In brief
- Email to professionals: possible without prior consent if the offer relates to their profession, with information and a right to object.
- Generic addresses (info@, contact@) of legal persons: the CNIL excludes them from these principles.
- Telephone: since 11 August 2026, prior consent for consumers; professionals can object. Bloctel has closed.
- Every message identifies the sender and offers a simple way to refuse further messages.
The principle: opt-out for professionals, opt-in for consumers
The CNIL, France’s data protection authority, sums up the rule at the top of its CNIL guidance on prospecting by email, SMS-MMS and automated calls (in French) (updated on 10 June 2026, retrieved on 4 November 2026). Quotations below are our translation: “Electronic commercial prospecting (email, SMS-MMS, automated calls, etc.) is possible, but people must first be informed. They must also give prior consent if they are private individuals, or be able to object if they are professionals.”
For business-to-business prospecting, the key sentence is: “Prospecting directed at professionals may be based on the organisation’s legitimate interest where the subject of the approach relates to the profession of the person contacted.” The CNIL’s example is a call presenting the merits of software to a company’s IT director. Among its reference texts, the guidance cites Article L34-5 of the French Postal and Electronic Communications Code.
The link with the profession is the condition that matters
The B2B regime does not cover any message sent to a business address: your offer must concern the recipient’s activity, such as invoicing software for an accounting firm or site equipment for a construction business. Without that link, the CNIL guidance does not provide this basis: to be safe, treat the contact as a private individual and obtain consent first. Targeting by NAF code helps you document the link; our records do not carry this code yet: it will come from matching with the Sirene database (in progress; see NAF and APE codes: targeting an industry).
Generic, named and reconstructed addresses
The CNIL draws a clear line: “Generic addresses such as info@companyname.fr, contact@companyname.fr or order@companyname.fr, which concern legal persons, are not subject to the principles set out above.” A named address (firstname.lastname@company.fr), by contrast, relates to a natural person: it is personal data and the GDPR applies.
Addresses “guessed” from a person’s name and their employer’s address pattern are covered by a CNIL publication of 16 October 2026 (in French): legitimate interest is only possible after a case-by-case assessment, because “people with no identifiable online presence, or who take concrete steps to hide or protect their contact details, cannot, a priori, reasonably expect their email address to be reconstructed”. basedecontacts.fr does not generate addresses of this kind.
What every message must allow
According to the CNIL, “every approach must allow the person concerned to know the identity of the organisation sending it and to express, if they wish and by a simple means, their refusal to receive further approaches”. In practice:
- an identifiable sender (company name, not just a first name);
- a working unsubscribe link or reply address in every message;
- a suppression list (in French), so that you do not contact again someone who has objected and appears in a new file; the CNIL recommends keeping it for at least 3 years, preferably as hashes.
Telephone: what changed on 11 August 2026
The CNIL guidance on telephone prospecting (in French) (updated on 10 June 2026, retrieved on 4 November 2026) opens with: “The rules on commercial telephone prospecting have changed since 11 August 2026. To prospect private individuals, you must first obtain their consent. Professionals, for their part, have the option of objecting.”
Towards consumers, prior consent is now required, except for calls relating to a current contract (Article L. 223-1 of the French Consumer Code, in the wording introduced by Law No. 2025-594 of 30 June 2025). According to the CNIL, consent is valid for one year at most and proof must be kept for at least three years (Decree No. 2026-662 of 23 July 2026); calls take place Monday to Friday, 10:00–13:00 and 14:00–20:00. Telephone canvassing is banned outright for energy renovation, adapting homes for loss of autonomy and the personal training account (CPF).
Towards professionals, the rule remains the right to object: information when the number is collected, a simple and free way to object, and a call related to the profession of the person contacted.
Bloctel no longer exists. The Bloctel website states: “The Bloctel service ended with the entry into force on 11 August 2026 of the telephone canvassing regime based on obtaining the consumer’s prior consent.” What counts now is consumer consent and your own objection list.
The CNIL guidance does not expressly address sole traders (entrepreneurs individuels) reached on their business number: if your target group includes many of them, have your approach reviewed.
The channels at a glance
You can scroll the table sideways.
| Channel | Towards professionals | Towards consumers |
|---|---|---|
| Email, SMS-MMS, automated calls | legitimate interest if the subject relates to the profession; information and objection | prior consent (exceptions: existing customers for similar products or services, non-commercial prospecting) |
| Telephone (not automated) | option to object; information | prior consent since 11 August 2026 (exceptions, including calls about a current contract) |
| Postal mail | prior information and right to object (CNIL guidance on postal mail, in French) | |
GDPR: informing people and respecting objections
As soon as the file contains data on natural persons (sole traders, named addresses), the GDPR applies on top of these rules:
- Information (Article 14 GDPR). Where data were not obtained from the person, they receive in particular the controller’s identity, the purposes, the source of the data and their rights, at the latest at the first communication if the data are used to contact them.
- Objection (Article 21 GDPR). The person can object to prospecting at any time; their data are then no longer processed for that purpose. This right must be presented to them at the latest at the first communication, clearly and separately.
For data obtained from third parties, the CNIL asks you to “make sure that the person concerned has been informed of the possible use of their email address or telephone number […] for prospecting and is able to object”. Your first message should therefore say who you are, where the address comes from and how to object.
What about a purchased file?
It does not include any consent: you use the contact details under your own responsibility and according to the rules of the channel. basedecontacts.fr files have no column for executives; a sole trader’s business name may still be their own name, and the published number may be a mobile (06, 07); see export and sample file and sources and methodology.
Checklist before a campaign
- Check that your offer relates to the recipients’ profession.
- Identify sole traders (legal form column once Sirene matching is done; until then, a business name that is a person’s name) and named addresses: the GDPR applies.
- Prepare the Article 14 information text: who you are, the source of the data, the right to object.
- Identify the sender and include an unsubscribe link in every message.
- Keep a suppression list and match it against every new file before sending.
- If in doubt, have your approach reviewed by a lawyer.
Frequently asked questions
Can I send a prospecting email to a French business without consent?
Yes, if the offer relates to the recipient’s profession: the CNIL then accepts legitimate interest as the basis. The person must be informed and able to object, and every message must identify the sender and offer a simple way to refuse further messages.
Do info@ and contact@ addresses fall under these rules?
According to the CNIL, generic addresses (info@, contact@, order@) belonging to legal persons are not subject to these principles. Identifying the sender and offering a way to refuse are still required in all cases.
Can I still call a business after 11 August 2026?
Yes. Prior consent is now required for consumers; professionals can object. The call must relate to their profession, with information and a simple way to refuse.
As of 4 November 2026. Sources: CNIL guidance, the Bloctel website, ANIL and the GDPR text published by the CNIL, retrieved on 4 November 2026; quotations are our translation. General information, not legal advice.
