GDPR and B2B Prospecting: What's Allowed (and Forbidden) in France

Is B2B cold email legal in France?

Yes. It is the question that holds back most small-business owners before they write to a stranger. The answer fits in one sentence from the CNIL, the French data protection authority: « La prospection à l’égard de professionnels peut être fondée sur l’intérêt légitime de l’organisme », meaning prospecting professionals can rest on the sender’s legitimate interest (the CNIL’s page on email prospecting).

To a private individual, you need prior consent, unless they are already your customer and you offer them similar products. To a professional, at their work address, you can write without prior consent, under three conditions the CNIL lists on the same page:

• the subject of the message relates to the person’s profession;
• the person has been informed that their address may be used;
• they are able to object.

The legal basis: legitimate interest

Article 6(1)(f) of the GDPR allows processing personal data when it is necessary for the legitimate interest of whoever processes it, unless the person’s rights override it (GDPR article 6, on the CNIL’s site).

Example: offering payroll software to the HR director of a 40-person company concerns their profession. Offering holiday packages to the same person, at their work address, does not.

The rules, one by one

1. Know which address you are targeting

A named address, such as firstname.lastname@company.fr, is personal data: GDPR applies. According to the CNIL, generic addresses such as contact@ or info@, which designate a legal entity, are not subject to the consent and information rules above.

One rule applies to all of them: article L34-5 of the French Postal and Electronic Communications Code forbids sending a prospecting message without valid contact details for asking the messages to stop, and forbids hiding the sender’s identity (article L34-5 on Légifrance).

2. Offer something related to their profession

This is the condition most often overlooked. Your message must speak to the person’s job: an HR tool to the HR director, an accounting service to the finance director. An offer unrelated to their profession falls outside legitimate interest.

3. Inform the recipient (article 14)

When you did not get their details from the person themselves, GDPR article 14 requires you to inform them. Article 14 sets the deadline: within one month of obtaining their details, and in your first message if you write before then (GDPR article 14, on the CNIL’s site).

In practice, a few lines in the first email: who you are, where their details came from, why you are writing, and, on a line of its own, how to refuse further messages. Add a link to your privacy policy, which gives the rest Article 14 requires: retention period, the person’s rights, the right to complain to the CNIL.

4. Respect the right to object (article 21)

GDPR article 21 lets anyone object to prospecting at any time. Once they have objected, their data can no longer be used to prospect them (GDPR article 21, on the CNIL’s site).

The means must be simple: a “STOP” reply, a link that works. And the objection must apply everywhere, across all your sending.

What is forbidden

• Hiding your identity, or writing a subject line unrelated to your offer (article L34-5).
• Contacting again someone who has objected (article 21).
• Keeping a prospect’s data forever: the CNIL recommends keeping it at most three years from collection or from the prospect’s last contact, such as a click on a link in an email (the CNIL’s Q&A on commercial management). At the end of that period, you may ask whether they want to keep receiving your messages. Without a positive and explicit answer, you delete or archive their data.
• Collecting contact details whose visibility the person limited, for example to their LinkedIn connections: this is what the CNIL fined in 2024 (below).

What the CNIL fines

On 5 December 2024, the CNIL fined the company KASPR 240,000 euros. KASPR sells an extension that gives the contact details of the people whose LinkedIn profile you view (the CNIL’s article on this fine). The CNIL found four breaches:

• collecting the details of people who had limited their visibility on LinkedIn, which in its view went beyond what they could reasonably expect;
• a five-year retention period, renewed at every data update;
• informing people only four years after the extension launched, and in English;
• answers to access requests limited to “publicly accessible sources”, when the company knew some of its sources.

The CNIL gave it until 18 June 2025 to comply.

The decision targets a data provider. The obligations at stake apply to every data controller, so to you: say where the data comes from (article 15), do not keep it too long (article 5), inform people in a language they understand (articles 12 and 14).

Key takeaways

In practice with FindMyLead

You are the sender. You are responsible for your campaigns: you tell each recipient where their details came from in your first email, sent within a month of adding them to a list. FindMyLead adds no text to your emails. Name the exact source, for example: “I found your professional details with FindMyLead, a professional-profile search tool”.

A “STOP” reply unsubscribes the person at once, and FindMyLead excludes them from all later sending. Every email also carries an unsubscribe header that mail apps recognise.

FindMyLead shows people only in their professional capacity: job, company, LinkedIn profile, work email. Anyone who asks on the opt-out page disappears from search results. Our servers and database are hosted in France; email sending and AI writing go through US-based providers under standard contractual clauses (our privacy policy).

To find these people and their email, read our guide to finding a company’s director, HR or finance director.

What each plan includes is on the FindMyLead pricing page.

Frequently asked questions

Do I need a professional’s consent to send them a prospecting email?

No, if you write to their work address and your offer concerns their profession. You must tell them where their details came from and let them refuse further messages.

What should the first prospecting email contain?

Your identity, where the recipient’s details came from, the reason for your message, a simple way to refuse further messages set apart from the rest, such as replying “STOP”, and a link to your privacy policy for the rest of the information.

How long can I keep a prospect’s data?

The CNIL recommends three years at most, from collection or the prospect’s last contact. After that, without a positive and explicit answer from them, delete or archive their data.

Can I write to contact@ or info@?

Yes. According to the CNIL, these generic addresses are not subject to the same principles. Your message must still say who you are and how to ask for the messages to stop.

This article is for information only and is not legal advice. For a question specific to your situation, consult the CNIL’s website directly or a legal professional.