Guide · Compliance
B2B prospecting under GDPR
In France you can email a professional without prior consent, under conditions. Here they are, based on the legal texts and the guidance of the CNIL, the French data protection authority.
Updated 2026-10-05
In short
In France, email prospecting aimed at professionals can rely on legitimate interest, without prior consent, when the message relates to the person’s job, the person has been informed that their data is used, and every message lets them object simply and free of charge. Prospect data is generally kept for three years after the last contact.
The principle: B2C and B2B follow different rules
Towards consumers, email prospecting generally requires prior consent. Towards professionals, the CNIL (in French) states that prospecting can rely on the prospecting company’s legitimate interest when the subject of the message relates to the recipient’s profession. Its example: presenting software to a company’s IT director.
In practice, emailing a CFO about cash management fits; emailing the same CFO about a personal holiday offer does not, even at a work address.
The CNIL also notes that generic addresses belonging to a legal entity (such as contact@ or info@) fall outside these rules, because they do not identify a person.
Three conditions to meet in every message
- A link to the role: the subject of the message concerns the person’s job or responsibilities.
- Information: the person must know their data is used for prospecting and where it came from. When data was not collected from the person, Article 14 GDPR requires the information to be given at the latest at the first communication. In practice: a short notice in the first email (who you are, why you are writing, where the address came from, how to exercise their rights) and a link to your privacy policy.
- A simple, free way to object: according to the CNIL (in French), every message must state the sender’s identity and offer a simple way to refuse further messages. An unsubscribe link, or the option to reply “stop”, handled without delay.
Do and don’t
| Do | Don’t |
|---|---|
| Target roles related to your offer | Email the whole company “just in case” |
| Say who you are and where the address came from | Hide the sender or the source of the data |
| A link or reply option to object, in every email | An unsubscribe link that requires an account or a password |
| Keep a suppression list and check it before every campaign | Re-import a contact who objected |
| Collect only the data the message needs | Store unrelated personal details (private life, opinions) |
| Delete or archive after the retention period | Keep prospects who never replied forever |
Data minimisation and retention
GDPR requires you to process only the data you need. For prospecting that is short: name, role, company, work email, LinkedIn profile, and the context that justifies the message (the signal). Nothing else belongs in your file.
On retention, the CNIL reference framework on commercial activities (in French) states that data on a prospect who is not a customer may be kept three years from collection or from the prospect’s last contact. At the end of that period you may ask whether they want to keep hearing from you; without a positive answer, delete or archive.
The suppression list
An objection has to last. The CNIL recommends a suppression list (in French): you keep the bare minimum (the email address, possibly hashed) to make sure someone who refused is not contacted again, even if they reappear in a new file. Check it before every import and every launch.
What about LinkedIn?
Information visible on a public profile is still personal data: GDPR applies to how you collect, store and use it. The same principles hold: link to the role, information, minimisation, objections respected.
LinkedIn also has its own rules: its User Agreement restricts scraping and automated tools. Complying with GDPR does not exempt you from it, and vice versa.
Compliance checklist
- Up-to-date record of processing, with a “commercial prospecting” entry and its legal basis.
- A written legitimate interest assessment: why prospecting is necessary and why it does not unduly affect the people concerned.
- An information notice in the first message and an accessible privacy policy.
- An opt-out in every email, handled without delay, and a suppression list that is actually checked.
- A configured retention period and an actual purge.
- An Article 28 GDPR agreement with every processor (sending tool, enrichment, CRM).
- A procedure to answer access and erasure requests within one month.
Example information notice
At the bottom of the first email, two or three lines are usually enough, with a link to the privacy policy for the rest. An example to adapt: “I’m writing because your role as [role] is directly concerned by [topic]. Your work contact details come from [source: company website, public professional profile, B2B database]. [Your company] uses them to present its services, on the basis of its legitimate interest. To stop receiving messages, reply “stop” or [unsubscribe link]. More: [privacy policy link].”
Later follow-ups must still let people object, but need not repeat the whole notice: one line with the unsubscribe link is enough.
Prospecting outside France
GDPR is common to the EU, but the rules on electronic prospecting come from the ePrivacy Directive, transposed differently in each country. Some member states require consent even for professionals, or treat named and generic addresses differently from France. Before a campaign in another country, check the local data protection authority’s guidance, and take advice if the volume or sector warrants it.
Outside the EU other texts apply: in the United Kingdom, close but distinct rules; in the United States, the CAN-SPAM Act, which notably requires a postal address and an opt-out mechanism.
What The Sales Engine does
On the platform, you approve every prospect before the first message, which lets you check the fit between your offer and their role. Emails carry an unsubscribe link, unsubscribed addresses are blocked from later campaigns, and a reply stops the sequence. You remain the controller of your prospecting; we act as processor, as described in our privacy policy.
Frequently asked questions
Do I need a professional’s consent to email them?
Not necessarily in France: the CNIL accepts legitimate interest if the message relates to their role, they have been informed and they can object in every message. Rules differ in other EU countries; check them before prospecting outside France.
How long can I keep a prospect who doesn’t reply?
Under the CNIL reference framework, three years from collection or from the prospect’s last contact. After that, ask whether they want to stay in touch; without a positive answer, delete or archive.
Does GDPR apply to prospects outside the EU?
It applies when you are established in the EU or target people in the EU. For prospects elsewhere, local law also applies (for example CAN-SPAM in the United States); check it before launching.
Read next
Prospect cleanly
We show you how prospect approval, unsubscribe handling and the suppression list work on the platform.