On 16 October 2026, France's data protection authority, the CNIL, published two guidance notes on something almost every B2B sales team does without talking about it: guessed work emails. You know a prospect's name, their company and the company's address format (firstname.lastname@company.com), and you're good to go.
The good news: the CNIL doesn't ban it. But it sets precise conditions, and most prospecting tools ignore them by default. The real risk starts afterwards, with what your CRM does with those addresses.
Here is what the CNIL actually wrote, followed by 6 common mistakes to avoid and how to fix them in HubSpot 👇🏼
The CNIL calls it "reconstructing professional email addresses": inferring an address from information found online (first name, last name, employer), often through the organisation's email format. It mentions B2B prospecting by name.
Its position comes down to three points:
If the reconstruction supports B2B prospecting already based on legitimate interest, it can generally rely on the same basis, though the CNIL warns that this is "neither automatic nor systematic". And if the conditions aren't met, the organisation must refrain, unless it obtains the person's consent.
So the practice is allowed, with conditions, and the burden of proof is on you. In our experience, CRMs are rarely set up for that.
"Their name is on LinkedIn, their company is on its website, so the address is public." In its note on when reconstruction is allowed, the CNIL rejects that reasoning: data being available online exempts you neither from the GDPR nor from the rules on commercial prospecting.
A generic address such as contact@, on the other hand, identifies the company itself. According to Selectra, that puts it outside this framework.
The CNIL asks you to look at where the data was published and what choices the person made. It gives two cases:
In both cases, the person cannot reasonably expect their address to be reconstructed. Leto, a compliance software vendor, sums up the CNIL's position: having no online presence is a "strong indicator" that the person did not wish to be easily reachable this way.
An enrichment tool doesn't run that check: it tests formats and returns a "valid" address. The decision has to stay with your team.
The CNIL recommends keeping a reconstructed address only if a real first contact happens within a reasonable time. Yet in many portals, enrichment imports just pile up: guessed contacts, never emailed, sitting in a list.
Take a fictional case: an SDR team imports 2,000 enriched contacts at the start of the quarter and only enrols 600 of them in sequences. The other 1,400 have no business staying in the database: they skew your reports, may inflate your bill depending on your HubSpot contract, and become a liability.
The address wasn't collected from the person, so they have to be told. The CNIL's note on individuals' rights lists what the organisation must say: the purpose, how the address was obtained, their rights and how to exercise them.
The first email in your sequence is the natural place to do this. A few lines are enough, adapted to your situation:
"We're writing to introduce [purpose: our offer related to your role]. We inferred your work address from your name and your company's email format. You have the right to access, erase and object to the use of your data: if you'd rather not hear from us, just reply to this email. More information: [link to our privacy policy]."
A prospect replies "please stop contacting me", and the rep deletes them from the CRM. Three months later, a new enrichment run recreates the same address. The result: the person who objected gets another email.
The CNIL is clear: an objection means the person's data is immediately excluded from any further reconstruction, with no justification required. Deleting the contact isn't enough. At if/else agency, we advise keeping a minimal record of the objection in an exclusion (or suppression) list, checked before every import.
You can't just declare legitimate interest. You have to demonstrate it, with your assessment, your exclusion criteria and your retention rules. Leto recommends listing every tool that guesses or enriches addresses, and recording reconstruction in your processing register, under your prospecting activity.
Set up a documented response process too (who handles requests, and how quickly): according to the CNIL's note on individuals' rights, someone who gets no reply within a month can file a complaint with it.
These rules have to be enforced by the CRM itself, because your reps' memory will never be enough. At if/else agency, we recommend a few simple settings:
It's the principle we argue for in our article on GDPR-compliant data enrichment: compliance depends mostly on how your CRM is structured. Our CRM and marketing automation service starts from these properties and workflows, and our Sales team aligns your prospecting sequences with these rules.
The CNIL has taken a pragmatic line: guessing a work email address is still an option for B2B prospecting in France. But the safeguards it describes show up in your CRM, not in your sales pitch.
If you can't tell which contacts in your database have a guessed address, you have work to do.
Our advice: track where every address comes from, delete what you never used, and never let an enrichment run override an objection. Starting from scratch? Our HubSpot onboarding method builds these rules into your portal from day one.
Want to check how your portal handles guessed addresses? Let's talk.