Is B2B Cold Email Legal in France? What the CNIL Actually Fines

In 2020 the CNIL fined a lunch-delivery company €20,000 for emailing people at work. The company called it B2B. The CNIL disagreed.

Yes. Under the rules of the CNIL, France's privacy regulator, you can cold email professionals without prior consent if the email is about their job, says where you got their address and makes opting out easy. Emailing private individuals at personal addresses is different. They have to say yes first.

This is general information, not legal advice.

I went through every CNIL fine since GDPR took effect that lists commercial prospecting as a breach, plus two the CNIL's table files under other headings. There are 26, from December 2020 to December 2025. Only two involved B2B contact data. The lunch company failed the job test. Kaspr, a Chrome extension that sold work contact details from LinkedIn, failed on where its data came from, how long it kept it and what it told people.

Neither was fined for emailing professionals about their work. In the CNIL's record, B2B cold email gets fined for the wrong pitch or the wrong data, not for being cold.

What does the CNIL allow for B2B cold email?

The CNIL's page on emails to prospects and customers, dated 10 June 2026 and checked October 2026, says prior consent is "pas systématiquement requis", not always required, for B2B prospecting when three things are true:

1. The message relates to the professional activity of the person you contact.
2. The person is told where their data came from and why they're getting the message.
3. They can easily object to further messages.

The usual legal basis is "legitimate interest" under Article 6(1)(f) of the GDPR. In plain words, you have a real business reason and it doesn't trample the person's rights. Recital 47 of the GDPR says direct marketing "may be regarded as carried out for a legitimate interest."

One honest caveat. France's anti-spam law, article L.34-5 of the telecoms code, bans prospecting emails to a "personne physique", a natural person, without prior consent. A named employee is a natural person too. The B2B exception comes from the CNIL's reading of the law, which it has held since at least 2009, not from the text itself. It's the reading the regulator enforces.

Two rules apply to every row. L.34-5 says that "dans tous les cas", in every case, a prospecting email must not hide who it's sent for and must give a valid way to ask for the messages to stop.

What counts as "about their job"?

The job test is about the offer, not the address. The CNIL's own example is a call pitching software to a company's IT director. A CNIL help page on B2B emails adds that when the message has nothing to do with the person's profession, the consumer rules apply. Payroll software to a finance director is fine. A personal insurance offer to the same person needs consent.

The lunch company shows where that line sits. According to the CNIL's 2020 decision, it had sent prospecting emails to 635,033 people since 2017. Some complained that it rebuilt their work address from their employer's email format, using details posted on a professional social network. The company argued the emails were strictly professional, since they were about lunch at the office.

The CNIL wasn't convinced. It found the messages had "peu de lien", little link, with the prospects' professional activity, so the company needed consent and didn't have it. The fine was €20,000, plus an order to delete the data it had collected without consent.

A work address doesn't make an offer B2B. My rule of thumb is to ask who would pay. If the person would buy it for the company, it's B2B. If they'd buy it for themselves, treat them as a consumer. That's my reading, not the CNIL's, but it would have caught this case.

Do generic addresses like contact@ get a pass?

They get a partial pass. The CNIL says addresses like info@ or contact@ belong to companies, not people, so the B2B conditions of job fit, data source and opt-out don't apply to them. L.34-5 still requires a visible sender and a way to stop.

I wouldn't build a French campaign on it. Outbound targets people, so email finders look up the decision-maker's own address, not contact@. The contact@ exemption is real, but almost nothing a B2B campaign sends goes to a generic inbox. Everything else is a named person, and all three conditions apply.

One limit. Our clients mostly sell into English-speaking markets, so our data can't say how French prospects reply. The rest of this piece runs on CNIL records.

What about freelancers and sole traders?

Sole traders are the messy case, and I couldn't find CNIL guidance that deals with them directly. L.34-5 protects every natural person, which a sole trader is. The CNIL's B2B position covers anyone contacted about their professional activity, which a sole trader also has.

Here's my rule. A freelance designer at their studio's domain, emailed about design work, reads as B2B to me. The same person at a personal Gmail, or any pitch that could be about their private life, I'd treat as a consumer. When you can't tell, leave them out. That's my reading, not the CNIL's, so if French sole traders are your core market, get a French lawyer to sign off first.

What actually gets companies fined in France?

I pulled the CNIL's table of sanctions and kept every decision since GDPR took effect that lists commercial prospecting or L.34-5 as a breach. The table files the lunch company and Kaspr under other headings, so I added both by hand. That gives 26 fines, December 2020 to December 2025. The CNIL's news feed shows no new prospecting fine in 2026 up to 8 October.

Source: CNIL sanctions table, decisions and press releases, checked 9 October 2026. n = 26 decisions, December 2020 to December 2025.

Four things stand out.

• Consumer marketing dominates. 12 fines hit consumer brands and 8 hit data brokers or marketing firms. In 4 simplified cases the CNIL published too little to tell who got the messages.
• Two involved B2B contact data. The lunch company paid €20,000 in 2020 and Kaspr €240,000 in 2024.
• Two inbox-ad cases are 98% of the money. Google paid €325 million and Orange €50 million for showing ads between users' emails without consent, along with cookie failures. Neither is about cold email.
• Small cases get fined too. 10 of the 26 fines were €20,000 or less. Eight of those came through the CNIL's simplified procedure, which caps a fine at €20,000, and all eight date from August 2024 or later.

I found no decision that fined a company for emailing a professional about their job with a working opt-out.

The table's tags do miss a few older phone and SMS cases about ignored objections, such as a €500,000 fine on a phone-canvassing firm in 2019. Those were consumer cases too, so treat 26 as a floor.

Kaspr is the case B2B senders should read twice. According to the CNIL, it held about 160 million contacts and collected details from LinkedIn users who had limited who could see them. It started telling people only in 2022, four years after launch, in an English email. It kept data for five years from each profile update. When people asked where their details came from, it said only "publicly accessible sources." In March 2026 the CNIL closed its order after Kaspr chose to delete its database and stop collecting from LinkedIn.

If you buy contact data, that problem travels with the list. The CNIL's June 2026 page says that with data you get from third parties, you must make sure people were told about prospecting use and can object. Judge vendors on where their rows come from, as we argue about B2B email finders.

Source: CNIL sanctions table, listed breaches, checked 9 October 2026. n = 26 decisions, December 2020 to December 2025. One decision can list several breaches.

Missing consent or a missing legal basis shows up in 24 of the 26, mostly consumer consent. But 20 also cite a failure that applies to B2B just as much. People weren't properly told how their data is used in 15, data was kept too long in 10, and opt-out or access requests were ignored in 10.

A tiny 2020 case shows how these stack up. An email marketer with one or two employees paid €7,300. Its decision found a footer that named neither the company nor the data source, and data on about 5 million people kept for over three years after they'd only opened an email. It also split its list across nine accounts, each with two sending domains, so an unsubscribe only cleared the account that sent that campaign. If you spread cold email across several domains, read that last one twice.

What should a B2B cold email to France include?

A safe B2B cold email to a French prospect does five things.

1. It says where you got the address. GDPR Articles 14 and 21 require the data source and the right to object to be given "at the latest at the time of the first communication." One plain line does it.
2. It has an opt-out that works everywhere. Under Article 21, once someone objects to direct marketing, you have to stop. Keep one suppression list across every domain and inbox, and treat a reply saying "stop" like a click on the link. Our opt-out rules guide covers the deadlines.
3. It fits the person's job. If you can't say in one sentence why their role makes the email relevant, don't send it.
4. It names the sender and links a privacy policy. The CNIL's B2B help page lists both, plus a simple opt-out, for every email.
5. It runs on a three-year clock. The CNIL's guidance on customer and prospect files says to keep prospect data for three years from collection or from the prospect's last contact. A click on a link counts as contact. An open doesn't, as the 2020 decision above shows.

Write the notice in French, and write down your legitimate-interest reasoning before you send. Here's an example footer:

Je vous écris car votre poste de [fonction] chez [entreprise] est directement concerné. J'ai trouvé votre adresse via [source]. Si vous ne souhaitez plus recevoir mes messages, répondez simplement "stop". Politique de confidentialité : [lien]

What changed in 2026?

• Open-tracking pixels need consent, B2B included. A tracking pixel is the invisible image that reports when someone opens your email. The CNIL's pixel recommendation, adopted in March 2026, treats consent as the rule. Its English version says pixel consent "may be necessary" even for emails that don't need consent themselves, and names "prospecting for professionals related to the profession" as one of them. The deliverability exemption only covers emails the recipient asked for, and a cold email isn't one. So skip open tracking for French prospects. We already keep open tracking off on cold sends for deliverability. France adds a legal reason.
• The Constitutional Council changed who can fine you, not what's allowed. On 25 June 2026, decision 2026-1210 QPC struck down the parts of L.34-5 that let the CNIL, the DGCCRF consumer authority and the telecom regulator ARCEP each punish the same facts. The repeal takes effect on 31 October 2027. Until then, or until a new law, no authority can pursue facts that another has already taken up. The consent and opt-out rules weren't touched.

Frequently asked questions

Do I have to write to French prospects in French?

No law says a B2B cold email must be in French. The data notice does have to be clear, and the CNIL found Kaspr's English-only email wasn't, then ordered it to inform people in a language they understand. A French source line and opt-out are cheap insurance.

Can I scrape email addresses from French websites?

Public doesn't mean free to use. The CNIL says publicly accessible data is still personal data, can't be reused without the person knowing, and can't be scraped from sites whose terms forbid it. Its 2009 guidance was blunter and called emailing addresses harvested from the public internet "interdit", forbidden.

What are the fines for breaking these rules?

GDPR fines go up to €20 million or 4% of worldwide annual turnover, whichever is higher. Until the 2027 repeal, L.34-5 also lets the DGCCRF fine up to €75,000 for an individual and €375,000 for a company. The CNIL's simplified procedure caps a fine at €20,000.

Does this apply if my company is outside France?

Very likely. Under Article 3(2), GDPR covers non-EU companies that offer goods or services to people in the EU, and pitching a French prospect looks like that. In 2022 the CNIL closed a case without a fine against a US contact-finder extension because it offered nothing to the people in its database and didn't monitor them. A sender pitching them is in a different spot.

Do follow-up emails need consent?

Not if the first email qualified. Follow-ups fall under the same B2B rules, and each one needs the opt-out, and once someone says stop, they come off every list. Our guide to handling cold email replies covers the sorting.

How long can I keep a French prospect in my CRM?

Three years from collection or from their last real contact, per CNIL guidance. A reply or a click counts, an open doesn't. The CNIL also recommends keeping opt-out records for at least three years, so you never email those people again by mistake.

The short version

B2B cold email to France works when you write to people about their jobs, tell them where you found them and make stopping easy. The fines land on pitches that aren't about work, bought lists, missing notices and broken unsubscribes. Kenso runs cold email and LinkedIn outreach for B2B companies, done for you, on infrastructure we own, and a human approves every campaign before the first email goes out. To see it on your own market, your first campaign is free.