You work on your own, and you have a simple idea: of calling thirty businesses this week to talk about what you do. Only problem: you don't have any numbers. You search "buy business contact list" and land on vendors promising ten thousand contacts for a few dozen euros, without telling you where those numbers came from, whether they still work, or whether you're even allowed to use them. You're right to be wary.
You don't need to buy anything. France is one of the countries with the most open business data, and professional phone numbers are, for the most part, publicly displayed. Finding numbers is easy. The work is building a clean list: up to date, deduplicated, free of dead numbers, and built in a way you can justify if anyone asks. Here's the method, step by step.
Why buying a list works against you (and puts you at risk)
A purchased list gives you three problems at once: outdated numbers you're paying full price for, a data origin you can't justify, and legal liability that falls squarely on you the moment you make your first call. You're paying to take on risk.
Volume means nothing. Ten thousand raw numbers are worthless if half of them no longer work and you have no idea who picks up. Worse: when you obtain data through a third party, it's your responsibility to have informed the contact about how you're using their number and to give them a simple way to opt out (CNIL, 2022). With an opaque purchased list, you can't even prove where the contact came from. A list you build yourself, from sources you can name, avoids all of that, and it's more up to date.
Building your business phone list from public sources
To build a business phone list without buying anything, you cross two free sources: the map (Google Maps), which gives you the main phone numbers that each business has publicly listed, and the official French business registry Sirene from INSEE, which gives you the legal identity and location. The first gives you the number, the second confirms the company.
Start with the map. Search "your target sector + your city" on Google Maps, and establishments scroll by with their name, address, website and, most of the time, their main phone number. All of it is public, all of it posted by the business itself. Copying two hundred listings by hand takes an entire evening of copy-pasting; an extraction tool gives you the same thing in a clean file in minutes. The full method is in our guide on exporting a list from Google Maps to CSV for free, and if you want fast volume, in our guide on building a list of 500 targeted businesses in one hour.
For the official framework, there's the Sirene database: free, open data, covering around 25 million companies and 36 million registered establishments since 1973, ceased entities included (INSEE, page updated 17 October 2024). Of that cumulative total, 14,351,029 establishments are active and publicly listed as of 2 October 2026: those are the ones you can actually call (outsend measurement on the Sirene open data stock). It doesn't contain phone numbers, but it gives you the SIREN identifier, legal form, business activity code and municipality, enough to verify that a structure actually exists and matches your target. We explain how to use it for qualification in our guide on qualifying a list with company legal data and in our guide on enriching a list with SIRET, SIREN and RCS data.
Targeting the right number: main line, professional mobile, direct line
Not all numbers are equal for outreach. The main phone number a business publicly displays is the safest to use: it's a professional line, published by the business to be called. A business owner's personal mobile, on the other hand, falls under stricter rules.
The distinction matters because it changes your obligations. A main office line or direct business number is a professional contact: you call it to discuss their work, which is the standard framework for B2B outreach. A mobile number that looks like a personal line can fall under the rules for private individuals, which are far stricter. In plain terms: prioritize numbers the business has publicly posted to be reached, and set aside mobile numbers collected elsewhere whose professional or personal nature you can't confirm. If you want to supplement an existing list by pulling the numbers displayed on companies' websites, that's exactly what the additional phone number enrichment from website feature does.
Keeping the list clean: duplicates and dead numbers
A clean phone list is one where every number still works and no business appears twice. Two cleanup steps are enough: deduplicate on a stable identifier (the SIREN, not the name, which varies between sources), then remove numbers and websites that no longer respond.
Deduplicating by name doesn't work: "Boulangerie Martin" and "Boulangerie MARTIN SARL" are the same business but two different rows in your spreadsheet. Use the SIREN, which is unique per company, to merge without errors. On dead numbers, your list gets old: a business moves, closes or changes its line. Rather than calling for nothing, flag stale records beforehand. A website that no longer responds is often the first sign that a contact needs checking. That's the logic behind the dead-check for dead URLs in a contact database, which saves you the calls you'd otherwise waste.
Staying compliant: disclosure, opt-out, and the 2026 law
Direct answer: a B2B prospecting list is compliant when three things are true at once: every contact has an origin you can name, the purpose of your approach relates to the person's line of work, and a simple, free way to opt out is offered at every contact. The CNIL does not require prior consent for B2B: the legal basis is legitimate interest, provided the person has been informed that their details may be used this way and is able to object (CNIL, "La prospection commerciale par courrier électronique", consulted 10 August 2026). The scope is in fact narrower than most assume: according to the CNIL, generic addresses belonging to legal entities (info@, contact@, commande@) are not subject to those principles, which places a substantial share of a list built from public sources outside their reach.
Cold-calling businesses remains legal without prior consent, subject to two conditions: your call must relate to the person's line of work, and they must be able to opt out simply and at no cost (CNIL, 2022). That's the baseline, and it still holds in 2026.
Don't mix up private individuals and businesses. For private individuals, the French law of 11 August 2026 (Légifrance) moves to mandatory prior consent and ends Bloctel: you can no longer call a consumer who hasn't said yes. But B2B outreach, meaning calling a company on a matter related to its business, remains grounded in legitimate interest, with no opt-in required. Your only obligation: log anyone who asks not to be called again, and respect that without exception. A simple "do not contact" column in your file is enough. For email outreach rather than phone, the related rules are detailed in our guide on cold email and GDPR in 2026.
From collection to call: a list you can justify
At this point, you no longer have an anonymous "database". You have your own list: real businesses in your area, their main phone numbers, their verified legal identity, no duplicates, no dead numbers. You can name every source if asked.
Use it like a good cold email: one targeted call, a genuine reason to be calling this business, and you hang up the moment they say no. To build your own list and land your first clients without buying anything, read our guide on finding your first clients as a freelancer without buying a contact database. The phone is one more channel on the same list, and it often brings the first meetings when you're starting out on your own. That's the point of bringing extraction, verification and enrichment together in one place, which is what outsend in alpha does: you start from nothing and get a list ready to call.
To place this topic in context, browse the guide to prospecting without a SIRET.
FAQ: building a business phone list
Is it legal to cold-call a business you've never had contact with?
Yes, under two conditions. Your call must relate to the person's line of work, and they must be able to opt out simply and at no cost (CNIL, 2022). B2B outreach remains grounded in legitimate interest, with no prior consent required, as long as you honor any request to stop calling.
Does the law of 11 August 2026 prevent me from calling businesses?
No. The French law of 11 August 2026 (Légifrance) introduces mandatory prior consent and ends Bloctel for outreach to private individuals. Calling businesses on their professional line for business-related matters remains permitted without opt-in. The key distinction is between a professional line and a business owner's personal mobile.
Where can I find business phone numbers for free?
Main phone numbers are publicly posted by businesses themselves on Google Maps and on their websites. You collect them by searching your sector and city, then consolidate everything into a clean file using an extraction tool instead of copying each listing by hand. The INSEE Sirene registry complements this with legal identity data, but does not contain phone numbers.
Does the Sirene database include phone numbers?
No. The INSEE Sirene database (page updated 17 October 2024) is free and covers around 25 million companies registered since 1973, ceased entities included, but it provides legal identity data (SIREN, legal form, business activity, municipality), not phone numbers. For numbers, you go to the contact details businesses publish themselves, such as on Google Maps or their website.
How do I avoid calling numbers that no longer work?
Keep your list up to date. Deduplicate on the SIREN rather than the name, and flag stale records before calling: a website that no longer responds often signals a business that has closed or relocated. A regular check, such as a URL dead-check, saves you calls that go nowhere.
Should I buy a list to save time when starting out?
No. A purchased list contains outdated numbers, its origin is unknown, and the legal liability falls on you. A list built from public sources you can name is more current, more targeted and defensible if anyone asks where your contacts came from. A large volume is useless if the contacts don't match your target.