Is cold email legal in France? B2B rules for 2026

Yes, with conditions. The CNIL, France's data protection authority, says you may email a named employee without prior consent if the message relates to their job and they are informed and able to object, and that generic addresses such as info@ fall outside the consent rule. The statute, Article L.34-5 of the Postal and Electronic Communications Code (CPCE), has no written B2B exception, so the opt-out rests on the CNIL's guidance. We found no guidance on sole traders or on LinkedIn messages.

Checked on 15 October 2026 against the law text and the regulator's guidance. This is not legal advice.

That makes France more open than Germany, where business recipients need consent too. For other countries, see cold email laws by country.

At a glance

What does L.34-5 say?

Article L.34-5 CPCE, in force since 26 July 2020, opens with the consent rule:

"Est interdite la prospection directe au moyen de système automatisé de communications électroniques au sens du 6° de l'article L. 32, d'un télécopieur ou de courriers électroniques utilisant les coordonnées d'une personne physique, abonné ou utilisateur, qui n'a pas exprimé préalablement son consentement à recevoir des prospections directes par ce moyen."

Our translation: "Direct marketing using an automated electronic communications system within the meaning of Article L. 32(6), a fax machine or electronic mail that uses the contact details of a natural person, subscriber or user, who has not given prior consent to receive direct marketing by this means, is prohibited."

The rule attaches to a natural person's contact details, which is why a company's generic address falls outside it. Another paragraph applies "dans tous les cas", in all cases: every marketing email must give valid contact details for stop requests.

What does the CNIL say?

The CNIL's guidance on email marketing, dated 10 June 2026, sets out the B2B rule (CNIL):

"La prospection à l'égard de professionnels peut être fondée sur l'intérêt légitime de l'organisme lorsque l'objet de la sollicitation est en rapport avec la profession de la personne démarchée (par exemple, un appel présentant les mérites d'un logiciel au directeur informatique d'une entreprise)."

Our translation: "Marketing to professionals can be based on the organisation's legitimate interest where the subject of the solicitation relates to the profession of the person contacted (for example, a call presenting the merits of software to a company's IT director)."

On generic addresses, the same page says: "Les adresses génériques de type info[@]nomsociete.fr, contact[@]nomsociete.fr ou commande[@]nomsociete.fr, qui concernent de personnes morales, ne sont pas soumises aux principes rappelés ci-dessus." Generic addresses of legal persons are not subject to those principles.

And every solicitation, B2B included, must show "l'identité de l'organisation qui l'émet", the sender's identity, and let the person refuse further messages "par un moyen simple", by a simple means.

Company, employee or sole trader?

France draws the line between legal and natural persons. Generic addresses belong to the company, a legal person, and fall outside the consent rule. For people:

• Named employees are natural persons, so the statute's consent rule applies on its face. The opt-out comes from the CNIL's guidance; we could not check the position of the DGCCRF, which also enforces the article. The conditions: the subject relates to the person's job, and the person is informed and can object simply and free of charge.
• Bought lists. Where data is "acquises auprès de tiers", acquired from third parties, the CNIL says you must make sure the person was informed of the possible marketing use and is able to object.
• Sole traders: no explicit guidance found. The CNIL's B2B rule speaks of "professionnels", while L.34-5 protects natural persons, so the position is unclear. Our reading: consent is the cautious choice.

Can you send LinkedIn messages to French prospects?

We found no CNIL guidance on whether a LinkedIn DM or InMail is "courrier électronique" under L.34-5. The closest decision concerns collecting data. On 5 December 2024 the CNIL fined KASPR, a B2B prospecting tool that collects contact details from LinkedIn, €240,000 (SAN-2024-020). It found that collecting details users had limited to their 1st and 2nd-degree connections went beyond what they could reasonably expect: showing details to one's contacts "ne revenait pas à autoriser KASPR à accéder à leurs coordonnées et à les collecter" (CNIL).

Our reading: visible on LinkedIn does not mean free to collect.

How does GDPR apply?

In France the B2B opt-out is itself built on GDPR: the CNIL grounds it in legitimate interest (Article 6(1)(f)). Its page on suppression lists, dated 10 June 2026, adds the rest (CNIL):

• "Les personnes ont un droit absolu de s'opposer, simplement et gratuitement, à la prospection", the right to object is absolute, simple and free.
• A suppression list ("liste repoussoir") keeps objections effective over time, including for data bought from a broker. The CNIL recommends keeping objection data for at least three years.

GDPR Article 14 also requires you to tell people where you got their data, at the latest in your first message (GDPR). The general method is in GDPR and B2B email under legitimate interest.

Sanctions

Breaches of L.34-5 carry administrative fines, imposed by the DGCCRF, the consumer and competition authority, of up to €75,000 for a natural person and €375,000 for a legal person. The CNIL enforces the article where a natural person's contact details are used.

We found no verified fine under L.34-5 for B2B email. The closest real case is KASPR (€240,000, 2024), for breaches including the lack of a legal basis, keeping data too long and failing to inform people.

Checklist: B2B email to France

1. Match the message to the person's job, the CNIL's condition for opt-out.
2. Identify your company and give a simple, free way to refuse in every email.
3. Inform people that their address may be used for marketing, where you got it and how to object, at the latest in the first email.
4. Check bought data: the person must have been informed and able to object.
5. Keep a suppression list and honour objections without asking why.
6. Document your legitimate-interest assessment.
7. Treat sole traders cautiously until there is guidance.

How Leo handles French leads

Revexa builds Leo, a buying-signal agent. Leo blocks only Germany automatically, so French leads are not blocked. In review mode, the default, you read and approve every draft before it is sent and decide yourself, including whether it relates to the person's job. Leo writes to each lead in their own language when your website exists in that language, so French leads get French if your site has French, and otherwise English.

Common questions

Is B2B cold email legal in France?

Yes, under the CNIL's guidance: to generic addresses such as info@, and to a named employee if the message relates to their job and they are informed and can object. Every email must identify you and offer an opt-out.

Do I need consent to email info@ addresses in France?

No. The CNIL says generic addresses of legal persons are not subject to the consent and objection principles. You must still identify yourself and give a valid address for stop requests.

Can I send LinkedIn messages to French prospects?

We found no CNIL guidance on LinkedIn DMs. The CNIL did fine KASPR €240,000 in 2024 for collecting LinkedIn contact details users had restricted.

What are the fines in France?

Under L.34-5, administrative fines of up to €75,000 for an individual and €375,000 for a company, imposed by the DGCCRF. The CNIL can also fine under GDPR.