Introduction: ten digits that amount to a civil record
Count them up. Over the past year, how many organisations have you given your mobile number to? The bank, the health insurer, the garage, two delivery platforms, the customer service line of an appliance manufacturer, the supermarket loyalty card, a restaurant booking form, a gym sign-up, the ticketing website, the second-hand seller of a piece of furniture you picked up one Saturday, the physiotherapist, the school, the home insurance policy, the computer repair service.
In most of those cases, the number wasn't necessary. It was just sitting there in the mandatory field.
The problem isn't that the number "gets around". The problem is that, with no law and no debate, it has become the de facto unique identifier of the French population. It almost never changes — number portability, mandatory since 2007, removed the one reason people used to have for switching numbers. It's unique, it's short, it's easy to remember, it's requested everywhere, and it's verifiable: a confirmation text proves you really are the holder. No other attribute combines all these properties. Not an email address, which people create by the dozen. Not a postal address, which changes on average every seven years. Not a name, which is ambiguous.
The result: your number is the column along which two databases are glued back together. It's a pivot. And in the world of data, a pivot is what turns anonymous fragments into a named file.
This guide explains how we got here, what a third party can genuinely extract from ten digits, and above all how to stop handing them out without having to live as a hermit.
Part 1 — Why the phone number became an identification pivot
The drift from contact to authentication
Originally, a phone number existed so you could be called. Today it serves three distinct purposes that are constantly conflated:
| Function | Example | Do they need your real number? |
|---|---|---|
| Reachability | The delivery driver lets you know he's downstairs | No, a relay number is enough |
| Authentication | A 6-digit code to approve a payment | Yes, but a dedicated number works fine |
| Identification / matching | The platform links your account to your in-store purchases | No, never necessary for you |
The third function is the one nobody tells you about. It is, however, the most lucrative. When a physical retailer and an app recognise you as the same person, it is almost always thanks to the phone number.
The "hashing" that protects nothing
You'll often read that a number is "transmitted in hashed form", and therefore anonymous. In this particular case that's false, and the CNIL has said so repeatedly in its positions on pseudonymised identifiers.
A French mobile number fits into a space of roughly 100 million combinations (the 06 and 07 ranges). An ordinary computer can calculate the hashes for that entire space in a few minutes. In other words: hashing a phone number doesn't hide it, it translates it. The hash remains a perfectly reversible identifier, and therefore personal data under the GDPR.
This is exactly the mechanism that allows ad networks to recognise a customer from an "anonymised" file supplied by a retailer.
What a bare phone number already gives away
With ten digits and nothing else, a motivated third party often obtains:
- The carrier and line type (mobile, landline, VoIP) — public information available through portability databases.
- Your name and sometimes your address, if you're listed in a directory or if the number once appeared in a classified ad, on a forum, or in an online CV.
- Your profile picture and first name on messaging apps that display them to anyone holding the number.
- Confirmation that an account exists on dozens of services: the "forgot your password" page inadvertently reveals whether the number is registered.
- Associated breaches: compromised databases are indexed and searchable by phone number. In 2024, several massive French leaks in health insurance and retail exposed millions of records containing names, dates of birth and phone numbers.
The number is therefore an entry point. Not an isolated piece of information.
Part 2 — The four channels through which it escapes
1. Directories and the misunderstood "ex-directory" listing
Many French people believe that going ex-directory protects them from everything. It does exactly one thing: it prevents publication in universal directories and the directory enquiries service. It is free and a legal right with your carrier — the French Postal and Electronic Communications Code entitles you to it.
What it does not do:
- It doesn't erase the private reverse directories that have already scraped the number.
- It doesn't stop cold calling based on files bought elsewhere.
- It has no effect on the databases of companies you gave the number to yourself.
2. Cold calling and the resale of files
Bloctel exists and has been strengthened: since the 2020 law and the October 2022 decree, telephone cold calling is banned at weekends, on public holidays, and on weekdays outside the 10am–1pm / 2pm–8pm windows. Since 2026, the rules have tightened further, with prior consent now required in several sectors, notably energy-efficiency renovation and personal training accounts.
That cuts down on the noise. It does not remove the market value of your number. A file of qualified prospects — number + postcode + age bracket + area of interest — is still very much a tradeable asset.
3. The holes you dig yourself
The number mostly leaks through channels nobody monitors:
- The online ad where you typed it out in plain text in the body, bypassing the platform's internal messaging.
- The automatic signature on your emails, sent out to mailing lists.
- The PDF document (CV, quote, invoice) published somewhere and indexed.
- A friend's address book, synced with an app that asks for contact access: your number leaves even though you never installed the app.
That last point is structural. You have no control over how discreet your contacts are.
4. Line theft: SIM swapping
This is the costliest scenario. An attacker gathers enough information about you to convince the carrier to port your number to a SIM card they control. They then receive your verification codes, and with them your bank accounts and your email.
ANSSI and French banks have recommended for several years that SMS should no longer be relied on as the sole second factor. The remedy exists and it's cheap: a FIDO2 security key plugged into USB or tapped via NFC replaces the SMS code with hardware-based proof that cannot be intercepted remotely. It's the only setup that makes number theft harmless for your critical accounts.
Part 3 — The three-number strategy
The mistake is to look for "one" protected number. The right approach is to segment, exactly as you would with several email addresses.
Number 1 — The private number
The one your family, close friends and GP know. Absolute rule: it is never entered into a form. Not for a delivery, not for a loyalty card, not for a booking. This number does not exist online.
Number 2 — The administrative and banking number
The one that receives the authentication codes that matter: bank, tax office, health insurance, carrier. It's given out sparingly, only to organisations you have chosen, and it is never used as a way for a retailer to reach you.
Number 3 — The disposable or secondary number
This is the one that absorbs everything else: delivery platforms, classified ads, sign-ups, free trials, one-off tradespeople, after-sales service. Three options in France:
| Solution | Cost | Limitations |
|---|---|---|
| Prepaid line from a second carrier | a few euros a month | identification mandatory at purchase since 2016; no complete anonymity |
| Software-based second number offered by some carriers and apps | €1 to €5/month | depends on an existing account |
| Anonymous text sending, with no number exposed | one-off | for sending, not receiving |
One technical point that matters: to run two lines without carrying two devices, check whether your phone supports eSIM or has a second physical slot. Otherwise, an entry-level dual-SIM phone works perfectly well as a "public" line, and you avoid mixing uses on the same device.
Beware of "free virtual number" apps downloaded at random. Many make their money reselling call metadata, or host messages on servers outside the EU with no legal basis. You're trading one form of protection for another leak. Prefer a paid offer from an identifiable carrier, with a readable privacy policy.
The case of one-way messaging
There are situations where you need to say something without leaving any way to be called back: reporting a problem anonymously, warning a loved one from a sensitive context, answering an ad without exposing yourself, alerting a neighbour. That is precisely the use case for sending a text without disclosing your number: the message goes out, the recipient reads it, and your personal line appears nowhere. The trade-off is clear and you have to accept it: you won't get a direct reply.
Part 4 — The clean-up: reclaiming what has already gone
Step 1: map it out
Search for your own number. In a search engine, in quotation marks, in several formats: 0612345678, 06 12 34 56 78, +33612345678. The results will tell you what is publicly indexed. Do the same on the major classified-ad platforms and, if you have any, on your old professional profiles.
Step 2: exercise the right to erasure
The GDPR, through its Article 17, gives you a right to erasure. For a phone number, the request is simple and fits in four lines:
Subject: request for erasure of personal data (Article 17 GDPR)
Dear Sir or Madam, I request the erasure of the phone number 06 XX XX XX XX associated with my account / file, as well as its removal from any prospecting file. I also request the list of recipients to whom it has been disclosed, pursuant to Article 15(3) GDPR. The data controller has one month in which to respond.
Citing Article 15(3) is the most useful lever: it tells you who your number has been passed on to, and therefore who to write to next. If there's no reply after a month, filing an online complaint with the CNIL is free and takes ten minutes.
Step 3: lock down what's left
- Move your critical accounts to an authenticator app or a physical key rather than SMS.
- In your messaging app settings, disable discovery by phone number and restrict profile picture visibility to contacts only.
- Refuse address book access to apps that have no functional need for it.
- Ask your carrier to add a password or protection code to your customer file, to block a fraudulent porting request.
- In classified ads, never publish the number in plain text, including disguised as "zero six".
Part 5 — Real-world situations
"The till is asking for my number for the loyalty card"
A phone number isn't necessary for a loyalty card. It's there to cross-reference your purchases with your advertising profile. Refuse, or give number 3. The programme works without it.
"The form won't submit without a number"
A mandatory field doesn't mean a legal obligation. The principle of minimisation (Article 5(1)(c) GDPR) prohibits collecting data that isn't necessary for the stated purpose. For a newsletter or a brochure download, a phone number is never necessary. Give number 3, or write to the site's data protection officer.
"A delivery driver, a tradesperson, a buyer needs to reach me"
Use the platform's internal messaging where it exists, otherwise number 3. For a home visit, bear in mind that the number will be stored in a shared job-management system, often hosted by a third party.
"I need to message someone without them being able to call me back"
That's the use case for anonymous texts. A report, a message to a neighbour, a sensitive piece of information: the content gets through, the sender remains unidentifiable to the recipient. Never to be used for harassment or threats — technical anonymity is not legal impunity, and judicial requests do get results.
"I'm switching carrier or moving country"
Moving abroad is one of the rare opportunities to start from scratch. Take advantage of it to set up a new private number and let the old one die, updating only your critical accounts.
Going further without becoming paranoid
The single most profitable habit fits in one sentence: before you type ten digits, ask yourself who will call, and why. In 70% of cases, nobody will ever call. The field exists to enrich a database.
For those who want to approach this methodically, two useful supports: the CNIL's practical fact sheets, free and regularly updated, and a reference guide on digital hygiene — the kind of book on personal data protection that lays out the principles once and for all, rather than chasing every individual setting. Some people add a paper password notebook, stored out of reach: hardly elegant, but far safer than a file called "codes" on the desktop.
And if you want to keep a record of your GDPR requests, a simple archive binder holding copies of your letters and the delivery receipts will come in handy the day you have to show the CNIL that you did indeed write a month earlier.
The five-minute dashboard
| Action | Frequency | Effect |
|---|---|---|
| Search for your number on the web | twice a year | detects public leaks |
| Check your ex-directory status with your carrier | when opening a line | removes you from directories |
| Add a protection code to your carrier account | once | blocks SIM swapping |
| Move your second factor from SMS to a key or an app | once | neutralises line theft |
| Use number 3 for every commercial form | ongoing | cuts off the advertising pivot |
Conclusion: the only identifier you hand out yourself
It took the French state forty years to regulate the use of the social security number, precisely because a unique, universal identifier makes it possible to link everything together. Meanwhile, we handed the same power to a mobile number, with no law, no register, no oversight, simply because it was convenient.
The good news is that this pivot is the only one you still control at source. Nobody is forcing you to write it down. Three numbers, one rule per number, and the whole cross-referencing machine grinds to a halt — without changing a single one of your habits.
