CertiLead, explained in English.

In short

A proof of consent that travels with the lead.

• What it is. CertiLead is a proof-of-consent service for lead generation in France. A small script, the tracker, is added to the form where a consumer agrees to be called. At submission, CertiLead seals what the consumer saw and did, and returns a proof token that is passed along with the lead.
• Who can use it. The account is opened by the company that operates the forms, whether it is registered in France or abroad. The professionals who will call the consumers, named in the consent, are companies registered in France.
• Who pays. Lead buyers check the token before calling, and pay for that check. Creating proofs is free for providers, whatever the volume.
• What does not change. Your landing pages, routing rules and CRM stay as they are. The tracker never blocks a submission: if CertiLead does not answer within three seconds, the form goes on without a token.
• What it is not. CertiLead does not make a form compliant by itself. It records what the form displayed and what the consumer did. The wording of the form, the list of recipients and your GDPR obligations remain your responsibility.

Decree no. 2026-662 · applicable since 11 August 2026

Why French lead forms need a proof.

Since 11 August 2026, business-to-consumer telephone prospecting in France requires the consumer's prior consent (opt-in). It replaces the previous opt-out regime, the Bloctel do-not-call list. For a company that collects a contact in order to sell it, the question is no longer "did the person tick a box?" but "can we prove what the person agreed to, for which advertiser, for how long, and what the status of that consent is today?".

The five items your form must make provable

1. Who will call, and about what. The identity of every authorised professional, of the collector if different, and the nature of the goods or services offered.
2. A real question. The consumer accepts or refuses calls by a dedicated, positive, understandable action.
3. A bounded duration. Announced at collection, never above one year, never tacitly renewed.
4. A withdrawal that is truly accessible. Possible at any time, through a path no more complex than the one used to consent.
5. An available proof. The person knows they can obtain, free of charge, an individual proof on a durable medium.

What is at stake

• Administrative fines of up to €75,000 for an individual and €375,000 for a company, and the decision can be made public.
• A contract concluded after prospecting carried out in breach of the rule is void.
• A professional who profited from unlawful calls is presumed liable, unless they show they were not at the origin of the breach. Without a file, that demonstration is impossible.

Who answers for what

Selling a contact does not transfer the duty of collection, and buying it does not exempt from checking. Each party answers for its own part, and no tool, ours included, takes any of it over.

Official sources (in French)

• Decree no. 2026-662, the text that sets the regime applicable since 11 August 2026.
• Articles L. 223-1 to L. 223-7 of the Consumer Code: prior consent, burden of proof and penalties.
• DGCCRF guidance, the reading of the administration in charge of controls and penalties.
• CNIL, transmitting data to partners: what naming recipients requires.

Informative summary, not legal advice.

Mechanism

How the proof is built, sealed and anchored.

What a proof contains

• The hashes and the position in the chain and in its batch.
• The sealed consent block: the professionals authorised to call, the collector, the goods or services, the validity period, the withdrawal and proof-access texts, the state and label of the checkbox, the closed list of named recipients.
• Pseudonymous contact identifiers obtained through VOPRF in the browser, with their scheme and key identifier. Historical proofs retain their HMAC references and remain verifiable.
• The encrypted session recording (AES-256-GCM with envelope encryption), reserved for audit.
• The technical context: page address, timing, anti-bot score, browser environment.

After the collection

• The buyer checks. Before calling, the lead buyer checks the token on CertiLead at one of three levels (Essential, Reinforced, Premium). The check answers three questions: does the consent cover this buyer and this purpose, is it still valid, has it been withdrawn? Buyers pay per check; providers pay nothing.
• The consumer can withdraw. On the public portal, a consumer proves ownership of their email address with a one-time code, lists the consents recorded with it and withdraws one. The proof changes status and no longer covers future calls. Buyers you listed with a contact address are notified.
• You can withdraw on their behalf. If a consumer asks you directly, the dashboard ("Retraits de consentement") finds their proofs by email or phone number and switches them off, with a written confirmation to the person. A withdrawal is final.
• Your signed receipt. cert_receipt is a deposit receipt signed by CertiLead (Ed25519) and handed over immediately, before any internal processing. It carries the token, the SHA-256 fingerprint of the sealed content and the submission date. Archived with the lead, it proves independently of CertiLead that the sealed content was never altered. Anyone can verify the signature with the public keys published by the API (/api/v1/public-keys); the dashboard has a "Vérifier un reçu" page for it.

Integration

One script, one attribute, then test before buying traffic.

One asynchronous script before </body>, one attribute on the consent checkbox, two optional attributes on the displayed texts. The tracker observes the form as it exists: no library, no rebuild, no change to your submission logic.

<!-- CertiLead Tracker v3 -->
<script src="https://providers.certilead.fr/tracker/v3/YOUR_GENERATOR_ID" async referrerpolicy="no-referrer"></script>

<form action="/lead" method="post">
    <input type="email" name="email" autocomplete="email">
    <input type="tel" name="phone" autocomplete="tel">

    <label>
        <input type="checkbox" name="phone_consent" data-certilead-consent="telephone">
        J'accepte d'être contacté(e) par téléphone par Assureur A et Assureur B
        au sujet de ma complémentaire santé, pendant 180 jours.
    </label>

    <p data-certilead-mention="retrait">Vous pouvez retirer ce consentement à tout moment …</p>
    <p data-certilead-mention="preuve">Vous pouvez obtenir gratuitement la preuve de votre consentement …</p>

    <button type="submit">Être rappelé</button>
</form>

What the tracker injects

On submission, the tracker holds the form for the time needed to obtain the proof (under a second in practice, three seconds at most), injects two hidden fields and replays the submission with the button that was used, so that your own handlers and libraries run with the token present:

• cert_token: the proof token, CL-YY-XXXXXXXXXXXX. Pass it to the buyer with the lead.
• cert_receipt: the signed receipt, base64-encoded. Keep it in your CRM with the lead.

Three modes when the form is not compliant

A form can work perfectly and still produce incomplete proofs: a missing text, no configuration, a recipient without SIREN. You choose, per tracker, what happens in that case.

Technologies

• Classic HTML form. Nothing to change in your markup: the tracker intercepts the submission, obtains the proof, then replays the original submission.
• jQuery, AJAX, JavaScript-driven submissions. The interception runs before handlers listening at document level, so a library that serialises the form right after cannot leave without the token.
• React, Vue, dynamic funnels. Forms mounted after page load are detected as they appear. A funnel step displayed later is followed like the others; CertiLead.scan() forces a rescan if needed.
• WordPress. The script works as is, but WPForms, Gravity Forms and Contact Form 7 only save the fields declared in their editor, so the injected token is lost when the entry is stored. The CertiLead WordPress extension keeps the token and the receipt with each entry, designates the checkbox (which the editors cannot do) and shows an integration status screen. Supported: WPForms (free and paid) and Gravity Forms. Updates arrive through WordPress like any other extension. Its admin screens are in French.

No form, or custom validation: the JavaScript API

Many funnels never submit a form: the fields live in a div, a button triggers a request, and your code decides whether the input is acceptable. The tracker steps aside and hands control to you.

// Fields in a container, a button triggers your own request: follow the container.
CertiLead.observe(document.querySelector('#quote-block'), { trigger: '#send' });

// Custom validation: declare the manual mode, then create the proof yourself.
// <form data-certilead-mode="manual"> … </form>
const proof = await CertiLead.certify(form, { timeoutMs: 3000 });
if (proof.status === 'skipped') {
    // contact_not_found | consent_not_found | consent_not_given
}
// proof.token and proof.receipt_b64 go with your lead
CertiLead.reset(form); // before a new attempt

• certify() never submits the form. timeoutMs is capped at three seconds: your funnel can never hang on the creation of the proof.
• In manual mode, at least one usable email address or phone number and a ticked consent box are required; otherwise the method answers contact_not_found, consent_not_found or consent_not_given without any network call.
• Do not combine the automatic listener and the manual call on the same form. reset() clears the stored result before a new attempt.

Test before buying traffic

• Playground. In the dashboard ("Intégration", then "Playground"), sample forms with a compliant checkbox let you see the whole flow, consent block included, without touching your site.
• Test mode (?test=true). Your real page, the complete flow, no proof stored.
• Diagnostic panel (?debug=true or the debug link). Initialisation status, detected forms, live metrics, bot detection, network requests, every error explained with its fix, and a compliance assistant that compares the displayed texts with the tracker's configuration. The report can be copied as JSON for your team or for support.
• Go live. Production script, mode "Signaler", and a watch on leads without cert_token in your CRM.

Webhooks and follow-up

In "Webhooks", subscribe an HTTPS endpoint to proof.created (a proof was written), proof.claimed (a buyer checked it), proof.withdrawn (the consumer, or you on their behalf, withdrew the consent) and proof.revoked (fraud established), plus tracker.non_conform in "Signaler" mode. Failed deliveries are retried with an increasing delay. "Attestations" lists every proof with its status, "Batches" the anchoring batches they belong to.

Dashboard

Dashboard glossary, French to English.

The provider dashboard is in French. Browser translation handles the day-to-day; this table gives the exact meaning of each entry of the menu.

Statuses and terms you will meet

For your legal and data-protection teams

Data protection and hosting.

• Roles. For the personal data collected on your form, your company is the controller. CertiLead acts as its processor for the technical operation of sealing and archiving the proof. The applicable terms are the French general terms of use and service and the French privacy policy, which also lists the subprocessors and the data processing terms.
• Hosting. The service and its data are hosted in France by OVH SAS (Roubaix). Transactional emails are sent through Mailjet.
• Data in the proof. Integrity hashes, VOPRF contact identifiers (HMAC references for historical proofs), the sealed consent block, the technical context, and the encrypted session recording. The proof contains no readable copy of the original email address or phone number.
• Retention. Three years from collection (article R. 223-2), on write-once storage that CertiLead itself cannot alter or delete before the term.
• Integrity. SHA-256 hash chain, Merkle batches (RFC 6962), Ed25519 signatures, qualified electronic time stamps (eIDAS, RFC 3161), OpenTimestamps anchoring, and the signed receipt handed to you at submission.
• Session recordings. Encrypted with AES-256-GCM under envelope encryption. Decryption is reserved for audit, requires a stated reason and is logged.
• Consumer rights. The public portal lets any consumer list the consents recorded with their email address and withdraw them; you can also do it on their behalf from the dashboard, and the buyers you listed are notified.

Questions

What your acquisition, technical and legal teams ask first.