In a guidance document published on 16 October 2026, the French data protection authority (CNIL) set out the conditions under which a company may infer a professional email address from publicly available online information. Businesses that use this method for outreach must now document their analysis, review their transparency practices, and verify how they handle objections.
A reconstructed business address is still personal data
Reconstruction involves deducing an email address from a person’s first name, surname, employer, and the format used by the company, for example firstname.surname@company.fr. The address does not need to have been published anywhere for data protection rules to apply.
The CNIL makes clear that the mere fact that the underlying information is accessible online does not make it freely available for reuse. Reconstruction must comply with the GDPR, and where the resulting address is used to send marketing messages, the specific rules on electronic direct marketing apply as well.
After years of case-by-case enforcement, the authority is taking a further step by providing businesses with a structured assessment framework that enables them to evaluate the lawfulness of their practices on their own.
Legitimate interest requires a concrete balancing exercise
The CNIL accepts that reconstruction may, in certain circumstances, be based on a legitimate interest, provided the company can demonstrate a genuine reason for contacting the individual, such as developing its business or facilitating professional exchanges.
This legal basis does not, however, create an automatic right. It requires a case-by-case assessment: the purpose pursued, the intrusiveness of the approach, the visibility of the data used, and the reasonable expectations of the individual concerned.
In its analysis, the authority places particular weight on the extent to which the individual exercises control over their own data. The absence of an identifiable online presence, reinforced privacy settings, or the use of a contact form rather than a direct email address may all indicate a deliberate wish to limit accessibility. In such cases, the company cannot assume that the person expected to be contacted.
Finally, the overall purpose of the processing is decisive in determining the applicable legal basis. Reconstruction is typically a technical step in the service of a broader objective, whether B2B prospecting or institutional outreach. It may rely on the same legal basis as the main processing activity, provided the logic is consistent from start to finish.
Commercial prospecting is subject to additional rules
Article L. 34-5 of the French Postal and Electronic Communications Code prohibits, in principle, direct electronic marketing using the contact details of a natural person who has not previously consented to receiving such messages.
The CNIL draws a distinction, however, between marketing addressed to individuals in their professional capacity – where it is sufficient to inform the person and provide a straightforward means of objecting – and marketing aimed at consumers, which in principle requires prior consent.
The assessment also depends on the connection between the message and the recipient’s professional role. In its decision SAN-2020-018 of 8 December 2020, the CNIL refused to allow a company to rely on legitimate interest when sending meal-delivery offers to individuals whose addresses had been reconstructed from a professional social network. The messages bore too weak a connection to the recipients’ professional activity. The CNIL held that prior consent was required.
The French Court of Cassation had already established, in its judgment of 14 March 2006 (No. 05-83.423), the principle that using an email address found online for a purpose unrelated to the context in which it was published is unfair. That ruling, handed down before the GDPR, remains fully applicable.
What businesses should do before any campaign
A company using this method should document the following before any campaign:
- the source of the first name and surname used and how the address was inferred;
- the purpose of the contact and its connection to the individual’s professional role;
- the assessment of the individual’s reasonable expectations and the intrusiveness of the approach;
- the legal basis relied upon for both the reconstruction and the sending of the message;
- the information provided at first contact, in particular regarding the source of the address and the individual’s rights.
The CNIL also recommends limiting the retention period for reconstructed addresses. An address should only remain in the database if an actual first contact takes place within a reasonable timeframe. Any objection should result in the immediate exclusion of the individual from future reconstruction processing, including where the purpose is not commercial.
The most dreaded sanction is not necessarily a fine. In the 2020 decision mentioned above, the CNIL ordered the company to destroy its entire prospect database, which had been built without consent. Months of prospecting work – wiped out in one stroke.