B2B cold email: what the law allows in France

Writing to strangers is intimidating, and it’s often the first question we get: are you allowed to email a director who never asked to hear from you? In France, between professionals, the answer is yes, on a few precise conditions. Here they are, as the CNIL (the French data protection authority) presents them, and what they change in practice.

The principle: objection rather than consent

For a private individual, email prospecting requires prior consent. For a professional contacted at their work address, the CNIL accepts prospecting without prior consent, on one condition of substance: the subject of the message must relate to their profession. Offering accounting software to the president of a holding company, yes; offering her a personal holiday deal, no.

The person does, however, keep a right to object, which they must be able to exercise at any time, simply and free of charge.

What every email must say

• Who is writing: the sender’s identity, on whose behalf they are writing, and a way to contact them.
• How to object: a link or an address to stop receiving anything, one that works and is honored immediately. The List-Unsubscribe header, which Gmail and Yahoo display as a button, makes this even simpler.
• Where the data comes from: when the contact details weren’t provided by the person themselves, the GDPR (article 14) requires you to tell them the source no later than the first communication. One sentence is enough: “We’re writing to you because you run ACME HOLDING, according to the national company registry.”

The registry, and the companies that said no

The data in the national company registry is public, but a company can object to its use for commercial prospecting. That objection appears in the published data: a company that has requested it simply must not be prospected. Coldlyne removes these companies before even suggesting them.

Retention, and never writing again

The CNIL recommends not keeping a prospect’s data for more than three years after it was collected or after their last contact. And someone who has unsubscribed must never receive another message: so you have to keep their address on a suppression list, the only use you can still make of it. Excluding a whole domain is useful when a company asks that none of its employees be contacted.

Generic addresses

Addresses like contact@ or hello@ belong to the company, not to a person. They follow the same common-sense rules: a message related to the business, an identifiable sender, an unsubscribe that works.

In practice

Respectful prospecting comes down to very little: write to the right person about the right subject, say who you are and where their details came from, stop as soon as you’re asked, and don’t keep data longer than necessary. It’s also common sense: a targeted, honest email is likelier to interest its reader, and less likely to be reported, than a mass send.

This post summarizes the CNIL’s public recommendations; it doesn’t replace legal advice for a specific case.