Introduction: twenty euros, and an opinion on record for ten years
A Sunday in November. You come across a fundraising campaign for a charity fighting a rare disease. You give twenty euros online. Three clicks, a bank card, a postal address for the tax receipt. Done — you move on to something else.
Except you haven't. That donation has just created a row in a database that now contains: your full name, your postal address, your email, sometimes your date of birth, the amount given, the date, the channel used, the cause supported. And above all, by inference: a marked interest in a specific condition — yours, that of someone close to you, or an activist leaning. Six weeks later, you receive two letters from charities you have never given a cent to, on oddly adjacent themes.
There's nothing illegal here either, provided everything was disclosed and — for certain uses — consented to. The problem is that donation data is among the most revealing data there is. It doesn't say what you buy: it says what you believe in. This guide explains what gets collected, what circulates, what the law actually requires, and how to keep supporting causes without becoming a sales prospect for the next fifteen years.
Why a donation says more about you than a shopping basket
The cause as a declaration of identity
A purchase history reveals habits. A donation history reveals convictions. The General Data Protection Regulation (GDPR) in fact classifies as special categories of data — those given reinforced protection under Article 9 — information revealing political opinions, religious or philosophical beliefs, trade union membership, as well as health data.
And a single donation often makes it possible to infer one of these:
| What you support | What can be inferred |
|---|---|
| Charity fighting a disease | A condition in your circle, possibly your own |
| Religious organisation or diocese | Religious belief |
| Migrant support charity, NGO | Political leaning |
| Trade union, party, political foundation | Declared commitment |
| Charity supporting single-parent families | Family situation |
| Veterans' or ex-servicemen's association | Personal background, age |
The CNIL regularly points out that associations with political, religious, philosophical or trade union aims process, by their very nature, sensitive data about their members and donors. This doesn't prohibit the processing — it is permitted, notably for members and people in regular contact with the organisation — but it strictly frames what can be done with it, and above all what cannot: passing it on to third parties without explicit consent.
A donation is never "anonymous" by default
Many donors assume a small amount slips under the radar. The opposite is true: the small, regular giver is the raw material of the sector. Large fundraising organisations think in terms of donor lifetime value, an indicator borrowed from mainstream marketing. A 20-euro donor who gives twice a year for eight years is worth more, in a database, than a one-off 200-euro donor — because they are predictable, reactivatable and transferable.
What the law actually requires (and what it doesn't)
The tax receipt: named out of necessity
If you want the tax break — 66% of the donation amount in the general case, 75% up to a certain ceiling for organisations helping people in difficulty, under Article 200 of the French General Tax Code — you need a tax receipt. And a tax receipt is necessarily in your name: it carries your name, your address, the amount and the date. The charity must keep it and make it available to the tax authorities.
The direct consequence: you cannot have both the tax receipt and complete anonymity. It's a trade-off, not a trap. It's up to you to decide, donation by donation, whether the tax advantage is worth being added to a file.
A 20-euro donation saves you around 13 euros in tax. A 500-euro donation, around 330 euros. On small amounts, anonymity costs little; on large ones, the question deserves to be framed differently.
The 153,000-euro threshold and hand-to-hand gifts
Two tax rules are worth knowing. First, since the 2021 law reinforcing respect for the principles of the Republic, organisations receiving donations must declare annually to the tax authorities the overall amount of donations giving entitlement to a tax receipt, along with the number of receipts issued — an aggregated declaration, not a named one. Second, associations whose resources exceed certain thresholds are subject to obligations to publish their accounts; here again, this concerns financial totals, not lists of names.
In other words: the State does not receive a list of your donations, charity by charity. It is your own tax return — the donations box — that carries the total amount, with no breakdown by beneficiary. That said, the authorities can request the receipts in the event of an audit.
What is never mandatory
- Your phone number. No legal text requires it for a donation. Yet it is the field most systematically made mandatory in online forms — because it opens the door to telemarketing.
- Your date of birth. Useful for marketing segmentation, useless for the tax receipt.
- Creating an account. A one-off donation doesn't require a personal user area.
- Agreeing to communications. Ticking "I'd like to receive news" has never been a condition of donating.
The discreet big market in donor files
Swapping, renting and "co-registration"
This is the least known part of the sector. Historically, large fundraising charities have practised file swapping: I lend you 50,000 names from my donors, you lend me yours, and each prospects the other's file by post. Specialist list brokers act as intermediaries in these operations, with rates measured in fractions of a cent per address.
Since the GDPR, the practice has been tightly regulated. Passing donor data to a third party for prospecting purposes requires clear information and, for sensitive data, explicit consent. The CNIL has repeatedly stated that a box reading "we may pass your details on to partner organisations", pre-ticked or buried at the bottom of a form, does not constitute valid consent.
In practice, swapping has declined markedly but has not disappeared, notably in more subtle forms: campaign partnerships, joint appeals, pooled street fundraising, and online giving platforms that reserve a communication right of their own.
The tell-tale sign
You gave once to charity A. Six months later, charity B — never contacted — writes to you by name at your exact address, with your name spelled correctly, on a related theme. Two possible explanations: your record has circulated, or you appear in a prospecting file bought from a broker who identified you by cross-referencing.
There is a counter-measure, and it's as old as direct marketing: address tagging. Add a harmless variation to your name or address with each donation — "Flat B", a middle name, an initial — and note it down. When a letter arrives with the variant you used with A but is sent by B, you have proof of circulation. A simple alphabetical address book is enough to keep this register, and it does the same job for subscriptions and other sign-ups.
Concrete leak points, channel by channel
Online giving
This is the most traceable route. Besides the data you enter, the donation page often carries advertising trackers: social network pixels, measurement tools, sometimes "retargeting" solutions that later serve you ads for the same cause. A health charity's donation page that fires an advertising pixel is, in effect, transmitting a signal about a health-related interest to a third-party ad network.
Useful steps:
- Refuse non-essential cookies before filling in the form.
- Use a compartmentalised browser for donations, or a private window with tracker blocking.
- Fill in only the fields marked mandatory with an asterisk — and if the phone number is forced on you, ask yourself why.
- Check that there is a dated privacy policy, with contact details for a data protection officer.
Direct debit
Regular giving by SEPA direct debit is charities' preferred format, because it stabilises their income. It involves a signed mandate, an IBAN, and a long-term relationship. Nothing scandalous — but be aware that you can revoke a SEPA mandate at any time through your bank, and that an unauthorised debit can be challenged for thirteen months (eight weeks without justification, thirteen months where no valid mandate exists). Keep the signed mandate: a portable document scanner or simply an archived photo is enough to preserve the useful evidence in the event of a dispute.
Street fundraising and door-to-door
The recruiter who approaches you on the pavement — the job is known as "street fundraising" — has a numerical target in signed direct debit mandates. The tablet they hand you captures name, address, phone, email, IBAN, date of birth. It's the most complete data collection in the sector, obtained in three minutes, often standing up, without any real reading of the privacy notice.
If you want to support the cause, nothing obliges you to sign on the spot: note the charity's name and give from home, calmly, on your own terms.
Cheques and cash
A cheque carries your name, your bank and your signature — it is traceable, but it doesn't circulate through an automated marketing system. Cash, on the other hand, remains the only genuinely anonymous way of giving: collection plate, donation box, envelope dropped off. Without a tax receipt, obviously.
Taking back control: a five-step procedure
1. Take stock
List the charities you give to or have given to, and those that write to you although you have never given them anything. The second column is the most instructive. Set up a dedicated expanding cardboard folder and keep the letters in it: they make up your evidence file.
2. Exercise your right of access
The GDPR (Article 15) gives you the right to a copy of the data held about you, as well as information about the recipients or categories of recipients to whom it has been disclosed. It's that last phrase that matters: ask for it explicitly. The organisation has one month to reply.
A minimal template, by email to the data protection officer or by registered post:
Subject: request for access to my personal data (Article 15 GDPR)
Dear Sir or Madam, I request that you provide me with all the personal data you hold concerning me, the purposes of its processing, its retention period, and the list of recipients to whom it has been disclosed, including in the context of file swaps or rentals. Please find enclosed a copy of proof of identity.
3. Object to prospecting
The right to object to direct marketing (Article 21 GDPR) is absolute: it doesn't have to be justified, and the organisation must comply without delay. Make the request separately from the access request, in writing, and specify: "all channels — post, telephone, email, SMS". Also ask for your details to be withdrawn from any file passed to third parties.
4. Cut off the channels at source
- Paper mail: the Stop Publicité / "Stop Pub" scheme only blocks unaddressed printed matter. For mail addressed to you by name, you need the Robinson list run by the Union française du marketing direct et digital, which registers people refusing addressed postal marketing.
- Telephone: free registration with Bloctel, the French national opt-out service for cold calling.
- Email: a working unsubscribe link is mandatory; if it doesn't work, that's a breach you can report.
For the paper that piles up, a cross-cut shredder prevents a letter bearing your name from ending up legible in a communal bin — a detail that matters more than people think in a block of flats.
5. Refer the matter to the CNIL if nothing happens
If there's no reply after a month, or in the event of a refusal, filing an online complaint with the CNIL takes ten minutes. Attach your letters, the replies received, and details of your address tagging if you have any. Failures to respect the right to object are among the most frequent grounds for complaint handled by the authority.
Giving differently: strategies that work
Compartmentalise your generosity
Nothing obliges you to give under the same contact identity everywhere. A dedicated donations email address, separate from your main address, contains the noise and lets you gauge at a glance how much commercial pressure an organisation applies. Likewise, a secondary number — or no number at all — limits telemarketing.
One-off donations rather than direct debits
Direct debit creates a permanent relationship and a stable banking identifier. A one-off donation, renewed at your own initiative once or twice a year, leaves you in control of the timing and the amount. The cause receives the same sum; you keep the upper hand.
Give in kind, give your time
Volunteering, donating equipment, food donations, local collections: all are forms of support that don't go through a fundraising database. Be careful, though, with volunteering itself, which often involves registration, an internal photo directory, and sometimes photos published on the charity's social media. Ask the question beforehand, not afterwards.
Go through an intermediary
Some structures allow you to give without the final beneficiary knowing your identity: umbrella foundations, donations via a notary, bequests. It's cumbersome for twenty euros, relevant for significant amounts or sensitive causes.
Contact the charity without revealing yourself
Want to report a questionable practice, ask an awkward question about how funds are used, or request removal from a file without giving them any further hold over you? A one-off channel unconnected to your main identity — a message sent from an SMS service that requires no sign-up, for instance — lets you open the conversation before deciding whether you want to identify yourself.
Summary
| Objective | Concrete step |
|---|---|
| Give without leaving a trace | Cash, donation box, collection plate — no tax receipt |
| Keep the tax advantage | Receipt required: accept being filed, limit the channels |
| Detect your data circulating | Address tagging, written register |
| Find out who holds your data | GDPR access request, Article 15, mention of recipients |
| Stop follow-up requests | Written objection across all channels + Bloctel + Robinson list |
| Reduce exposure at source | Dedicated email, no phone number, one-off gifts rather than direct debits |
| Enforce your rights | Online complaint to the CNIL after a month without a reply |
Conclusion: generosity doesn't have to be a public declaration
Supporting a cause is a private act. Nothing in French law requires it to become a permanent row in a commercial database, or to generate fifteen solicitations a year for a decade. The charity sector lives on fundraising and that's legitimate — but raising funds and harvesting data are two different things, and you have the right to separate the two.
The essential point fits in one sentence: decide in advance what you agree to give, money on one side, data on the other. These are two distinct donations, and only the first is the one you meant to make.
To go further, the CNIL's practical guidance sheets on associations and direct marketing, the text of the GDPR (Articles 9, 15 and 21) and Article 200 of the French General Tax Code are the reference sources — all freely available online.
