Short answer: because a prize draw entry slip is almost never just an entry slip. The "I agree to receive offers from partners" box turns your number into a tradable asset: it travels to dozens of advertisers, each of whom can legally text you from a different short code. The flow does not stop when you block one sender — it stops when you cut off the source and reply STOP to every sender.
Updated 9 November 2026.
The scenario is always the same. A stand in a shopping mall with a car to be won. A "spin the wheel" on an auction site. A form to "win a year of groceries" shared by someone you know. You fill in your surname, first name, postcode, email, mobile — thirty seconds — and you forget about it.
Ten days later, your phone buzzes about a fitted kitchen, a health plan for seniors, a solar panel, a product-box subscription, a "private selection" from fashion brands. None of these messages is a scam in the criminal sense. In a way, it is worse: it is legal, and you are the one who signed up.
Why does a single form trigger so many texts?
Because your number does not stay with the organiser of the draw. It enters a resale chain, and every link in that chain is entitled to text you if the box you ticked mentioned "partners".
In the direct marketing world, these forms are known as data collection operations, or lead generation. The prize draw is not the product: it is the bait. The product is the database of qualified contacts — with, on every line, a first name, a postcode, sometimes an age, a homeowner or tenant status, a vehicle type.
Three mechanisms explain the volume you are seeing:
- The "partners" clause. A single ticked box can cover a list of partners set out… in a link at the bottom of the page, sometimes several hundred companies long.
- Cascading resale. A data broker buys the database and resells it to other brokers, who rent it out to advertisers. Every buyer considers itself legitimate.
- Sector profiling. Did you say you own a house? You will get photovoltaics, insulation, heat pumps. Did you tick an older age bracket? Health cover and personal alarm services.
A French mobile number has no public price, but it does have a value: an "opt-in" contact with targeting criteria is rented out or sold several times over, and every rental can generate a text.
Is it legal to send these marketing texts?
Yes, on one strict condition: your prior consent. In France, SMS marketing falls under Article L. 34-5 of the Code des postes et des communications électroniques (French Postal and Electronic Communications Code), which requires express prior consent for advertising messages sent to a mobile.
The CNIL says so unambiguously in its guidance on commercial prospecting: for text messages, it is opt-in that applies (unlike postal mail, for example). Consent must be:
- freely given — entry to the draw cannot be made conditional on accepting the advertising;
- specific — it must relate to an identified purpose;
- informed — you must know who is going to contact you;
- unambiguous — a box that is not pre-ticked, never a box you have to untick instead.
It is precisely on points 2 and 3 that most of these operations are shaky. A single box standing as consent for "our partners", with no list accessible at the moment you click, is regularly criticised by the CNIL. You can read the authority's position on commercial prospecting and on the right to object.
Another obligation advertisers often forget: every marketing text must include a simple, free way to unsubscribe. In practice, the wording « STOP au 36xxx » ("STOP to 36xxx") or « STOP SMS au 36xxx » ("STOP SMS to 36xxx"). Its absence is, in itself, a breach.
For the details of the French framework, the site has a page dedicated to the rules on SMS marketing and the GDPR.
How can you tell who is texting you from a short code?
Look at the sender: most of these messages come from a five-digit short code starting with 36 or 38. That format is reserved for business sending and it is allocated, so it is traceable.
A short code is not anonymous: it is assigned to an SMS operator (an aggregator) on behalf of an advertiser. That is the major difference from an unknown mobile number or a sender name in letters, which is far easier to spoof — a subject covered in detail in our article on texts signed with a brand name.
| Sender displayed | Who is behind it | Free? | STOP reply |
|---|---|---|---|
| 36xxx / 38xxx | Advertiser via an SMS aggregator | Free to receive | Yes, mandatory |
| 2xxxx | Services, alerts, marketing | Free to receive | Generally yes |
| 6xxxx | Operators, usage tracking | Free to receive | Depends on the service |
| Name in letters (11 char. max) | Declared by the sender | Free to receive | Often no reply channel |
| Unknown 06/07 | Private individual, or low-cost bulk sending | Free to receive | Unreliable |
To understand the number ranges, how they are allocated and the question of premium charges, the site maintains a reference page on SMS short codes in France, plus an article devoted to texts from 38xxx numbers.
One point that reassures many readers: receiving a marketing text costs you nothing. In mainland France, incoming messages are not billed to the recipient. The risk is not on your bill — it is on your attention, and on the confusion with genuine scams.
What can you actually do to shut off the flow?
The right method is not to block numbers one by one: it is to deal with the source and each sender separately. Here is the order that works.
1. Reply STOP to every short code, without exception
Reply STOP (or the exact wording given in the message, such as "STOP SMS") to each of the short codes texting you. It is free, and it is a legal obligation for the advertiser. Do not be discouraged if you have to do it ten times: each STOP cuts off one advertiser, not the whole database.
Two important nuances, developed in our guide on replying STOP:
- STOP acts on the sender of the message, not on the companies that bought the same database;
- never reply STOP to a text that looks like a scam (payment link, threat, fake parcel): there, replying only confirms that your number is active.
2. Exercise your right to object with the source
This is the step almost nobody takes, and it is the one with the greatest effect. Identify the original prize draw (search your emails for the entry confirmation), find the data controller in its legal notices or privacy policy, and send a written request:
Subject: right to object and right to erasure (Art. 17 and 21 GDPR) I object to any processing of my data for commercial prospecting purposes, including its transfer to third parties, and request the erasure of my data. Please provide me with the list of recipients to whom my number has been transferred (Art. 15 GDPR).
That last sentence is the key: the right of access lets you ask who your data has been disclosed to. The controller has one month to respond. If it does not, you can file a complaint online with the CNIL.
3. Report anything out of line to 33700
33700 is the official reporting platform for unwanted texts and calls, run by the operators under the authority of Arcep. Forward the message to 33700, then send the sender's number in a second text when prompted.
33700 is not just for scams: it also handles abusive prospecting — in particular messages without STOP wording, or that keep coming after a STOP. The site sets out how a report is handled on its unwanted texts and 33700 page and in the article "what happens to your report?".
4. Do not confuse this with Bloctel
Bloctel is the public opt-out scheme for telephone cold calling — calls. It does not cover SMS marketing. Registering with Bloctel is useful, but it will not cut a single advertising message from your mobile. This is a very widespread misunderstanding.
How do you spot a prize draw that only exists to harvest your number?
A few signals are unmistakable. You can spot them in twenty seconds, before you type in your number.
- The prize is wildly out of proportion to the effort asked of you ("a car", "€10,000 of groceries") and the organiser is an unknown company, not the brand behind the prize.
- The mobile field is mandatory when an email would be enough to notify a winner.
- A single box covers both the organiser and "its partners", and the list of those partners is only reachable through an inconspicuous link — or not at all.
- The rules of the draw are nowhere to be found, or mention no draw date.
- The questions are profiling: do you own your home? do you have a gas boiler? how old are you? None of them has anything to do with a prize draw.
- The form chains together offer screens after you submit ("just one more question to confirm"). Each screen is a separate consent.
The most effective countermeasure is still to compartmentalise. Many readers keep a second line — a prepaid eSIM, or a no-contract prepaid SIM card — reserved for forms, deliveries and commercial sign-ups, and only give their main line to family, their bank and their doctor. The method is set out in detail in our article on the second number that dries up unwanted texts.
Why does the advertising flow also increase your scam risk?
Because it gets you used to receiving approaches from legitimate strangers. That is exactly the environment in which a fraudulent text goes unnoticed.
A phone that receives three commercial messages a day loses its alarm reflex. The fake parcel text, the fake bank card update or the fake refund slip into an already saturated thread. And if your number is circulating in databases resold several times over, statistically it ends up on lists used by players who are anything but legal — a phenomenon documented by cybermalveillance.gouv.fr on smishing.
Two markers for sorting quickly:
| Clue | Legal advertising | Scam |
|---|---|---|
| STOP wording | Present | Absent |
| Sender | Allocated short code | 06/07, foreign number, spoofed name |
| Request | Click through to a retail site | Bank details, credentials, "the code you received" |
| Urgency | Dated promotion | Threat, 24-hour deadline, fine |
If the message asks for a verification code, a card number or a login, it is no longer prospecting: see our article on texts demanding a code you have received.
Should you change your number?
Rarely, and it is the last resort. Changing your mobile line breaks your two-factor authentication, your contacts and your service messages, for a temporary benefit: a brand-new number ends up in the databases from the very first commercial sign-up.
Before going that far, three moves cover the essentials:
- A month of STOP discipline on every short code that texts you. The volume drops sharply once the main senders are cut off.
- A filter on the phone itself for unknown senders. iOS and Android both offer automatic sorting of messages from unsaved senders; see what that really stops in blocking a text sender.
- Form hygiene: a dedicated email address for sign-ups, and your mobile reserved for the cases that genuinely require it.
For readers managing a business line, a security notebook or a paper filing binder is still useful for keeping a record of the objection requests you have sent and the replies received: if you complain to the CNIL, that file is what makes the difference. And if your phone is overloaded, a wireless induction charger on your desk at least stops the battery draining from constantly checking marketing messages.
Key takeaways
- A barrage of marketing texts after a prize draw comes from a database resale, not a hack.
- SMS marketing requires prior consent (Art. L. 34-5 CPCE) and free STOP wording.
- STOP cuts off one sender at a time; the right to object and right of access (GDPR, Art. 15, 17, 21) with the organiser cuts off the source.
- 33700 also handles abusive prospecting, not just scams. Bloctel only covers calls.
- A second number for forms is the most durable protection.
Frequently asked questions
I replied STOP and I am still getting texts: is that normal? Yes, if the messages come from different short codes: your STOP only binds the sender you sent it to. If it is the same short code still texting you after a few days, that is a breach: report it to 33700.
Does replying STOP cost anything? No. Sending a STOP to an unsubscribe short code is free, and it is deducted from your plan like an ordinary text, with no premium charge.
How can I find out which prize draw sold my number? Search your emails for entry confirmations from the past six months, then exercise your right of access (Art. 15 GDPR) with each organiser, asking for the list of recipients of your data.
Does 33700 remove my number from advertising databases? No. 33700 identifies and penalises abusive senders through the operators, but it is not meant to erase your data at an advertiser: only the right to object, exercised with the data controller, does that.
Can a marketing text be premium-rated on receipt? Not in standard prospecting: receiving a text is not billed in mainland France. Premium charges apply to SMS+ services you have subscribed to, a case covered in our article on premium-rate texts on your bill.
