Is B2B Cold Email Legal in France? What CNIL Allows in 2026

Is B2B cold email legal in France? The short answer

Yes, under conditions. CNIL, the French data protection authority, says prior consent is not always required for prospecting between professionals. Three conditions apply. The message has to be linked to the recipient's professional activity. The person has to be told where their data came from and why you are writing. They have to be able to object simply (CNIL guidance on electronic communications).

CNIL's hub page on prospecting sums it up in one line: electronic prospecting "est possible". People must be informed first. Private individuals must consent beforehand, and professionals must be able to object (CNIL on commercial prospecting).

Stop asking whether France allows cold email. Look at your list instead. Mark which contacts are professionals, reached about their own job. That one split decides every rule below.

Each European country on a list brings its own rules, and France is one where a B2B route exists.

This page covers France only, and it is not legal advice, so check your own setup with a French data protection lawyer. The wider question of scraping and cold emailing is a separate one.

What a B2B cold email to France must tell the recipient

CNIL's requirements come down to three points:

1. How their data is used. Professionals must be informed of how their data is used, for example when their email address is collected, and must be able to object simply and free of charge (CNIL page on email, SMS and automated-call prospecting).
2. The source of their data and the purpose of the message. CNIL's words are "de l'origine de ses données et de la finalité du message" (CNIL guidance on electronic communications).
3. That they can object. The mechanics are in the opt-out section below.

The same CNIL page on email and SMS prospecting says B2B prospecting can rest on "l'intérêt légitime", or legitimate interest, when the message is "en rapport avec la profession" of the person. The rule CNIL is reading here is Article L34-5 of the French postal and electronic communications code (CPCE). The article itself says CNIL oversees compliance with it for direct prospecting that uses a person's contact details.

In practice, "linked to their job" means the title and the offer match. A logistics software pitch to a head of logistics fits. A cybersecurity audit pitched to a CTO fits. The same audit pitched to the company's office manager is a stretch, and anything about the person's private life fails.

Why the notice has to sit in the first email

In cold outreach, email 1 is usually your first real chance to inform someone. Reply rates make that sharper. Our campaigns usually see a reply rate of about 1%, and at thousands of emails a day it often drops to 0.5%. That is a range, and it moves with targeting as well as volume.

So 1,000 contacts -> roughly 10 replies over a full sequence. The other 990 or so never write back. Everything they learn about where you found them and why you wrote, they learn inside your emails. A privacy page linked in the footer reaches almost none of them.

A short line does the job. Say how you found the address and that the message is about something tied to their role. One sentence before the signature covers source and purpose, and it reads like a normal person explaining themselves. My team verifies every address before a campaign goes out. Write the source down at that same step, while you still know it.

Which email addresses the B2B rule covers

A B2B list mixes several kinds of contact, and CNIL treats them differently.

The generic inbox row comes from CNIL's golden rules for email prospecting, which list info@, contact@ and commande@ as generic addresses. That page dates from 2009 (more on its status in the questions at the end), so read the exemption narrowly: identify yourself and offer a refusal anyway.

Keep generic inboxes in their own segment. They need different copy anyway. The reader is whoever opens the shared mailbox, and the realistic goal is a forward to the right person.

Opt-out rules for cold email in France

CNIL asks for two things in every single solicitation. It must show who is sending. It must let the recipient refuse further messages easily (CNIL page on email, SMS and automated-call prospecting). Refusing must also be free. CNIL's general guidance uses the word "simplement", and its prospecting page says "de manière simple et gratuite".

CNIL's older golden rules for email prospecting add two details. Every commercial message needs a way to unsubscribe "par tous moyens", by any means. It must also name the person on whose behalf the message is sent.

For cold email, a plain reply instruction works better than a tracked unsubscribe link. It costs the reader nothing and takes one word. It also keeps your email from looking like a newsletter. An English version:

Your work address comes from a B2B contact database, and this note is about procurement, which you run. Reply "no" and you will not hear from us again.

The same idea in French:

Votre adresse professionnelle provient d'une base de contacts B2B et ce message concerne vos achats. Si vous ne souhaitez plus recevoir de messages de ma part, répondez simplement "non".

Follow-ups count as solicitations too, so each one names your company and keeps the refusal line. Across our campaigns, the best results often arrive with the third follow-up, because many prospects only read you properly late in the sequence. The way out has to be in every message, not only the first.

How to handle replies and refusals from French prospects

A refusal rarely arrives as the exact word you asked for. Sort each reply by what it means:

• "Non", "stop", "pas intéressé", "merci de ne plus m'écrire": a refusal. The contact goes on the exclusion list the same day, for every mailbox and every future campaign.
• An angry reply or a complaint: also a refusal, even if it never says stop. Log it with the date.
• "Not me, write to my colleague": a referral. The colleague is a new contact with a new source, so they get their own job check and their own notice line.
• An out-of-office naming a deputy: handle it like a referral. Note the source and check the deputy's role before you write.
• "Where did you get my address?": answer from your source column (more in the questions at the end).

The exclusion list only works if it is shared. If one mailbox logs a refusal and another keeps sending, you broke the promise in your first email. My team keeps one exclusion list that every sender and every mailbox checks before each send. One person also owns the replies and reads every one, so a "non" buried at the bottom of a long thread still gets caught.

We also avoid making email the first touch. That is how we sequence, not a legal rule: a LinkedIn touch comes first, so the prospect already knows a real, named sender before the email and its notice line arrive, and that line then states the source again.

Can you use publicly available company data?

Being public does not make data free to use. CNIL states that publicly accessible data is still personal data, and it must be reused "dans le respect des dispositions du RGPD", in line with the GDPR (CNIL on commercial prospecting).

CNIL's 2009 golden rules go further on one point. Prospecting with addresses collected in public spaces of the internet, which it lists as websites, directories and discussion forums, is, in its words, "interdit". The current hub page is less blunt, but it still says public data stays personal data and must be reused under the GDPR.

Read together, harvesting addresses off websites, directories and forums is the practice to avoid. Even with a list from a B2B data provider, "it was public" only answers where the address came from. You still owe the person the notice, the job link and the easy refusal. So the source of each contact belongs in the list itself. No source, no send.

We build lists from tools like Sales Navigator, Apollo and UpLead and do not scrape. So every contact has a named source, and the notice line in email 1 can say exactly where the address came from.

How to tell lawful B2B prospecting from B2C spam

Run every segment of your list through these questions, in order. A "no" on question 1, 3, 4 or 5 means do not send. Question 2 only changes how you write.

1. Is the contact a professional reached at work? If they are a private individual, prior consent is the rule. Stop here unless you have it and can prove it.
2. Is the address a generic company inbox? If yes, CNIL's 2009 guidance places it outside the notice and objection principles for named contacts. Identify yourself and offer a refusal anyway.
3. Is the message about the person's job? A payroll software pitch to an HR director passes. Anything about their private life fails.
4. Can your first email say where you got the address and why you are writing? If you cannot name the source, do not send.
5. Can the person refuse for free in one step, and will every mailbox stop? If not, do not send.

France and Germany in the same campaign

Many "Europe" lists mix countries with different rules. France has a B2B route, as shown above. Germany gets different handling from us. When a client needs Germany, my team applies its own stricter rules and prefers LinkedIn outreach there. Austria and the Czech Republic get the same treatment from us: no cold email to them without a compliant basis, so LinkedIn carries the outreach.

So split the list by country before you write any copy. The French segment goes through the five questions above. The German, Austrian and Czech segments go to a LinkedIn sequence instead. One exclusion list still covers all of them, so a person who refused in one channel is not picked up again in another.

What CNIL enforcement shows

In May 2025, CNIL issued a 900,000 euro fine against Solocal Marketing Services over email and SMS prospecting to individuals, run on prospect data it got mainly from data brokers. CNIL found that where consent was required, the company had to be able to prove valid consent under Article 7 of the GDPR, and it "failed to provide" that proof.

For a B2B sender, the lesson is about records. If any part of your outreach relies on consent, the burden of proof sits with you. If it relies on the B2B route, you still need to show the conditions were met: where each address came from, why the message fit the person's job, and when you honored each refusal.

CNIL's page on legitimate interest says an organization using that basis must be able to demonstrate it is valid, and it recommends documenting the method. In practice that can be one row per contact. A generic example: source "B2B contact database, named tool", date pulled, title "Head of HR", why the offer fits ("training budget sits with HR"), and the refusal date if they opted out.

CNIL does enforce, so keep that paper trail. Its list of sanctions shows that in April 2024 it ordered a company doing email prospecting for advertisers to pay a 25,000 euro penalty, because it failed to respond to an injunction. The list does not say whether that prospecting was B2B or B2C.

A compliant France cold email process, step by step

Build it in this order.

1. Source column. Every contact carries where it came from and the date it was pulled. That column feeds the notice line and answers any question later.
2. Audience fit. Titles match what you sell, using the real decision-maker titles for that niche rather than a generic "manager", so the job link is real. Country splits come first, and generic inboxes sit in their own segment.
3. Notice and opt-out line in email 1. Source, purpose and a one-word reply to refuse. Every follow-up keeps the refusal line and names your company.
4. Shared exclusion list. Every refusal goes on one list that all senders and mailboxes check before each send.
5. Verified addresses. Verify every address before the campaign and keep the bounce rate below 0.5%. Cheap lists bought from freelancers are where we see high bounces and low opens, and every bounce is a sign the list is not as clean as you think.
6. Separate sending setup. Never send cold email from your main domain. Authenticate every sending domain with SPF, DKIM and DMARC, then give each new mailbox 10 to 14 days of warmup before it writes to a single prospect. We run every client on dedicated sending IPs, separate even across domains.
7. Records. Keep the list version, the sent copy and the refusal log for each campaign.

If a contact fails the five questions, no copy fixes it. Fix the list first. Then write the email.

Sending cold email into France and unsure your notice line holds up? Book a call and send me your first email, and I will go through it with you before you check it with a French lawyer.