You have a file of four hundred companies open in front of you, a first message written, and that pause right before you hit send. So you look up what the law says, and everywhere you land on the same sentence: comply with the GDPR, be transparent, include an unsubscribe link. Nobody tells you which article, in which code, in which version. You close the tab knowing exactly as much as when you opened it.
The answer does exist, and it is short. Three texts are enough to frame B2B prospecting in France, what marketing vocabulary calls outbound marketing: outbound prospecting, where you write first to companies that do not know you yet. They say what you may send, to whom, and under what conditions. This page names them, quotes their number and the date of the version in force, and links to the official text so you can read it yourself instead of taking my word for it.
The three texts that decide, and nothing else
B2B prospecting in France is governed by three sources: article L. 34-5 of the postal and electronic communications code (CPCE) for anything sent electronically, article L. 223-1 of the consumer code for the telephone, and articles 14 and 21 of the GDPR for information and objection. The published doctrine of the CNIL, the French data protection authority, settles the case of professional addresses.
| What you are doing | The text that applies | What it requires |
|---|---|---|
| Email to a named professional address | Art. L. 34-5 CPCE, read with CNIL doctrine | Subject related to the recipient's occupation, information, easy objection |
| Email to a generic company address | CNIL doctrine on legal entities | Outside the principles set for natural persons |
| Email to a private individual | Art. L. 34-5 CPCE | Prior consent |
| Phone call to a company | Art. L. 223-1, consumer code | Covers consumers only, a professional call is not caught |
| Phone call to a private individual | Art. L. 223-1, consumer code | Prior consent since 11 August 2026 |
| List built without contacting the people directly | GDPR articles 14 and 21 | Information within one month, right to object brought to attention |
The question that settles everything: natural person or legal entity
The whole regime for electronic prospecting sits in the first sentence of a single article. Here it is as published, in the version in force since 26 July 2020:
"Est interdite la prospection directe au moyen de système automatisé de communications électroniques au sens du 6° de l'article L. 32, d'un télécopieur ou de courriers électroniques utilisant les coordonnées d'une personne physique, abonné ou utilisateur, qui n'a pas exprimé préalablement son consentement à recevoir des prospections directes par ce moyen." (Légifrance, art. L. 34-5 CPCE)
Two words carry everything that follows: personne physique, a natural person. The prohibition protects an identifiable human being, not a company. That is why the CNIL states, on its page devoted to prospecting by electronic mail updated on 10 June 2026, that generic addresses such as info@companyname.fr, contact@companyname.fr or orders@companyname.fr, "which concern legal entities, are not subject to the principles set out above" (CNIL, 2026).
A named address, on the other hand, does identify a natural person, even when the domain belongs to a company. Knowing which category each row of your file falls into is therefore not a compliance detail: it is the first operation to perform, before a single word of the message is written. It is also what an email finder built for professional addresses does when it separates a role address from a named one.
The B2B regime does not come from the statute, it comes from CNIL doctrine
Here is the point almost no page states plainly. Article L. 34-5 contains no sentence expressly permitting prospecting without consent towards a named professional address. What permits it is the doctrine published by the CNIL, which accepts legitimate interest as a basis for prospecting between professionals.
The CNIL sets one substantive condition, worded as follows: prospecting is admissible "when the subject of the solicitation relates to the occupation of the person being approached". It adds a transparency condition where the contact details were not collected from the person: they must have been informed that their email address or phone number could be used for prospecting, and must be able to object to it simply and free of charge.
In practice, a message offering site management software to the owner of a masonry business falls squarely inside the framework. The same message sent to the same address to sell a cruise does not, however professional the address may be. The criterion is neither the channel nor the source of the file: it is the link between the subject of the message and the recipient's trade.
Two formal obligations complete the picture, and these ones are in the statute itself: the message must give valid contact details through which the recipient can ask for the sending to stop, and it must neither disguise the sender's identity nor use a misleading subject line. Those are the only mentions the text makes an explicit condition.
A list built elsewhere: the two GDPR articles everyone skips
As soon as your file does not come from a form filled in by the people themselves, two GDPR articles apply in full. Neither of them mentions commercial prospecting by name, which is precisely why they get skipped.
Article 14 governs the case where the data was not obtained from the data subject. It sets a deadline: the information must be provided "within a reasonable period after obtaining the personal data, but at the latest within one month". That deadline is rarely quoted, and it is exactly what turns a good intention into a dated obligation.
Article 21 deals with objection. Paragraph 2 states that "where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time". Paragraph 4 adds the detail that changes the layout of your messages: "at the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information" (GDPR text, chapter III).
Clearly and separately. A sentence buried in the body of the message does not meet the condition; a standalone line at the end does. That difference is decided on the first send, not the hundredth.
Why the word "consumer" matters since 11 August 2026
The telephone channel changed regime in France on 11 August 2026: article L. 223-1 of the consumer code, as amended by law no. 2025-594 of 30 June 2025, now prohibits calling for commercial purposes a person who has not given prior consent, except where the call falls within the performance of an existing contract (Légifrance, version in force on 11 August 2026).
The decisive detail is one word of the text: the protected person is the consumer. And the introductory article of the consumer code, in the version in force since 24 April 2024, defines a consumer as "any natural person acting for purposes which do not fall within the scope of their commercial, industrial, craft, liberal or agricultural activity", and a professional as one "acting for purposes falling within the scope of their activity" (Légifrance, introductory article).
Calling a tradesperson on their business line about their business therefore does not fall under article L. 223-1, because they are not acting as a consumer. The distinction deserves to be understood rather than summarised, and it is set out in our page on B2B telephone prospecting after the law of 11 August 2026.
The amounts, as written in the text
Article L. 34-5 sets out its own administrative penalty, and the figure is there in black and white: a fine "the amount of which may not exceed 75,000 € for a natural person and 375,000 € for a legal entity". That ceiling belongs to this article alone and stands, in principle, alongside the GDPR penalty regime, which is a matter for the CNIL and follows its own scale.
The figure is not there to frighten anyone. It is there because it can be checked in two clicks, and compliance you cannot check is not compliance.
What these texts require when you build the file
Translated into concrete moves, the three texts come down to four decisions taken before sending, not after:
- Sort addresses by nature. Generic ones on one side, named ones on the other, private individuals isolated in a third column. The regimes differ, so the files should differ too.
- Check that the recipient really is a professional. A legal form, a company registration number, an activity code are enough to settle it. That is the job of enrichment through official company identifiers, which ties each row to a registered entity rather than to an assumption.
- Put the information and the objection right in the message. Origin of the data, purpose, a simple way to say no, presented separately from everything else. The legal notices published on the recipient's own website often tell you exactly which entity you are addressing.
- Date what you do. The one month period in article 14 runs from the moment the data is obtained. Without a collection date recorded somewhere, that period cannot be measured, and therefore cannot be demonstrated.
If this is the kind of sorted, dated file you are building, outsend is in alpha by application and you can request free access to try it on your own target.
What these texts do not say
It is worth knowing what you will not find in them either. None of the three texts sets a maximum number of messages per day, a follow-up cadence, or a fixed retention period for prospect records. Those rules circulate widely; they come from recommendations, from sending best practice or from the technical constraints of mailbox providers, but they are not in the law you have just read.
What the texts do fix is precisely delimited: who the recipient is, the link between the subject of the message and their trade, the information about where the data came from, and a simple way to say no. The rest belongs to the quality of your targeting, not to your compliance. For the vocabulary used across these pages, our definition of cold email and its GDPR framework is a useful companion to this one.
Frequently asked questions
Does the GDPR apply to B2B prospecting?
Yes, in full, as soon as it targets identifiable natural persons, which a named address or a director's name always is. The GDPR contains no B2B exemption. What changes between B2B and B2C is not whether the regulation applies, but which legal basis is available: legitimate interest is accepted by the CNIL for prospecting between professionals, whereas prior consent is required for electronic prospecting of private individuals.
What exactly does the CNIL say about B2B prospecting?
On its page devoted to prospecting by electronic mail, updated on 10 June 2026, the CNIL accepts that prior consent is not required to approach a professional when the subject of the solicitation relates to their occupation. In return, it requires that the person has been informed that their contact details may be used for prospecting and that they can object simply and at no cost.
Does the French telephone prospecting law apply to B2B calls?
Article L. 223-1 of the consumer code targets the consumer, that is, under the introductory article of the same code, a natural person not acting within their professional activity. Calling a company on its business line, about its own line of work, therefore does not fall under that text. The general duties of fair dealing and of respecting a refusal continue to apply.
Do I need consent to write to contact@ or info@?
No: those generic addresses concern legal entities, and the CNIL states expressly that they are not subject to the principles applicable to natural persons. Treat them as a company channel, not as an individual contact.
Which article should I quote if a prospect challenges my message?
Three references cover nearly every case: article L. 34-5 of the postal and electronic communications code for the lawfulness of the electronic send, the CNIL page on prospecting by electronic mail for the professional regime, and article 14 of the GDPR for the origin of the data. Add the date on which you obtained the contact details: that date is what makes your answer verifiable.
How long may I keep a prospect who never replied?
None of the three texts quoted here sets a figure. The GDPR lays down a storage limitation principle, assessed against the purpose: it is for you to set the period, then write it in your register.
This article is part of a broader series: see the complete prospecting glossary.
outsend.xyz, a scraping and prospecting platform in alpha, open by application. Request free access at /en/demander-acces.