CNIL sets limits on guessing work emails for outreach
In brief
According to the CNIL, reconstructing a professional email is not prohibited, but the GDPR applies. Legitimate interest is valid only if the organisation has a genuine reason to contact the person, such as developing its business, and the impact on rights is not disproportionate. Prospecting rules still apply, including notice and the right to object, even when AI tools guess the address.
What it changes for an SME
For an SME with 10 to 250 employees, B2B email outreach and AI tools to find contacts remain possible. The main change is risk and compliance: reconstructing an address without a genuine interest, or for someone with little online visibility, may breach the GDPR. It can also take more time, because those points need to be checked before you write. According to the CNIL, you must inform the recipient, offer a way to object, keep a reconstructed address only for a reasonable period after a first exchange, and stop all outreach if they refuse.
What you can do
- Check that you have a genuine interest in contacting each person and whether they have limited their online visibility.
- Inform the recipient in the first message and give them an easy way to object.
- Keep reconstructed addresses only for a reasonable period after a first exchange, and stop all prospecting if they object.
Let's talk about the time you could save.
In 20 minutes, we find where AI could save you time or money. Free, no commitment.