Is a cold B2B e-mail legal in France? What CNIL actually allows

France is one of the few large EU markets where a manufacturer can send a first e-mail to a distributor it has never dealt with, provided it follows the rules the regulator has set out. The rules are not complicated, but they are specific, and the regulator, the Commission nationale de l'informatique et des libertés (CNIL), publishes them in plain terms.

Putting it simply: an unsolicited e-mail to a French company about your products is lawful if it goes to a professional address, the subject matches the recipient's job, the message says who you are and how to opt out, and you can show the person was told their address might be used this way. Generic addresses such as contact@ or info@ are not personal data and are outside those conditions.

The legal starting point: opt-in for natural persons

Article L34-5 of the Code des postes et des communications électroniques bans direct prospecting by e-mail using the details of a natural person who has not given prior consent. The same article carries the existing-customer exception (details obtained in a sale, similar products, opt-out at collection and in every message) and the rule that applies to everyone: every prospecting e-mail must give valid contact details through which the recipient can ask you to stop, at no cost beyond sending the request.

Read on its own, that looks like a consent regime. What makes France workable for B2B is how CNIL applies it to professionals.

What CNIL allows for professionals

CNIL's guidance on e-mail prospecting draws a line between consumers and professionals. For consumers, prior consent is required. For professionals, CNIL says prospecting "peut être fondée sur l'intérêt légitime de l'organisme lorsque l'objet de la sollicitation est en rapport avec la profession de la personne démarchée": it can rest on your legitimate interest when the subject of the message relates to the person's profession.

Three conditions follow from CNIL's text.

1. The message must fit the recipient's function

A product offer to the purchasing director of a wholesaler that sells your category passes. The same offer to the company's payroll officer does not, because the subject has nothing to do with that person's role. CNIL's example of a professional address is of the form prenom.nom@entreprise.fr: a named person reachable in their professional capacity.

2. The person must have been informed and able to object

Where the address was already held or obtained from a third party, CNIL requires you to make sure "que la personne concernée a été informée de la possible utilisation de son adresse électronique ... pour de la prospection et est en mesure de s'y opposer". In CNIL's current guidance (updated 10 June 2026) this information is given when the address is collected: a named professional address may be used without consent only if the person was told then that it could be used for prospecting and can object free of charge, and the message relates to their job. A notice in your first e-mail does not cure an address collected without it.

3. Every message identifies the sender and offers an easy opt-out

Each e-mail must allow the recipient to identify the sender and to refuse further messages simply. A reply-to-stop line in the footer and a working sender address satisfy this. Hiding behind a no-reply address or a vague brand name does not.

Generic addresses are a different case

CNIL states that generic addresses "de type info[@]nomsociete.fr, contact[@]nomsociete.fr ou commande[@]nomsociete.fr, qui concernent des personnes morales, ne sont pas soumises aux principes rappelés ci-dessus". They identify a legal person, not a human being, so the personal-data conditions above do not apply.

Two cautions. First, the identity and opt-out obligations in Article L34-5 apply to all prospecting e-mail, generic address or not. Second, a message to contact@ still lands in front of a human who can complain; the practical standard of relevance and restraint does not change.

For a manufacturer this creates a sensible ordering: start with the generic address the company publishes for enquiries, state your purpose, and let the company route you to the right person. Approach named individuals only when their role is clear, the message is about that role, and they were told when their address was collected that it could be used for prospecting.

The GDPR layer still applies

Article 6(1)(f) GDPR is the lawful basis CNIL points to. Keep a short written balancing note: why a supplier enquiry is within the reasonable expectations of a buyer at a distributor in your category. Article 21 GDPR gives the person an absolute right to object to direct marketing; CNIL's "en mesure de s'y opposer" is the same right. Log every objection and never contact that address again.

A named address copied from a company website or a public contract notice does not meet CNIL's condition, because the person was not told at collection that it could be used for prospecting; write to the generic address instead. Public availability is not consent.

What stays risky

• Buying lists of named French contacts without evidence of how they were informed. The information duty then falls on you and you cannot discharge it before sending.
• Sending in volume. CNIL's tolerance is built around relevance to the person; a mass campaign to every address in a sector looks like the consumer-style marketing that requires consent.
• Automated follow-up sequences that keep sending after a reply. One message, one polite follow-up, then stop, unless the company engages.
• Attachments and tracking links in a first message. Not unlawful in themselves, but they invite spam filters and complaints.

As of October 2026 we could not find a published CNIL sanction that turns specifically on a B2B supplier enquiry of the kind described here; the published enforcement we reviewed concerns consumer marketing and bought lists. CNIL has, however, fined the collection of professionals' contact details for prospecting: KASPR, which extracted LinkedIn users' contact details, was fined EUR 240,000 on 5 December 2024. Treat the absence of a supplier-enquiry case as an absence of evidence, not as a safe harbour.

Write it in French

Nothing in CNIL's rules requires French, but French law on the use of the French language expects commercial documents, product descriptions and instructions to be in French, and a buyer who receives an English cold e-mail from an unknown foreign supplier has an easy reason to ignore it. The country playbook for France covers language and documents in more detail. For the first message: French, formal register (vouvoiement), one concrete reason why this distributor, and a question that is easy to answer.

Cresques flags France as a market where a first e-mail is permitted under these conditions; Cresques drafts the first message in French with an English version and an opt-out, which you send from your own mailbox, and the market view gives you the evidence of who sells your category so that the relevance test is met before you write.

What this means for a manufacturer

• You can e-mail a French distributor you have never met. Use the published generic address; use a named address only where the role fits the message and the person was told at collection that it could be used for prospecting.
• Put four things in every message: who you are (legal name, address), where the address came from, what you are proposing in one sentence, and how to say stop.
• Keep the written legitimate-interest note and the log of sends and objections.
• Keep volume low and relevance high. The lawful basis is built on relevance to the person's job, and a scattergun campaign undermines it.
• Write in French.