Legitimate interest in B2B: prospecting without explicit consent

In brief: In B2B, prospecting by email without prior consent is possible. Not because the GDPR does not apply, but because another legal basis takes over: legitimate interest. You still have to meet its conditions and know how to document them.

“No consent” does not mean “no legal basis”

This is the most widespread confusion in B2B marketing teams. They were told that in B2B, opt-in was not mandatory, and many concluded that professional prospecting took place in some kind of GDPR free zone. The mistake is understandable. It remains costly on the day of an inspection.

The regulation lays down a rule without exception: any processing of personal data must rest on one of the six legal bases listed in its article 6. A personal professional address, of the firstname.lastname@company.com type, identifies a natural person. It is therefore personal data, and the GDPR applies in full.

Consent is only the first of the six. In B2B prospecting, it is the last one that takes over. So you are not dispensing with a legal basis, you are changing it. And that switch comes with obligations of its own.

What French law really says about professional prospecting

One nuance deserves to be stated at the outset, because it is almost always glossed over. Article L.34-5 of the Code des postes et des communications électroniques (the French Postal and Electronic Communications Code), the one everyone cites, does not mention B2B. It prohibits “direct marketing by means of an automated calling system, a fax machine or electronic mail using […] the contact details of a natural person who has not given prior consent to receiving direct marketing by that means”.

The text targets natural persons. The distinction between professional prospecting and prospecting of private individuals comes from the doctrine of the CNIL, the French data protection authority, which accepts legitimate interest as a legal basis provided the solicitation relates to the recipient’s position.

Two situations therefore coexist, with different regimes.

Generic address or personal address

An address of the contact@company.com or info@company.com type is attached to a legal entity. It identifies no one in particular. The CNIL considers that it falls outside the protective regime for natural persons.

A personal address, conversely, identifies an individual. The GDPR applies, with all its obligations of information, documentation and respect for the right to object. The practical difficulty is that B2B prospecting databases cheerfully mix the two. Segmenting on this criterion at import time avoids a lot of approximation later, and it concretely changes how you document the campaign.

One particular case comes up often: the head of a very small business or the freelancer who uses a personal address with a consumer provider for their business. The attachment to a legal entity becomes debatable. Caution: the consent regime may apply.

The conditions set by the CNIL

The CNIL is explicit on the page it devotes to commercial prospecting by email: prospecting professionals is permitted “where the subject of the solicitation relates to the profession of the person being solicited”.

That sentence carries everything. It means that an accounting software vendor may solicit a chief financial officer, but has no business in that same CFO’s inbox selling them a skiing holiday. The criterion is not the nature of the address, it is the relevance of the message to the position held.

Three obligations are added, which tolerate no approximation:

• Informing the person. They must know that their data is being used for prospecting purposes. When the data comes from a third party, the CNIL asks you to make sure the person has indeed been informed of this possible use, and article 14 of the GDPR requires informing them at the latest at the first contact.
• The right to object. Article 21 of the GDPR is blunt: “Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing.” No reason to give, no cooling-off period. The unsubscribe link must be simple and free.
• Identification of the sender. Each message must make it possible to know immediately who is writing and on whose behalf.

Nothing insurmountable. But these three points are exactly the ones missing from improvised prospecting campaigns.

Legitimate interest or consent: how to decide

Still in doubt? Consent always remains the safest basis. It costs in volume what it brings in peace of mind. That is where the real trade-off lies, and it is as much commercial as legal.

As for purchased or rented files, they are not unlawful by nature. Contrary to a persistent belief, buying a file does not invalidate legitimate interest. On the other hand, you become a fully-fledged controller. Demand from the supplier the origin of the data, proof that the people were informed of the transfer for prospecting purposes, and the date of collection. Without these elements, you will be unable to demonstrate anything in the event of a complaint. This point ties in directly with the rules applicable to compliant B2B cold emailing.

The balancing test, step by step

Legitimate interest is not declaratory. It has to be demonstrated. The CNIL describes a three-step method:

1. “Identification of the ’legitimate’ nature of the interest pursued by the controller and verification of the ’necessary’ nature of the processing”
2. “Assessment of the impact on the interests, rights and freedoms of the persons concerned, taking into account their reasonable expectations”
3. “Balancing of these elements and, where appropriate, provision for additional measures”

The CNIL specifies that the interest pursued must be manifestly lawful, determined in a sufficiently clear and precise way, and real and present for the organisation, not fictitious. It adds a formula that sums up the spirit of the test better than any commentary: the processing must not surprise the persons whose data is processed. A CFO who receives an offer for accounting software is not surprised. That is exactly the meaning of the condition set by the CNIL on the relationship with the profession.

One question long remained debated: can a purely commercial interest be “legitimate”? The Court of Justice of the European Union answered it on 4 October 2024 in case C-621/22, which pitted the Dutch tennis federation against the country’s data protection authority. Answer: yes. A commercial interest can ground processing under article 6.1.f. In the same movement, the Court recalls that the necessity of the processing must be examined strictly, and that an available less intrusive means brings the argument down.

The European Data Protection Board also adopted in October 2024 guidelines devoted to this legal basis, submitted to public consultation until 20 November of the same year. They follow the same three-step logic and explicitly cite direct marketing among the typical use cases.

What a documented analysis looks like

Everyone repeats that the balancing test must be documented. Almost no one shows what it looks like. Here is a one-page outline, sufficient for a standard B2B prospecting campaign, to keep alongside your record of processing activities.

There is nothing bureaucratic about this outline when it is filled in seriously. It forces you to formulate the targeting, which often improves the campaign itself. And the day a complaint arrives, it turns a defensive discussion into a demonstration.

On the retention period, one benchmark circulates widely in practice: three years after the last contact. To our knowledge, no text imposes it as such for B2B prospecting, but it is an established good practice, and a prospecting database that is never purged poses a deliverability problem anyway before it poses a legal one. A point we detail in our guide on data protection in emailing.

Legitimate interest covers the send, not the measurement

This is the point that almost no content on the subject addresses, and yet it creates real nasty surprises.

Legitimate interest allows you to send the message. It does not allow you to track opens individually. The tracking pixel placed in an email falls under the tracker regime, the one for cookies, and it presupposes prior consent. The CNIL recalled this in its recommendation on tracking pixels, with a compliance deadline set for July 2026.

Two processing operations, two distinct regimes. You may perfectly well prospect a CFO on the basis of legitimate interest while having no right to measure the opening of their message without their agreement. The subject is technical and deserves to be treated on its own: we have devoted a dedicated article to it on consent to the tracking pixel.

This question of the legal basis more broadly ties in with that of the hosting and processing of your contacts’ data. At Ediware, data is hosted in France, which considerably simplifies the demonstration of GDPR compliance expected in the event of an inspection.

Frequently asked questions

Can you prospect by email in B2B without prior consent?

Yes, provided you rely on legitimate interest and meet its conditions. The subject of the message must relate to the recipient’s profession, the person must be informed of the use of their data and be able to object simply and free of charge at any time.

Does legitimate interest exempt you from every GDPR obligation?

No. It is a legal basis on the same footing as consent, not an exemption. It requires informing the persons, documenting the balancing test, entering the processing in the register and handling objections without delay.

Is a contact@company.com address personal data?

No, a generic address attached to a legal entity identifies no natural person in particular. The CNIL considers that it falls outside the protective regime for natural persons. A personal address of the firstname.lastname@company.com type, on the other hand, remains personal data.

Can you use a purchased prospecting file?

Yes, the purchase does not make the processing unlawful in itself. You must however be able to demonstrate the origin of the data, prove that the persons were informed of its transfer for prospecting purposes, and provide the information and the right to object yourself.

What exactly needs to be documented?

The purpose pursued, the interest invoked, the data processed and its origin, the necessity of the processing, the reasonable expectations of the persons, the potential harm and the measures that limit it. One page is enough, to be reviewed at each change of targeting.

Is a commercial interest a valid legitimate interest?

Yes. The Court of Justice of the European Union confirmed it on 4 October 2024 in case C-621/22. A purely commercial interest can ground processing, provided that the processing is genuinely necessary and that the rights of the persons do not prevail.

Is open tracking covered by legitimate interest?

No. Sending the message and measuring its opening are two distinct processing operations. The tracking pixel falls under the tracker regime and presupposes prior consent, regardless of the legal basis chosen for the prospecting itself.