Guessing a prospect's work email is legal in France if they could reasonably expect it

A sales rep exports 400 heads of IT at French companies from Hunter, and a third of the addresses come back marked "Inferred": with no public source for those people, the tool built jane.doe@ from "public patterns at that domain". On 16 October 2026, France's data protection regulator, the CNIL, said when a company may guess addresses like these. It may do so without asking first, under the GDPR's "legitimate interest" basis, if the person could reasonably expect it 1. Among those who by default could not, it names people with no visible professional presence online and people who have hidden their contact details. And each person must be told how the company got their address 2.

In my reading, that last duty applies to the company sending the email as well as to the tool it bought the address from. Under the GDPR, a company that gets someone's data from somewhere other than the person must say where it came from by the first email, and at the latest within one month 5. Addresses imported in August for a sequence that starts in October are already late. On the tool side, the same regulator fined KASPR, a seller of a contact-finding browser extension, €240,000 in 2024 after many complaints from people its customers had contacted 4.

What did the CNIL say about guessing work email addresses?

The CNIL calls the practice "reconstitution": deducing a work address from information found online, usually a name, an employer and the employer's address format 1. That the information is findable online does not take it outside the GDPR. The CNIL accepts a company's interest in growing its business as a legitimate interest, the legal basis for using personal data without asking when the use is needed and the person's rights do not outweigh it 5.

Whether the guess is allowed also depends on whether the email is. For professionals, the CNIL's prospecting page says a company may send a sales email without prior consent when the subject relates to the recipient's job (its example is pitching software to a company's head of IT), provided the person was informed and is able to object 3. Sales emails to private individuals need prior consent. For someone whose address was guessed, the first email is the earliest point at which they can be informed.

Whose work address should a company not guess?

The CNIL's test is whether the person could reasonably expect their address to be reconstructed, judged from how visible they made themselves online 1. It names two groups who, by default, could not:

• People with no identifiable online presence. No profile on a professional network, no listing on an employer's site. The CNIL says this absence can be a strong sign that the person did not want to be easy to reach.
• People who took steps to restrict access. Stricter privacy settings, information visible only to some, a contact form in place of a published address.

For these people, the CNIL says guessing would only be possible if the company puts safeguards in place to protect their rights 2, and a company unable to meet the conditions must not guess at all unless it gets consent 1. My advice for a sales team is to leave both groups out of the list: guessing them is allowed only on terms that are hard to prove you met.

The second group is where the CNIL has already enforced. KASPR's extension shows the contact details of LinkedIn profiles a user visits, and its fine came in December 2024 4. Part of the fine was for collecting the details of LinkedIn members who had limited the visibility of their contact information to their first and second-degree connections. The CNIL found that this choice did not authorise KASPR to take the data, and ordered it to stop collecting it and delete what it had.

Where the line falls for an ordinary profile is not settled. The CNIL has not said that a public LinkedIn profile showing a name, a job title and an employer counts as hidden; KASPR's case concerned contact details people had chosen to restrict. A setting the person never touched is arguably not one of the "concrete steps" the CNIL describes, but whether a profile that shows no email address counts as restricted is open. I would treat a profile showing name, job and employer as visible, and leave out anyone who has none.

What safeguards does the CNIL expect?

The guidance gives two examples of safeguards that can help tip the balance in the company's favour 1. A company may use others, but these show what the CNIL has in mind:

• Keep a guessed address only if contact follows. The company could keep the address only where a first real contact with the person happens within a reasonable time. The CNIL does not define "reasonable".
• An objection stops all future guessing. When someone objects, their data is excluded at once from any later reconstruction, and they do not have to give a reason.

I read the second safeguard as applying to the person, whatever address a tool returns. My recommendation: when someone objects, delete the address, and add to the suppression list a hash of two things written in a standard form (lower case, no accents): their name and the profile URL you found them through. Then check each new prospect against that list before they go into the email finder, so the guess never happens. The address alone does not work as the key, because an email finder can return a different spelling for the same person later (jane.doe@ one quarter, jdoe@ the next). The employer does not work either, because it changes when they change jobs.

The CNIL's guidance on suppression lists recommends keeping an objection for at least three years with only the data needed to honour it, offers hashing as a way to avoid keeping a list of names, and notes that hashed data is still personal data that must be secured 7. It also says an objector's address must be deleted from the contact base 2.

What must the first email say?

The first email starts the information duty the GDPR sets when a company did not get personal data from the person directly. Article 14 of the GDPR lists what the person must be told, including who the company is and how to reach it, why it uses the data and on what legal basis (including which legitimate interest), who receives it, how long it is kept, the person's rights (including the right to complain to a regulator), and "from which source the personal data originate" 5.

The timing has two limits, and the earlier one wins. Where the data is used to contact the person, the information is due "at the latest at the time of the first communication". In any case it is due "at the latest within one month" of obtaining the data. A guessed address that sits in a CRM for two months before the first email has already missed the deadline. Article 21 adds that the right to object to direct marketing must be "explicitly brought to the attention" of the person at that first contact, "clearly and separately from any other information", and once someone objects, the company must stop using their data for marketing.

The full list does not fit in an email footer. In my view, the workable shape is a short footer (who you are, how you got the address, a one-click way to object) that links to a privacy policy covering the rest.

The KASPR decision shows what falls short 4:

• Late notice. KASPR only began informing people in 2022, about four years after the extension launched.
• The wrong language. Its notice was an email in English with an opt-out link. The CNIL found that it was neither transparent nor understandable, and ordered KASPR to inform people in a language they understand.
• A vague source. In a separate breach, of the right of access, people who asked where their data came from were told "publicly accessible sources". The CNIL found that inadequate because KASPR knew some of its sources and even listed them in its privacy policy.

Does this apply outside France?

The guidance is the CNIL's reading of the GDPR, and it binds no other regulator. People in France can complain to the CNIL about any company that emails them (Article 77). Where the company's main EU establishment is in another member state, that state's regulator usually leads the case and the CNIL takes part (Article 56) 5. In KASPR's case the CNIL was itself the lead regulator: the EDPB's record of the decision lists France as lead and all EU regulators as concerned. For a seller with no establishment in the EU, the GDPR applies if it offers goods or services to people in the EU or monitors their behaviour there (Article 3(2)), for example by tracking email opens. This post does not settle that question for any particular company.

I would expect other regulators to weigh the same factors, because the test comes from the GDPR itself, but I have not seen equivalent guidance on guessed addresses from another regulator.

The sales-email layer is national, and it varies more. In France a relevant B2B email can go out without prior consent 3. Germany's Act against Unfair Competition (UWG) treats advertising by email without the addressee's prior express consent as unreasonable harassment, with no carve-out for work addresses 6. Its only exception covers a company's existing customers and similar products, which a cold prospect is not. The French permission does not help in Germany: there you need the person's consent to send the email at all, however you found the address.

If you send cold email to prospects in Europe, what should you change?

If your team prospects people in France with addresses from an email finder, or guessed by hand, these are the changes I would make. The risk of skipping them is a complaint to the CNIL: KASPR's case followed many complaints from people who had been contacted by its customers 4.

1. Filter the list before the first send. Drop anyone with no visible professional profile, and anyone whose profile hides their contact details. If your tool marks addresses as inferred, those are the ones to check.
2. Contact within a month, or delete. Send the first email within one month of adding a guessed address, or delete it, and write that rule down.
3. Suppress by person. Delete an objector's address, keep a hash of their name and profile URL on the suppression list, and check each new prospect against it before they go into the email finder.
4. Rewrite the first email's footer. Say who you are, that you found the address by combining their name with their company's address format (and which tool, if one was used), and give a one-click way to object, set apart from the pitch. Link to your privacy policy for the rest. Write the footer in a language the person understands, which the CNIL ordered KASPR to do; if you pitch French prospects in English, I would add the footer in French as well. Our post on unsubscribes covers making that opt-out stop email from every tool you send from.
5. Keep Germany separate. For prospects there, email only people who have consented through something they did themselves, such as signing up on your site or asking for a demo.
6. Add prospects to your privacy policy. Give the people you contact for sales their own section, covering everything Article 14 of the GDPR requires, which includes more than the items listed above (for example, the categories of data and any transfers outside the EU). A privacy policy written for customers and website visitors will usually not mention them.