GDPR B2B prospecting: what is allowed in 2026

GDPR B2B prospecting is allowed without prior consent, by email, on LinkedIn or by phone, under three conditions: the message relates to the person’s job, they know where their contact details came from and they can opt out easily, at any time. What changes in 2026 is mainly phone calls to consumers and the use of AI. Here is the simple rule, channel by channel, checked against texts from the CNIL (the French data protection authority), the DGCCRF (the French consumer protection authority) and the European Commission, with a notice template to paste at the bottom of your messages.

📌 Key takeaways

• Between businesses, prospecting relies on legitimate interest: no prior consent is needed if the message relates to the recipient’s line of work.
• Every message must say who is writing, where the contact came from and how to stop being contacted. A refusal stops everything, straight away.
• In France, since 11 August 2026, calling a consumer requires their prior consent. Cold calling between businesses still relies on the right to object.
• Since August 2026, the EU AI Act requires that people be told when they are interacting with an AI. A message reviewed and owned by a human remains the simplest option.

This article is not legal advice: it is a practical reading of the official texts, as of October 2026, based on the rules in France; the GDPR and the AI Act apply across the whole EU. For a specific case, your lawyer or your DPO remains the reference. ⚖️

GDPR B2B prospecting: is it legal?

Yes. The GDPR does not forbid writing to a professional you do not know: it regulates how you do it. The CNIL accepts that prospecting aimed at professionals relies on the company’s legitimate interest, without prior consent, as long as the subject of the message relates to the profession of the person contacted.

The example given by the CNIL says it all: presenting software to a company’s IT director relates to their role. Offering the same director home insurance, for themselves, does not. 🎯 The question to ask before every campaign fits on one line: does my offer concern this person’s work?

Three rules complete this principle:

• 🔍 Information: the person must know that their details are used for prospecting and where they came from, at the latest in the first message (Article 14 of the GDPR).
• ✋ Objection: they can object at any time, and their data is then no longer used for that purpose (Article 21 of the GDPR).
• 🗂️ Proportion: you only keep the data you need, and not indefinitely.

A special case: generic addresses such as contact@ or info@ designate a company, not an individual. The CNIL states that they are not subject to these principles. But a firstname.lastname@company address is still personal data, with all the rules above.

What are the rules for each channel: email, LinkedIn, phone, AI?

The underlying rule is the same everywhere between businesses: a message related to the role, clear information and a respected refusal. What varies is how the contact is collected and the obligations specific to each channel, notably phone calls to consumers and exchanges run by an AI.

Channel	What is allowed in B2B	On what condition	What is forbidden or risky
Named email	Writing without prior consent	Message related to the role, sender identity, easy way to opt out, source of the details	Writing to a consumer without their consent, ignoring an unsubscribe
Generic email (contact@)	Writing without prior consent	Staying relevant to the company	Nothing GDPR-specific, but deliverability suffers if the message is off topic
LinkedIn (invitation, message)	Writing to a member about their professional activity	Same rules as email, to be safe	Collecting details the person has hidden, keeping data indefinitely
Phone to a professional	Calling without prior consent	Call related to their job, caller identity, option to refuse	Calling back someone who has objected
Phone to a consumer	Calling only with prior consent	Consent valid for one year at most, proof kept for 3 years	Calling without consent since 11 August 2026
Message written or assisted by AI	Using AI to prepare and sort	A human reviews, the person is told if they are talking to an AI	Letting an AI pass itself off as a human

Two nuances are worth stressing. On LinkedIn, no French text sets separate rules for messaging: applying the email rules is the safest choice. And for freelancers or tradespeople reached on a personal mobile, the line between professional and consumer is blurred: when in doubt, treat them as consumers. 💡

What should the GDPR notice in a prospecting message contain?

A GDPR notice in a prospecting message must say, in a few lines, who you are, why you are writing to this person, where their contact details came from and how they can stop being contacted. The CNIL requires the sender’s identity and an easy way to opt out in every message; Article 14 of the GDPR adds the source of the data.

Article 14 of the GDPR lists the information to provide when you did not obtain the contact details from the person themselves. Our approach: the essentials in the message, the detail behind a link to your privacy policy. In practice, the notice comes down to five elements:

1. Who is writing: your company name and a valid reply address.
2. Why this person: the link between your offer and their role.
3. Where the contact came from: public LinkedIn profile, company website, trade show, referral.
4. How long: how long you keep their data without any exchange.
5. How to opt out: a word to reply or a link, and a commitment to stop immediately, with a link to their rights (access, objection, complaint to the CNIL).

Here is a template to adapt and place under your signature. ✍️

Example

You are receiving this message because your role as [purchasing director] at [Company] relates to [our industrial maintenance services]. Your business contact details come from [your public LinkedIn profile / your company’s website]. [Your company], [city], keeps them for no more than 3 years without any exchange with you. To stop being contacted, simply reply “stop” and we will stop straight away. Your rights (access, objection, complaint to the CNIL): [link to the privacy policy].

Five lines, no more. A twenty-line notice in small print informs nobody: it drives people away. A short, frank notice reassures, and it shows that you know what you are doing. 🙂

Can you prospect on LinkedIn without breaching the GDPR?

Yes, if you write to a member about their professional activity, with a message that concerns them, and if you do not retrieve contact details they have chosen to hide. The legal risk on LinkedIn does not come from the message itself, but from how the data is collected upstream, especially with extensions that scrape profiles.

The CNIL made this clear with the €240,000 fine imposed on 5 December 2024 on KASPR, the company behind a Chrome extension that displayed the contact details of people whose LinkedIn profile you visited (CNIL, December 2024). The breaches it found are instructive for any sales team:

• Collection: KASPR also retrieved the details of members who had limited their visibility to their connections. For the CNIL, this went beyond what these people could reasonably expect.
• Retention: the data was kept for five years from each update, which amounted to keeping it almost forever.
• Information: people were only notified from 2022 onwards, four years after launch, by an email in English.
• Rights: access requests were not handled properly.

⚠️ The practical lesson: if a tool gives you the email or phone number of someone who does not display them, ask yourself where it got them. You remain responsible for how you use them. Our guide to finding a prospect’s email address covers the reliable methods and their GDPR angle.

Is B2B phone prospecting affected by the 2025 French law?

Not directly. French law no. 2025-594 of 30 June 2025, applied since 11 August 2026, requires prior consent to cold call a consumer. Between businesses, the CNIL states that calls still rely on legitimate interest, with a simple right to object, as long as they concern the person’s job.

On the consumer side, the change is profound. The DGCCRF states that this reform ends Bloctel, the opt-out register consumers used to sign up to. 📞 Consent must be freely given, specific and expressed through a positive action; it is valid for one year at most, and proof of it must be kept for at least three years, according to the CNIL. Calls to consumers are only allowed Monday to Friday, from 10am to 1pm and from 2pm to 8pm.

On the business side, cold calling remains possible, with the same reflexes as for email: you introduce yourself, you say why you are calling this person, and you record any refusal so you never call them again. To give the call a chance of working, it is better to call for a real reason: that is the subject of our article on cold calling.

What does the AI Act change for AI-assisted prospecting?

The AI Act does not forbid using AI to prospect. It adds a transparency obligation, applicable since August 2026 according to the European Commission: people must know when they are interacting with an AI system, for example a conversational assistant, when this is not obvious.

In prospecting, this mainly affects two uses. Preparing a message, sorting prospects, summarising a profile: AI remains a work tool, and the message sent is that of a human who has reviewed it. Running a conversation with a prospect on its own: here, the person must be told they are talking to an AI. 🤖 In both cases, the GDPR still applies to the data the AI processes.

The safest route comes down to three reflexes:

• A human reviews every first message before it is sent, and owns it.
• If an assistant replies to prospects, it says so, and answers honestly if asked.
• The AI only gets the data needed for the message: the role, the company, the public fact that justifies the contact.

To see how an assistant can run the conversation after the first reply without misleading anyone, read our article on the AI conversational agent.

How long should you keep a prospect’s data?

The CNIL recommends keeping the data of a prospect who is not a customer for three years at most, from collection or from the last contact initiated by the prospect. A click on a link counts as contact; an email you send that gets no reaction does not restart the clock.

This benchmark comes from the CNIL’s reference frameworks on sales management, which are not binding but require you to justify any deviation. The same page recommends keeping the information that lets you respect an objection for at least three years, in a so-called suppression list. 🗑️ In practice:

• Delete or archive prospects with no exchange for three years.
• Keep the list of refusals, so you never contact someone who said no again.
• Be wary of tools that reset the “last activity” date with every automatic follow-up: a follow-up is not contact from the prospect.

How do you stay compliant without losing meetings?

Being compliant and booking meetings go in the same direction: a message that talks about the person’s work, says where you come from and leaves them free to decline is also the one that gets replies. Compliance costs your opener nothing; it is the generic message that costs you, in refusals as well as spam reports.

Here is what the difference looks like, on a real prospecting signal.

Example

Signal: the purchasing director of a manufacturing SME posts on LinkedIn that she wants to reduce line stoppages caused by maintenance.

Opener that misses: “Hello, I found your email, we help companies optimise their costs. Do you have 15 minutes this week?” Nothing says why her, where the address came from, or how to opt out.

Opener that gets a reply: “Hi Emma, your post about line stoppages struck a chord: we often see this problem at manufacturers that use two maintenance providers for the same set of machines. How do you handle it today?” Followed by the five-line GDPR notice, with the source: her public LinkedIn post.

The second version follows the CNIL’s three rules, and it gives a reason to reply. ✅ Among our clients, who write about the person’s role and respect every refusal, 30% of contacted prospects reply (MeetMagnet snapshot of 9 October 2026, 27 paying client accounts, 15,910 prospects, LinkedIn and email). A figure that shows a clear message you stand behind does not stop you from getting replies.

This is how MeetMagnet works: we start from a public signal related to the person’s role, the opener is about their work, every message is reviewed by a human before it is sent, and a refusal stops the sequence immediately. To make sure your emails also land in the inbox, our guide to cold email deliverability completes this part.

Before your next campaign, a six-point checklist:

1. Does my offer concern the role of every person targeted?
2. Do I know where each contact detail came from, and can I say so?
3. Does every message say who is writing and how to opt out?
4. Does a refusal stop the sequence on every channel?
5. Is data with no exchange for three years deleted?
6. Does a human review the messages, and is the AI disclosed when it converses on its own?

The GDPR does not close the door on B2B prospecting: it asks you to write to the right person, for a good reason, and to say so openly. These are also the three ingredients of a first message that gets a reply, then a meeting. The real risk is not writing to a stranger: it is buying lists of unknown origin, keeping data forever, or letting an AI speak in place of a human without saying so. 🚀

Sources

• “La prospection commerciale par courrier électronique”, CNIL, accessed 27 October 2026, https://www.cnil.fr/fr/la-prospection-commerciale-par-courrier-electronique
• “Prospection commerciale par téléphone (hors automate d’appel) : quelles sont les règles ?”, CNIL, accessed 27 October 2026, https://cnil.fr/fr/prospection-commerciale-par-telephone-hors-automate-dappel-quelles-sont-les-regles
• “Aspiration de données : sanction de 240 000 euros à l’encontre de la société KASPR”, CNIL, accessed 27 October 2026, https://www.cnil.fr/fr/aspiration-de-donnees-sanction-de-240-000-euros-lencontre-de-la-societe-kaspr
• “Questions-réponses sur les référentiels relatifs à la gestion des activités commerciales et des impayés”, CNIL, accessed 27 October 2026, https://www.cnil.fr/fr/questions-reponses-sur-les-referentiels-relatifs-la-gestion-des-activites-commerciales-et-des
• “Règlement européen sur la protection des données, chapitre III (articles 14 et 21)”, CNIL, accessed 27 October 2026, https://www.cnil.fr/fr/reglement-europeen-protection-donnees/chapitre3
• “Les règles du démarchage téléphonique s’imposant aux entreprises”, DGCCRF, accessed 27 October 2026, https://www.economie.gouv.fr/dgccrf/les-fiches-pratiques/les-regles-du-demarchage-telephonique-simposant-aux-entreprises
• “AI Act”, European Commission, accessed 27 October 2026, https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai