Is B2B Cold Emailing Legal in France? GDPR and CNIL Rules

The short answer: B2B and B2C follow different rules

French law on electronic prospecting (article L34-5 of the Postal and Electronic Communications Code, which implements the EU ePrivacy Directive) sets prior consent as the principle for sending marketing emails to individuals as consumers. The CNIL explains that prospecting professionals works differently: it can be based on the sender's legitimate interest under GDPR, as long as the recipient can object.

In practice, the CNIL lists three conditions for B2B email prospecting without prior consent: the message must relate to the professional activity of the person contacted, the person must be informed of how their data is used, and they must be able to object simply to receiving further messages. Its example: presenting the merits of software to a company's IT director. An offer unrelated to the person's job falls under the consumer rules instead.

• Prospecting a consumer by email: prior consent, except for similar products offered to existing customers.
• Prospecting a professional about their job: no prior consent, but information and a simple opt-out.
• Prospecting a professional about something unrelated to their job: treated like consumer prospecting.

Generic vs named addresses

The CNIL distinguishes two kinds of professional addresses. Generic addresses such as info@company.fr, contact@company.fr or orders@company.fr are contact details of a legal entity, not of a person. The CNIL states that they are not subject to the principles above, so the personal-data conditions do not apply to them in the same way.

A named address such as firstname.lastname@company.fr, or the address of a sole trader, identifies a person, so it is personal data under GDPR. Everything in the previous section applies: relevance to their job, information, easy opt-out.

Even with a generic address, other obligations remain. Every marketing email must identify the sender and give a way to stop receiving messages. Treating every address as if it were named is the simplest habit, and it costs you nothing.

What to include in every prospecting email

Most compliance problems come from what is missing in the message, not from the fact of writing to a stranger. A compliant B2B email is also a more trustworthy one.

• Your real identity: name, company, and a way to contact you. No anonymous or misleading sender.
• Why you are writing to this person: a reason linked to their job or business.
• Where you got their details, for example their company's website or a public business listing.
• A simple, free opt-out: a link or “reply STOP and I will not write again”, and you honour it.
• A link to your privacy notice or a short line on how you handle their data and their rights.

Your obligations after you hit send

GDPR also governs how you keep and use the data. When you collect personal data from a source other than the person (a website, a directory), article 14 of GDPR requires you to inform them within a reasonable period and at the latest one month after obtaining the data, or at your first communication with them if that comes sooner.

Opt-outs must be permanent. The CNIL recommends keeping a suppression list so that someone who refused is never contacted again, including when you import a new list later. Answer access, deletion or objection requests within one month.

Do not keep prospects forever. The CNIL's guidance on retention indicates that prospect data can be kept for three years from the last contact coming from the prospect; simply opening an email does not count as a contact. After that, ask whether they still want to hear from you, and delete or archive the data if they do not answer positively.

If you buy or rent a list, you remain responsible: the CNIL asks you to check that the people were informed that their details could be used for prospecting and could object.

Cold calling businesses

Phone prospecting rules changed in France on 11 August 2026: calling consumers now requires their prior consent. For professionals, the CNIL indicates that prospecting can still rely on legitimate interest when the call relates to the person's profession, and that professionals keep the right to object. As with email, they must be able to learn who is calling and to refuse further calls by a simple means.

Be careful with sole traders and very small businesses: the number listed may be a personal mobile, and the line between professional and consumer can blur. Keep the call strictly about their business, and record any refusal.

Outside France

GDPR applies across the EU, but the ePrivacy Directive leaves member states room to decide how electronic marketing to legal persons is treated. Some countries, Germany for example, are stricter about unsolicited B2B email than France. Before prospecting in another country, read the guidance of its data protection authority. This guide is general information, not legal advice; for a specific situation, consult the texts or a lawyer.

Where LeadsIt fits

LeadsIt only collects public, professional business data (contacts that businesses publish on their own websites) and hosts it in the EU, and it shows the source website for each contact. Your messages, opt-outs and retention remain your responsibility; no tool can guarantee compliance for you.

Frequently asked questions