Andy Garcia · freelance dev
FRENES
Back to the blog
GDPR & Prospecting

France's CNIL Says Guessing a Prospect's Work Email Can Be Legal. The Catch Is What You Keep.

October 19, 2026 7 min read

On Friday, October 16, 2026, France's data protection authority, the CNIL, published two short pages on a practice many B2B sales teams use without naming it: "reconstituting" a work email address. You know a prospect's first name, last name and employer, you know the company builds its addresses as firstname.lastname, and you deduce the address, even if it was never published online. One page is written for organizations. The other is written for the people whose addresses get guessed.

The sentence that sets the tone, in my translation: the fact that the data used to reconstitute these addresses are accessible on the Internet "does not exempt organizations from complying with the applicable rules."

I prospect small businesses by email myself, so I read both pages with one practical question: what would a prospecting pipeline have to change to stay inside them? I also read the CNIL's general page on email prospecting, its 2024 recommendations for reusers of data published online, and a 2020 sanction in which guessed addresses were part of the facts.

This is a close reading, not legal advice.

What the CNIL allows

The answer starts with "in certain cases". An organization can reconstitute a work address on the basis of its legitimate interest, without asking for consent first, if two things hold. It must have a real and legitimate interest in contacting the person, for example to develop its business. And the practice must not cause disproportionate harm to the person's rights, which it has to assess case by case.

The CNIL treats reconstitution as a technical step. It is rarely an isolated operation: it serves a wider purpose identified from the start, such as a B2B prospecting campaign. When that main processing is clearly defined, the guessing can generally rest on the same legal basis. If your B2B prospecting relies on legitimate interest, the reconstitution can too.

Then comes the sentence that stops the shortcut. That rule "is neither automatic nor systematic."

The three criteria

The CNIL recommends weighing three things.

The purpose, and how intrusive the guessing is. B2B prospecting, professional communication and institutional exchanges are the examples given.

The visibility of the data, and the control the person keeps over it. This is the part I would print. The CNIL distinguishes two situations. People with no identifiable online presence, no professional network profile, no institutional page: that absence "can be a strong indication" that they did not want to be easy to reach. And people who took steps to restrict access to their data: stronger privacy settings, restricted information, the "use of contact forms rather than a direct address." People in either group "cannot, a priori, reasonably expect" their address to be reconstituted.

The safeguards. The CNIL gives two examples. Strictly limit retention: the organization "could keep the email address only if an effective first contact is established with the person within a reasonable time." And make any objection trigger the immediate exclusion of that person's data from all further reconstitution, with no justification required, even when the data serve purposes other than prospecting. For prospecting, the GDPR already provides that right.

The two pages differ slightly on the people who hid. The individuals' page says that for them, reconstitution "would only be possible" with safeguards in place. The organizations' page says that if the conditions cannot be met, the organization must refrain, unless it can obtain the person's consent.

The individuals' page also sets the duty that shapes the first email. Organizations must inform people "as soon as possible and clearly", including the purpose, and "explain how your address was obtained." After an objection, they must stop using the reconstituted address and delete it from any contact database. If a rights request gets no answer within one month, the person can file a complaint with the CNIL.

The email rule underneath

Guessing is one question. Sending is another. The statute, Article L. 34-5 of the French postal and electronic communications code, bans email prospecting that uses the contact details of a natural person who has not consented first.

The CNIL's page on email prospecting, dated June 10, 2026, sets out its position for professionals. Prospecting them can rest on legitimate interest "when the subject of the solicitation relates to the profession" of the person. Its example: a pitch for software to a company's IT director. Every message must identify the sender and offer a simple way to refuse further messages. Generic addresses such as info@ or contact@, which concern legal entities, are not subject to these principles.

The 2024 recommendations for reusers of online data add a deadline. Information comes as early as possible, at the latest at the first contact, and in any case within one month of collection. The source belongs in that information, down to the names of the websites when several were used. And they give a contrast worth keeping in mind: data protection officers, whose contact details the CNIL publishes as open data, can more easily expect a pitch from a cybersecurity training company than lawyers listed in the national bar council's online directory can expect one from a cosmetics company.

A 2020 case where it went wrong

The CNIL has already seen this pattern in a sanction. In decision SAN-2020-018 of December 8, 2020, its restricted committee fined a meal delivery company 20,000 euros. The company built its prospect file from a professional social network: one supplier listed names and employers, a second one added the professional email addresses. Some complainants told the CNIL that the company had said it reconstituted their address from their employer's email format. According to the decision, 635,033 prospects had received prospecting emails since 2017.

The company argued legitimate interest: business lunches, a work address, delivery to the office, during working hours. The committee disagreed. Messages selling meals at people's workplace had "little connection with the professional activity of the prospects," so prior consent was required. The company also answered one access request more than five months late, without naming the source of the data. The committee says it set the amount in light of the financial consequences of Covid-19 for the company.

The guessing was not the breach in itself. The use was. That is exactly how the October pages frame it: the legal basis of the guess follows the purpose.

What the pages do not say

Neither page puts a number on what a pipeline needs: no "reasonable time" for the first contact, no retention period, no fine. The only deadline in them is the month after which a person whose request went unanswered can complain. The criteria are recommendations, applied case by case, so no checklist makes a campaign safe on its own. The pages do not name tools or discuss email verification. And they say nothing specific about a one-person business, where the "generic" address may be the owner's own.

What I would do before the next campaign

Write the balance test down, one page per campaign: who, why, why the message relates to their job, where the names come from. If someone asks, that page is the answer.

Prefer what is published. If the company publishes a generic address, or the person publishes their own, use it before guessing anything.

Exclude the people who hid. No identifiable presence online, or a contact form instead of an address: skip them, or find another route.

Store provenance with every guessed address: source page, pattern used, date. The individuals' page says people must be told how their address was obtained. When a complainant asked, the 2020 company did not give the source.

Give guessed addresses an expiry. If no first contact happens within a period you choose and write down, delete them. The CNIL gives no number, so pick one you can defend.

Keep the suppression list upstream. An objection should block the next guess, not only the next email, so the check belongs before the guesser, keyed on the person rather than on one address.

Make the first email do the paperwork: who you are, why their job is the reason, how you got the address, and a simple way to say no.

And answer rights requests within the month.

If you build an enrichment tool, none of this is a legal chore. It is product: a time-to-live on every guessed address, a provenance column, a suppression check that runs before the pattern engine. On October 16, the CNIL told your customers what to ask for.

Sources

A project like this one?

I design and deploy products like this. Let's talk.

Let's talk