What are the CNIL rules for sales prospecting?

The short answer depends on your target: in B2C (consumers), the opt-in principle (prior consent) is mandatory, while in B2B (professionals) the opt-out rule (right to object) applies, which gives you more flexibility. In every case, the sender must be clearly identified and offer a simple way to unsubscribe, in any sales prospecting approach.

1. B2C prospecting (consumers): prior consent rules

When you address consumers, personal data protection is at its highest. The golden rule set by the CNIL is to obtain the person's explicit, free and informed consent before any electronic marketing message.

Rules for email and SMS

You may never prospect a consumer electronically unless they have ticked a box expressly agreeing to receive your offers (the opt-in principle). There is one strict exception: if the person is already your customer, you may send them messages offering products or services similar to those they have already bought.

Rules for phone and postal mail

For phone and postal prospecting, prior consent is not mandatory. However, you must inform the person of their right to object to prospecting at the very moment you collect their data.

Good to know

Since 2016, French consumers can sign up for the "Bloctel" do-not-call list. In B2C phone prospecting, you are legally required to screen your call lists against Bloctel and remove registered numbers before launching your campaigns, or face heavy penalties.

2. B2B prospecting (professionals): the flexibility of opt-out

Business-to-business (B2B) prospecting benefits from a much more flexible regulatory framework. The CNIL considers prospecting to be a normal part of business life. Prior consent is therefore not required: this is the opt-out principle.

The strict conditions of B2B opt-out

Although more flexible, this approach comes with two major conditions to stay within the law. First, what you are offering must be directly related to the professional activity of the person you contact (for example, offering accounting software to a chartered accountant). Second, the professional must be informed, when their address is collected, that it will be used for prospecting and that they can object.

The special status of generic addresses

So-called "generic" business email addresses (such as contact@entreprise.com or info@societe.fr) are not subject to CNIL rules, because they are not considered personal data. You can prospect them freely, while keeping respectful practices so that your domain doesn't end up flagged as spam, particularly in a B2B prospecting strategy.

3. Obligations that apply to all prospecting

Whether you target consumers or professionals, the CNIL and the GDPR impose a common set of non-negotiable obligations to ensure the rights of the people you contact are respected.

‍

• Clear sender identity: The identity of the company on whose behalf the prospecting is carried out must be clearly stated. It is strictly forbidden to hide your identity or use fake sender names or misleading email addresses.
• A simple, immediate right to object: Every message (email or SMS) must include a visible unsubscribe link or a very simple way to opt out of future messages (such as "STOP SMS"). The unsubscribe request must take effect immediately.

4. Collecting and buying databases: what does the law say?

Building your database is the first step of prospecting, and the CNIL watches it particularly closely. Whether you collect data on your own website or use external providers, traceability is essential.

‍

How can you buy a customer file legally?

‍

Buying or renting prospecting files is legal, but you remain responsible for how the data is used. You must make sure, contractually, that the seller collected the data in strict compliance with the GDPR. For B2C prospecting, you need a guarantee that prospects explicitly agreed to their data being shared with "partners" for marketing offers, which avoids the risks associated with buying an email database.

‍

How do you prove consent under CNIL rules?

‍

In the event of a CNIL inspection, the burden of proof always lies with the advertiser. You must be able to show when, on which medium and how the prospect gave their consent. This means keeping logs that include the sign-up timestamp, the user's IP address and, ideally, a screenshot of the submitted form.

5. Managing data over time, and penalties

The GDPR forbids keeping personal data indefinitely. Good management of your prospecting lists means cleaning your databases regularly to remove inactive contacts, notably as part of sound sales team management.

‍

How long can you keep a prospect's data?

‍

According to CNIL recommendations, the data of a prospect who is not a customer can be kept for a maximum of 3 years from collection or from the last contact initiated by them (a click on a link, a quote request). For an active customer, prospecting data can be kept for up to 3 years after the end of the business relationship.

‍

To make things clearer, here is a table setting out the legal retention periods:

What fine can the CNIL impose for non-compliance?

Breaking the rules of sales prospecting is very costly. Under the GDPR, CNIL administrative fines can reach 20 million euros or up to 4% of the company's worldwide annual revenue. The CNIL can also issue public formal notices that seriously damage the offending company's brand image.

Is B2B cold emailing legal?

Cold emailing is perfectly legal in France, provided you scrupulously follow CNIL guidelines. In B2B, it is allowed without prior consent (opt-out), as long as the offer is relevant to the targeted professional's role. In B2C, on the other hand, cold emailing is strictly forbidden without explicit prior agreement (opt-in), even within a cold email strategy.

Summary: key rules by prospecting channel

To avoid mistakes when launching your next marketing campaigns, here is a definitive summary table of the rules set by the CNIL depending on the channel used and the target audience: