B2B cold email in France: what the CNIL says, in plain English

It is the question I am asked most often: “Am I allowed to email an executive I don’t know?” In France, between businesses, yes, under precise conditions. Here is what the CNIL, the French data protection authority, says, with no creative interpretation. These are the rules for prospecting in France; other EU countries apply the same EU rules in their own way, so check the local regulator before prospecting there.

Between businesses, no prior consent

For a private individual, the rule is prior consent: they must have agreed, by ticking a box themselves, to receive your messages. For a professional, the CNIL accepts that prospecting rests on legitimate interest, without prior consent, if its subject relates to the person’s profession.

Emailing a head of procurement to present procurement software: yes. Offering her personal car insurance at her work address: no, her job is no longer what the message is about.

The three conditions

1. The message relates to the recipient’s profession.
2. It makes clear who is sending it: your name and your company.
3. It offers a simple way to refuse further messages, in every send.

The CNIL adds a point that is often forgotten: the person must be informed that their details may be used, including when you got them from a third party, for example a prospect database. And a request to exercise their rights calls for an answer within one month at most.

The case of generic addresses

Addresses such as contact@, info@ or orders@ designate a company, not a person. The CNIL states that they are not subject to these principles. They are still subject to common sense: a contact address flooded with pitches ends up filtering your domain.

What Phantera does with these rules

• Every email goes out from your own mailbox, in your name, with your signature: the sender is identified.
• Campaign emails carry an unsubscribe link, and an unsubscribe stops the sequence.
• A reply from the prospect also stops their sequence, and a lead marked “Do not contact” receives nothing more, on any channel.

Targeting remains your responsibility: a message unrelated to the recipient’s job is not covered by legitimate interest, whatever the tool.