarises the position for sales teams. French privacy law interacts with criminal, employment and data-protection law. Have counsel or your DPO review your process before an event.
Article 226-1: the criminal layer
Article 226-1 of the Code pénal protects l'intimité de la vie privée — the privacy of private life. It makes it an offence to wilfully record or transmit, without the consent of the person concerned, words spoken in a private capacity or confidentially (paroles prononcées à titre privé ou confidentiel).
Article 226-2 extends the same penalty to anyone who keeps, brings to public attention, or uses such a recording.
Two points matter for exhibitors:
A booth conversation is generally "private" in this sense. The test is not whether the location is public but whether the exchange was directed to a specific person rather than broadcast. A discovery conversation about a prospect's budget and timeline is clearly private in character, even in a crowded hall.
The presumption of consent is narrow. Article 226-1 provides that where the acts are performed openly and in the presence of the person concerned, and that person does not object although in a position to do so, consent is presumed. This is genuinely helpful — but it is a rebuttable presumption, it applies only to overt recording, and critically it does not satisfy GDPR.
Why the presumption is not enough on its own
Relying on "they saw the device and kept talking" creates two problems.
First, it is evidentially weak. If the person later disputes it, you are arguing about what they noticed. You have no record.
Second, and more decisively, GDPR requires more. Article 4(11) defines consent as freely given, specific, informed and unambiguous, expressed through a clear affirmative action. Not objecting is, by definition, the absence of an action. The CNIL has been consistent on this: passive or implied consent is not valid consent.
So the criminal presumption and the data-protection requirement do not line up. Design for the stricter one.
The GDPR layer and the CNIL
France applies GDPR through the Loi Informatique et Libertés, supervised by the Commission Nationale de l'Informatique et des Libertés (CNIL) — historically one of Europe's most active enforcers.
You need a lawful basis under Article 6. For recording a conversation with a prospect, consent (Article 6(1)(a)) is the practical choice. Legitimate interests is difficult to sustain for audio capture of an identifiable person who would reasonably expect to be asked.
At the moment of collection you must provide, under Articles 13 and 14:
- The identity of the controller and DPO contact details
- The purposes and lawful basis
- Retention period
- The right to withdraw consent at any time
- Rights of access, rectification, erasure, restriction and portability
- The right to lodge a complaint with the CNIL
In booth practice: a short spoken summary plus a QR code to the full politique de confidentialité.
What good practice looks like in French
Ask, in French, before starting:
"J'enregistre notre conversation pour que mes notes soient exactes — êtes-vous d'accord ?" ("I am recording our conversation so my notes are accurate — is that alright with you?")
Then:
- Wait for an explicit oui or an affirmative gesture
- Make sure the device visibly indicates recording — this is what makes it au vu et au su, openly and knowingly, and engages the Article 226-1 presumption as a backstop
- Log that consent was obtained, with a timestamp
- Stop immediately if anyone objects, including someone joining mid-conversation
Retention and minimisation
Article 5(1)(c) GDPR requires data to be limited to what is necessary. The CNIL takes minimisation seriously and has repeatedly criticised organisations for retaining raw material longer than the purpose requires.
For booth recording this points to a clear design: extract the structured fields you need, then delete the audio. If your purpose is "capture the lead accurately," that purpose is fulfilled the moment name, company, requirement and next step are in the CRM. Keeping the recording beyond that is hard to justify.
This is how Confee works — audio is transcribed and reduced to CRM fields, and the raw recording need not be retained at all. Less data held is less risk, shorter retention obligations, and a smaller breach surface.
French booth checklist
Before the show
- Privacy notice available in French via QR code
- Booth staff scripted on the consent question
- Retention period defined and documented
- Register of processing activities updated (Article 30)
Per conversation
- Ask before recording
- Wait for an explicit yes
- Recording indicator visible
- Log the consent
- Stop on any objection
After the show
- Delete raw audio once fields are extracted
- Respond to any rights request within one month
The short version
France gives you a partial safety net — the Article 226-1 presumption of consent for open recording — but that net does not extend to GDPR. Ask clearly, get an explicit yes, keep the device visible, log the answer, and delete the audio once you have the lead data.
Do that and French shows are straightforward. Skip it and you have criminal exposure under the Code pénal and CNIL exposure under GDPR, independently of each other.
Related reading:
- Is Recording Sales Conversations Legal? — the cross-jurisdiction overview
- GDPR-Compliant Lead Capture — the data-protection side in full
- Recording Consent at German Trade Shows — the stricter neighbouring regime
FAQ
Can you record a business conversation at a trade show in France?
Yes, provided the other party has consented. Article 226-1 of the Code pénal makes it an offence to record words spoken in private without consent, and a booth conversation counts. France also applies GDPR through the Loi Informatique et Libertés, supervised by the CNIL.
What is the penalty for recording someone without consent in France?
Up to one year of imprisonment and a €45,000 fine under Article 226-1, with Article 226-2 applying the same penalty to keeping or using the recording. CNIL can separately impose GDPR fines up to €20 million or 4% of global turnover.
Does French law presume consent if someone keeps talking?
Article 226-1 presumes consent where recording is done openly in the person's presence and they do not object. But the presumption is rebuttable and does not satisfy GDPR's requirement for a clear affirmative act. Do not rely on it alone.
What does the CNIL expect from event recording?
A clear lawful basis, transparent information at the point of collection, strict data minimisation, a defined retention period, and demonstrable consent. The CNIL stresses that consent must be provable, so logging it is a practical necessity.