B2B cold emailing: legal framework and best practices

In brief: in France, prospecting a professional by email without their prior consent remains permitted. Under three cumulative conditions: a named business email address, a message related to the recipient’s role, and a simple, free way to opt out in every send.

Cold emailing is not marketing emailing

A cold email goes to someone who asked for nothing. No form filled in, no white paper downloaded, no prior business relationship. You have identified a professional whose position matches your target, and you write to them. That is the whole difference from a newsletter sent to an opt-in database, where the recipient has explicitly agreed to receive your messages.

This difference is not cosmetic. It changes the legal basis of the processing, the way you must inform people, and the precautions to take on the deliverability side. Many sales teams apply the reflexes of the newsletter to cold email. That is where the trouble starts.

Cold emailing is an integral part of B2B email prospecting techniques, but it follows rules of its own. Better to know them before sending the first message.

What French law really allows

The reference text is article L34-5 of the French Postal and Electronic Communications Code (Code des postes et des communications électroniques). It lays down a simple principle: direct prospecting by electronic mail to a natural person who has not given prior consent is prohibited. This is the opt-in regime, the one that applies to the general public.

But the CNIL, the French data protection authority, allows a distinct regime for prospecting between professionals. Its practical guide on commercial prospecting by electronic mail, updated in June 2026, describes an objection regime, often called opt-out, valid if three conditions are met at the same time:

• the targeted address is a business address, of the prenom.nom@entreprise.fr type;
• the person was informed, at the time of collection, that they can object freely and simply to the commercial use of their contact details;
• the purpose of the solicitation is related to the role held by the recipient.

This third condition is the one most often forgotten. Offering an emailing platform to a marketing director, that works. Offering her home insurance, no. The link with the role is not a drafting formality, it is the very justification for the send.

On the GDPR side, the legal basis relied on is legitimate interest, provided for in article 6.1.f. The EDPB’s Guidelines 1/2024 detail the analysis grid: a real and lawful interest, the necessity of the processing to achieve that interest, and a balancing against the rights of individuals. Document this reasoning somewhere. A page in your record of processing activities is enough, but it must exist before the inspection, not after.

The limits nobody should cross

The most slippery boundary concerns the type of address. A freelancer working with a personal Gmail address remains a natural person acting under their private identity. The benefit of the doubt goes to the account holder: treat these addresses as opt-in. Conversely, generic addresses such as contact@ or info@ target no identified natural person, which takes them outside the scope of data protection. Be careful all the same, they often land in shared inboxes and generate complaints.

Second limit, the origin of the data. Mass-extracting LinkedIn profiles to reconstruct business addresses, buying a file that nobody can tell you how it was built, these are practices that expose you directly. In December 2024, the CNIL fined a data broker 240,000 euros for exploiting business contact details collected without a valid legal basis. The supplier of the file was not the only one concerned by the problem.

Third limit, handling objections. A recipient who unsubscribes must leave your sequences immediately, not at the next export. Re-enrolling them six months later via another tool is exactly the kind of manoeuvre that turns an isolated complaint into a formal report.

What the CNIL actually sanctions

The figures from the CNIL’s 2025 report give the measure of the subject: 83 sanctions issued for a cumulative amount of 486,839,500 euros, including ten decisions specifically concerning commercial prospecting via the simplified procedure. The subject is no longer theoretical.

Two decisions of 15 May 2025 are worth a look. The company Solocal Marketing Services was fined 900,000 euros, notably for having been unable to demonstrate valid consent concerning more than 1.2 million people, with poorly designed partner forms. The same day, the company Caloga was fined 80,000 euros on similar grounds, consent collected via misleading forms and prospect databases not purged.

What emerges from these decisions is less the amount than the recurring ground. It is not the sending itself that is the problem, it is the inability to prove how the data got into the database. Traceability is worth more than the best privacy policy. We detail the general obligations of GDPR compliance in emailing in a dedicated article.

Your sending infrastructure is part of compliance

This is the angle that legal guides systematically leave aside. Since 2024, Gmail and Yahoo have imposed precise requirements on senders exceeding around 5,000 messages a day to their users: SPF, DKIM and DMARC authentication with domain alignment, one-click unsubscribe, and above all a spam complaint rate kept below 0.3%, with Google recommending aiming below 0.1%.

A prospector who multiplies domains and sending accounts to get around these thresholds thinks they are gaining volume. They lose reputation, and the penalty is immediate: their messages no longer reach anyone. The real cost of non-compliance is rarely measured in fines. It is measured in lost deliverability, and that loss is slow to repair.

Another point deserves attention. Most popular cold emailing tools host their data outside the European Union, which raises the question of international transfers. Routing from a French infrastructure with dedicated IPs means dealing with two issues at once: data location and control of your sender reputation, which no longer depends on the behaviour of unknown senders sharing the same IP. That is the approach taken by the Ediware B2B prospecting solution, with data hosted in France and dedicated IPs included from the entry-level plan.

One last technical detail, the open-tracking pixel. The CNIL has clarified its doctrine on the subject, and open tracking in cold prospecting falls under the same consent issue as other trackers. Many senders now disable it, for reasons that have as much to do with compliance as with deliverability.

Structuring a sequence that holds up

A compliant cold emailing sequence rests on a few common-sense principles, applied with discipline.

Target narrowly. A list of 200 contacts genuinely concerned by your offer will produce more than a send to 5,000 vaguely qualified addresses, and will spare you half the complaints. The link with the role held is not just a legal requirement, it is also what drives performance.

Personalise beyond the first name. A reference to the company’s context, to a public project, to an identifiable signal. That is what distinguishes a message sent to someone from a message sent to a list.

Limit follow-ups to three messages at most, spaced four to seven days apart, and stop everything at the first reply as at the first objection. Each message must carry your full identity and a clear means of refusal. Ramp up volume gradually on a recent domain, sender reputation is built over several weeks.

Measuring a cold campaign without fooling yourself

The open rate has lost much of its value in cold emailing. Between Apple’s privacy protection and the disabling of the pixel, the figures reported are at best indicative. The metric that counts is the reply rate.

And you have to look at it without complacency. The agency Belkins published an analysis covering more than 7.5 million prospecting emails sent in 2025: the unique reply rate observed stands at 0.45%, calculated on the total emails sent and not on opens alone. A change of method the agency embraces as more honest. The double-digit rates found in promotional articles almost always rest on a different calculation basis.

Also track the number of objections and the processing time. These are the indicators an inspector will look at first, and they will tell you a lot about the relevance of your targeting.

Frequently asked questions about B2B cold emailing

Is cold email legal in France?

Yes, in B2B. The CNIL allows an objection regime for prospecting between professionals: you can write without prior consent if the address is a named business address, if the message concerns the role held by the recipient, and if every send offers a simple, free means of refusal.

Do you need an unsubscribe link in a cold email?

Yes, systematically. The right to object must be exercisable freely and simply in every message. A working unsubscribe link remains the safest method. A monitored reply address can be acceptable, provided requests are actually processed.

Can you prospect a contact@ or info@ address?

These generic addresses do not designate an identified natural person and therefore fall outside the scope of personal data protection. In practice, they often land in poorly monitored shared inboxes, with a low yield and a high risk of complaints.

Can you use data from LinkedIn?

Consulting a profile to qualify a prospect poses no difficulty. Mass-extracting profiles to reconstruct email addresses does. In 2024, the CNIL fined a data broker for collecting business contact details without a valid legal basis.

How long should you keep a prospect’s data?

The CNIL uses a reference period of three years from the last contact with the prospect. After this period without a reaction, the data must be deleted or anonymised. An objection, on the other hand, is kept on a suppression list with no time limit.

How many prospecting emails per day?

No text sets a legal ceiling. The constraint comes from the mailbox providers: beyond around 5,000 daily messages to Gmail, the authentication and complaint rate requirements tighten. On a recent domain, start low and ramp up gradually.