Hook: Today’s digest slipped in a line about a new French law coming into force on 11 August 2026: "France bans unsolicited telemarketing calls, fines up to €375,000 per call." At first glance—just another local news item, the kind where "the government shakes its finger at scammers." But dig half a bayonet deep, and it turns out this is a story about a fundamental architectural vulnerability—about how the telephone network, designed by Alexander Bell in 1876 to connect two known subscribers via an operator, unlearned how to tell a legitimate call from spam the moment the world switched to over-the-top VoIP and caller ID spoofing. And this is the first case in history where a national law isn’t fighting scammers, but the very architecture of telephone signaling—because no signaling system, SS7 or SIP, contains a cryptographically protected notion of "the caller truly has the right to ring this subscriber." So France’s 2026 law isn’t about fines. It’s about the state admitting for the first time that the protocol doesn’t solve the problem—and deciding to patch the hole with criminal law.
That Tuesday, Law No. 2026-878 "On Countering Unwanted Commercial Calls" came into force, backed by the Macron government and pushed through parliament by Alice Vilcot (chief of staff at the Directorate General for Competition, Consumer Affairs and Fraud Control—DGCCRF). The law radically changes the logic: France is switching from opt-out to opt-in. Before 11 August, there was the Bloctel system—a "Do Not Call" registry where you could add your number so telemarketers would leave it alone. After—no calls without prior subscriber consent. Consent can be obtained in three ways: at a store purchase, during an office visit, or by filling out a form. It can be revoked at any time. Exceptions—calls regarding an existing contract (e.g., your bank can call about your mortgage).
The fines are a European record, but not because the state believes they’ll be collected:
That’s 750 times higher than the previous fine (€500). Because businesses treated the old fines as a "cost of doing business"—covered by a 0.5% conversion rate, says Micode (a tech blogger whose 2026 documentary investigation into Moroccan call centers went viral in French media and formed the basis of the law).
But the most interesting part is the third clause, which almost no one noticed. The law bans calls not only from within France but also from abroad to French numbers—with extraterritorial effect. This is the first case in the EU where a national telemarketing law extends to foreign jurisdictions. Which is legally contentious in itself: to hold a Moroccan call center accountable, you’d either need to extradite its operators or block international gateways at the France-IX level. Neither is mentioned in the law—just fines.
The law hit not those it was aimed at. 80% of revenue from Moroccan call centers historically came from the French market. Younes Sekkouri, Morocco’s Minister of Employment, told parliament in early August that 50,000 jobs in the industry were at risk—an industry generating over $1 billion in annual revenue and attracting around $100 million in foreign direct investment. Youssef Chraïbi, president of the Moroccan Federation of Outsourcing, clarified: "Pure telemarketing now accounts for only 15–20% of the sector’s activity"—the rest is B2B, tech support, financial services. But that 15–20% is the most profitable slice, and it’s what kept most operators in Tangier and Casablanca afloat.
Cheap labor, French-speaking workforce, weak unions—Morocco was historically France’s "offshore" in the same way Ireland was Silicon Valley’s. France’s 2026 law is the first systemic shock to this model. And, characteristically, there’s no Moroccan equivalent of the law—calls from Morocco to other countries will continue, just not to French numbers.
And here’s where it gets most interesting for us as engineers. Let’s set politics aside for a second and get to the core: why is phone spam even possible? Why can email spam be filtered (with varying success), but phone spam practically can’t?
The roots go back to 1876. Alexander Bell patented the telephone on 7 March, and the first commercial network, Bell Telephone Company, started operating in 1877. The architecture was extremely simple: two subscribers, one switchboard operator, a physical wire. When you wanted to call Mr. Smith, you cranked the magneto on your phone, a light bulb lit up in the central office, the operator (often a woman) asked "Number, sir?", and manually plugged the jack into the socket. The operator was the enforced arbiter—they saw both parties, could refuse the connection, could verify the caller’s identity.
The first "unwanted calls" problem emerged in 1903, when the Boston Globe reported on a department store’s ad campaign: "On Friday morning, the telephone exchange operator dialed subscribers’ numbers and read out an advertisement. Telephone users began complaining that such calls disrupted work and personal life." In 1909, the journal Telephony published a response from a Boston housewife that became canonical: "My telephone is far more of a nuisance to me than it is a convenience"—a quote now cited by Wikipedia in the telemarketing article as the first documented protest against phone spam.
So the problem is 137 years old. And it remains unsolved for a fundamental reason: the telephone protocol doesn’t know who’s calling.
When Bell System designed the network in the 1900s, the idea was simple: wire = identity. If a wire ran from the central office to a subscriber, the caller was the subscriber that wire belonged to. No "signature" needed—the very fact of physical connection was confirmation. When Signaling System No. 7 (SS7) replaced physical wires with digital signaling in the 1970s, this ideology persisted: Calling Party Number (CPN) in the ISUP (ISDN User Part) signaling message was treated as "here’s the number of the person calling." No cryptography. No signature. Just a text field where the sending party could write whatever they wanted.
When VoIP (Voice over IP) emerged in the 1990s, and especially the SIP (Session Initiation Protocol, RFC 3261, 2002), the From: field in SIP messages wasn’t signed either. Any softphone could put whatever it wanted there. This is called Caller ID spoofing—number spoofing. And it’s not a bug, but a feature—operators allowed spoofing for decades because it enabled, for example, call forwarding through a corporate PBX without losing the original number, or routing calls through multiple VoIP providers while preserving the end subscriber’s identification.
In 2017–2020, the FCC, ATIS, and SIP Forum finally grasped the scale of the problem (in the U.S. alone, over 4 million complaints about robocalls were filed annually, and 60% of all calls in the U.S. in 2019 were spam). The response was the STIR/SHAKEN architecture (Secure Telephone Identity Revisited / Signature-based Handling of Asserted Information using toKENs)—an attempt to finally cryptographically sign Caller ID in SIP messages.
How it works in theory:
In theory—beautiful. In practice (per TransNexus data, June 2024), STIR/SHAKEN covers only 45.7% of calls in the U.S. (and this after four years of mandatory implementation). Of these:
54.3% of calls aren’t signed at all—these are international calls, calls via legacy TDM networks, calls from small VoIP providers that haven’t connected to STIR/SHAKEN. C-level (which technically means "the operator has no idea who’s calling but signed that the call came through their network") is essentially useless attestation, yet it accounts for 10% of traffic because it’s the easiest to obtain: just press the "sign" button in the VoIP operator’s admin panel.
And most importantly: STIR/SHAKEN doesn’t work for international calls. When a call comes from Morocco via an international gateway to a French number, the Moroccan operator isn’t required to sign, and the French operator physically can’t verify the authenticity of the Moroccan CPN. There’s an Out-of-Band SHAKEN specification—passing the signature via a special API—but it’s supported by a negligible number of operators worldwide. So a call from Tangier to a Paris number, routed through three VoIP providers, architecturally can’t be authenticated by any party.
That’s why France’s 2026 law isn’t targeting scammers (who bypass STIR/SHAKEN anyway via international channels) but legitimate Franco-Moroccan BPO companies that conducted business legally, complying with all previous laws, but simply via an international channel that contains no cryptographic signature.
France’s 2026 law is the fourth attempt to tackle the problem legally. The first was Bloctel, launched in June 2016. The principle: a registry where you could add your number, and telemarketers were obligated to check it before calling. As of 2023, about 4 million numbers were registered. Seemed like a working scheme. But in December 2024, the registry was hacked: 3 million phone numbers tied to identifiers were leaked, turning the "Do Not Call" registry into the perfect call list for spammers. The breach was discovered after victims themselves started complaining about a sharp increase in spam calls—meaning the registry literally helped fraudsters find those most likely to answer and not hang up.
This isn’t unique to France. In the U.S., the National Do Not Call Registry (created in 2003, covering 245 million numbers) showed a 50% drop in complaints by 2024 compared to 2021—but only against legitimate telemarketers. Robocalls from abroad (India, the Philippines, Caribbean countries) continued to rise. The main nuance: DNR/DNC only works when there’s someone to sue. If the caller is in India, the FTC/FCC can only block them at the U.S. gateway. But there are thousands of gateways, and blocking one P-record in DNS doesn’t prevent switching to another.
Canada (DNCL, since 2008)—coverage of about 12 million numbers, complaints drop by 10% annually, but robocalls still make up ~25% of incoming calls.
The UK (Telephone Preference Service, since 1995)—coverage of 20+ million, fines up to £500,000 per call, but per Ofcom data, in 2023 UK residents received 2.5 billion spam calls—47 calls per person per year.
Germany—system in place since 2009, opt-in for most categories. Fines up to €300,000. Effect: complaints dropped by 30% over five years, but fraudulent calls continue to rise.
The Netherlands—in July 2026 (literally a month ago) tightened rules, banning calls even to their own customers without separate consent. So France is following the same path as the Netherlands.
The pattern: all Do-Not-Call registries worldwide work against legitimate businesses and don’t work against illegitimate ones. Each subsequent law tightens conditions for the former and doesn’t touch the latter. This is a typical problem of regulation that optimizes the behavior of "good" actors and leaves "bad" ones in the same spot because they, by definition, don’t follow the rules.
In 137 years of fighting phone spam, humanity seems to have tried everything:
Blacklists (Call blocking, appeared in the 1990s, Panasonic phones with blocking for 100 numbers, in the 2020s—mobile apps like Truecaller, Hiya, Nomorobo). Problem: number spoofing, fraudsters generate numbers in batches and switch every 100 calls.
Reverse CAPTCHA (Challenge-response)—Telemarketing Guard from Primus Canada (2007): the caller must first press a button and say their name, the subscriber decides whether to accept or reject. Problem: human operators in call centers pass CAPTCHA, but robodialers don’t—though then robodialers won’t get through, and plus—legitimate telemarketers drop off.
Realtime behavioral analysis (Call Guardian from TNS, analyzes 25 billion public calls per year in real time)—detects robocall patterns (call at random time, short duration, mass dialing). Problem: false positives, when a legitimate robocall (e.g., a doctor’s appointment reminder) gets blocked.
Caller ID Reputation (Enhanced Caller ID from Cequint, Verizon/Sprint)—based on crowdsourced databases and big data analysis. Problem: same spoofing, plus dependence on database quality (when Truecaller was hacked in 2013 and its 30-million "trusted" number database leaked—that was the first major public incident with a crowdsourced registry).
STIR/SHAKEN (since 2020–2021)—cryptographic signature. Problem: 45% coverage in the U.S., 0% on international routes, uselessness of C-level, which accounts for 10% of traffic.
AI filters on the subscriber side (built into iOS 26 and Android 15 in 2025)—neural networks in real time determine whether it’s a conversation or a synthetic voice. Problem: 1.5-second delay when a call comes in, false positives, doesn’t work for SMS spam.
France’s 2026 law is a rejection of the engineering approach in favor of the legal one. Essentially, the Macron government admitted: "We can’t solve this technically within a reasonable budget. So we’re banning it." This is the first such precedent in the EU—previously, European countries tried to solve the issue through telecom operator regulation (Berec guidelines 2024), but not through a direct ban on business activity.
The law wouldn’t have been possible without Micode (real name—Mickaël Tade, 32, a former developer at a Paris startup turned tech blogger with 4 million YouTube subscribers). In 2024–2025, he conducted a six-month undercover investigation into Moroccan call centers, infiltrating one of the companies as a trainee operator and documenting the entire chain from the inside.
Here’s what he found (per franceinfo and Marianne, June 2026):
Selling "legitimate" numbers on the black market. In Morocco, there are companies legally registered as BPO (Business Process Outsourcing) that obtain thousands of French numbers (via VoIP providers that don’t verify real ownership) and then sell this number pool to small call centers for $50–200 per number per month. Thousands of numbers—for €1 each.
Predictive dialers—software that dials numbers faster than an operator can answer, connecting the operator only when the subscriber picks up (or their answering machine finishes recording). One operator’s productivity—up to 200 calls per hour versus 30–40 in normal mode. This software creates the feeling that calls are "coming in a flood."
Social engineering scripts—Micode documented scenarios where operators are instructed to never name the company, introduce themselves as "your bank’s security service" or "Orange support," and use the subscriber’s name (obtained from leaked databases) to create an illusion of familiarity: "Hello, Mr. Dupont, this concerns your recent loan application..."
Bypassing DNC through cross-selling—after the first "yes" (e.g., answering a survey question), the subscriber is automatically considered to have consented to marketing calls, and their number is removed from all DNC registries by internal logic.
Caller ID spoofing by default—95% of calls go out with spoofed numbers. Spammers set numbers that locally match the subscriber’s number (for Parisians—a Paris 01, for Marseillais—a Marseille 04), increasing answer conversion by 3 times (per Hiya 2023 data).
Micode’s documentary racked up 18 million views in its first week and became a political detonator. Alice Vilcot told Le Monde outright: "Without Micode’s investigation, the law wouldn’t have passed. We got a political window thanks to real faces, real voices, real video. Without that, the public would’ve stayed in the ‘calls are annoying, but what can you do’ mindset."
Back to our architectural lens: France’s law doesn’t solve the problem—it masks it. Because:
In other words, the law treats the symptom, not the disease. The disease is the architecture: the telephone network, designed in the 19th century, has no concept of "sender authorized," and no legal patches will fix this as long as signaling protocols remain "honest" in the sense that they carry the information declared by the sender without cryptographic verification.
In literature and industry, there are several proposals that could solve the problem architecturally, but none have been implemented at scale:
Direct call rights verification at the device level. Every phone would have a local ACL—a list of numbers it’s willing to accept calls from, plus cryptographically signed "permissions" from friends, employers, banks, government services. This is effectively a whitelist by default with caller opt-in. Challenges—migration, privacy, behavior during emergency calls.
End-to-end STIR/SHAKEN signing + mandatory international gateway certification. Requires all VoIP operators worldwide to connect to a unified PKI infrastructure (federated model, like DNSSEC). Technically feasible, politically impossible—because China, Russia, Iran won’t sign on.
Decentralized reputation system based on blockchain or DHT (distributed hash table). Every call generates a "review"—if the subscriber marks the call as spam, the number’s reputation drops, and it starts getting blocked at the network level. Challenges—Sybil attacks, infrastructure.
AI filters at the operator level, trained on phishing scenarios (not general heuristics). Modern LLMs can already detect social engineering patterns in the first 10 seconds of a conversation in real time. Challenges—false positives, computational costs, privacy (who’s listening to the calls?).
Using eSIM identification as a root of trust—every call from an eSIM device is cryptographically tied to the IMSI, and the operator can guarantee the caller is who they claim to be. Challenges—VoIP apps on Wi-Fi, bypass via SIM swapping.
All these solutions are 5–10 years away, if not more. And phone spam is a right now problem. So France’s 2026 law is a compromise: better to ban and lose 50,000 jobs in Morocco than let the phone fraud industry grow another 30% in the next two years.
The bottom line is a story of architectural bankruptcy.
The telephone network, designed by Bell in 1876, assumed that physical wire = identity. When the world migrated from copper pairs to SS7, then to SIP, then to VoIP, then to WebRTC—this invariant didn’t hold. Caller ID in a modern SIP network is a text field set by the caller, with no cryptographic binding. And every subsequent technical "solution" (STIR/SHAKEN, blocklists, AI filters) fights symptoms, not the cause.
France’s 2026 law is the first mass acknowledgment in history that it’s easier to ban the problem than solve it. And that in itself is a landmark precedent. Because if 137 years of technical evolution and 23 years of active regulation (from the U.S. DNC in 2003 to France’s 2026 law) haven’t beaten phone spam, then this is a structural failure of architecture, not regulation. And the only way to get rid of an architectural failure is either to rewrite the protocol (impossible for the global phone network) or admit that for some communications, the telephone is no longer suitable—and move to messengers with end-to-end encryption, device-level identity verification, and crowdsourced reputation.
Which, in fact, is already happening. The share of traditional phone calls in total voice communications in developed countries is dropping by 5–7% annually, and in 2024, WhatsApp + Messenger + Signal surpassed traditional telephony in voice minutes in the UK for the first time. So users are already voting with their feet for an alternative architecture. And old phone networks are turning into a reservation for spam bots and elderly relatives—which might be the most honest outcome for a technology that never learned to tell a friend from a fraudster.
And here’s the kicker: the first documented outrage over phone spam was a letter to Telephony magazine in 1909. The same year the Boston Globe wrote about department store ads. 117 years ago, the problem was exactly the same—only scammers called from real numbers, operators knew them by name, and the only defense was hanging up. Today we have STIR/SHAKEN, AI filters, DNC registries, laws with €375,000 fines per call, deepfake detection in iOS 26, and... people still hang up.
Architecture doesn’t forgive others’ mistakes. And Bell’s mistake was in 1876, when he decided that wire = trust.