What the CNIL says about B2B, and what it no longer says

by Francis Rozange | Sep 8, 2026 | Email Marketing

Abstract 3D render: two glass corridors branching from one entrance, one lit, one dark

A rule has circulated for twenty years in every B2B marketing course: a named address of the form firstname.lastname@company.com falls under an objection regime, a generic address of the form contact@company.com escapes the rules altogether, and independent professionals are treated as private individuals, therefore subject to prior consent.

We wanted to quote the French data protection authority on this. We could not find the sentence.

What the CNIL writes today, word for word

The reference page, updated on 10 June 2026, states the B2B rule this way:

“La prospection à l’égard de professionnels peut être fondée sur l’intérêt légitime de l’organisme lorsque l’objet de la sollicitation est en rapport avec la profession de la personne démarchée (par exemple, un appel présentant les mérites d’un logiciel au directeur informatique d’une entreprise).”

Marketing to professionals may rest on the organisation’s legitimate interest when the subject of the approach relates to the profession of the person contacted.

It adds a condition many omit: “Lorsque les données sont déjà en possession de la société ou acquises auprès de tiers, il faut s’assurer que la personne concernée a été informée de la possible utilisation de son adresse électronique pour de la prospection et est en mesure de s’y opposer.”

On generic addresses, the wording is clear: addresses of the form info@company.com, contact@company.com or orders@company.com, which relate to legal persons, are not subject to the principles set out above.

What the CNIL does not write, or no longer writes

We read in full the pages currently online: the page on commercial prospecting by electronic mail, the one on electronic communications to prospects and customers, and the answer in the CNIL Direct section.

The words “nominative” and “profession libérale” appear nowhere in them.

The widely taught distinction comes from an older CNIL communication, dating from the mid-2000s, which we did not find as such on any page online today. We do not claim it no longer exists: we observe that it is no longer stated in the current reference texts, and that a professional citing it as the position in force is citing a document they have probably not opened.

The current rule is both simpler and more demanding: what counts is not the form of the address, it is the relationship between the subject of the approach and the person’s profession. Backup software offered to an IT director falls within the framework. A ski holiday offered to the same IT director does not, whatever address is used.

Two regimes, and the border between them

The European foundation is the 2002 directive, whose Article 13(1) sets prior consent for marketing by electronic mail. The French transposition is Article L.34-5 of the postal and electronic communications code, which prohibits marketing using the contact details of a natural person who has not given prior consent to receiving direct marketing by that means.

That is the consumer regime: opt-in, except for the existing customer exception.

The professional regime rests on the legitimate interest provided by the GDPR, whose Recital 47 accepts that “the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest”.

Legitimate interest does not mean freedom. It requires a balancing test against the individual’s rights, prior information, and a simple, free way to object.

The right to object is absolute, and this is misunderstood

Article 21 of the GDPR sets out two different rights to object, and the nuance has practical consequences.

Under paragraph 1, objecting to processing based on legitimate interest must be justified “on grounds relating to his or her particular situation”, and the controller may refuse if it demonstrates compelling legitimate grounds.

Under paragraph 2, for direct marketing, there is no condition: “the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing”. And paragraph 3 is final: “the personal data shall no longer be processed for such purposes”.

An unsubscribe in marketing is not up for discussion, is not balanced against anything, and is not conditional on a stated reason. It is executed. And it is executed quickly, because the mailbox providers penalise within 48 hours where the law settles for a reasonable delay.

What is coming

On 22 January 2026, the CNIL opened a consultation with marketing players with a view to drafting a recommendation on proof of consent: varied collection methods, complex processing chains including data brokers.

No recommendation has been published to date. It is a work in progress, not an enforceable rule, and we flag it as such. But the subject of that work says quite a lot about where the authority is looking: not at the presence of a ticked box, but at the ability to prove, several links down the chain, where a consent came from.

What to do tomorrow morning

Take your professional prospecting file and ask it three questions.

Where does each address come from, with a date and a named source? If the answer is “it is a file”, you have no answer, and the obligation to inform those individuals falls on you.

Is the subject of your approach related to the profession of each recipient, individually? A file of executives across all sectors satisfies that condition only for part of its rows.

Is the ability to object offered with every send, simply and free of charge? An unsubscribe link that requires creating an account is neither simple nor free.

Those three questions are exactly the ones an inspection asks. Better to have dealt with them first. When the contact database itself documents the origin and reliability of each record, as Sestaro’s contact search does, the first question stops being a problem.

Sources

LaFactory works email on the evidence: headers, DNS records, rejection logs. No open rate promises, ever. Get in touch for a deliverability audit.