Guessing a prospect's work email: the CNIL sets the framework
CNIL, 16 October 2026: rebuilding a person's work email address from their name and employer remains subject to the GDPR; legitimate interest can apply, but not automatically.
- On 16 October 2026, the CNIL published two pages on rebuilding work email addresses from a person's name and employer.
- Even if never published online, a deduced address stays under the GDPR, and legitimate interest is judged case by case, not automatically.
- For an agency, it is safer to prospect contacts it can legitimately use than to guess addresses, and these pages are not legal advice.
On 16 October 2026, the CNIL published two pages on reconstructing professional email addresses: inferring a person's address from their name, their employer and the organisation's address format, even when it was never published online. The uses it cites are building a contact base, for example for business-to-business prospecting, and one-off contact in institutional relations. The CNIL reminds readers that information being public does not exempt anyone from the GDPR or from the specific rules on commercial prospecting.
Without consent, an organisation may rely on legitimate interest, but only if it has a real one and the impact on individuals is not disproportionate, judged case by case. A person with no identifiable professional presence online, or who uses a contact form rather than a direct address, cannot in principle expect their address to be rebuilt. Safeguards cited: keep the address only if an effective first contact is made within a reasonable time, inform the person as soon as possible, and exclude them immediately if they object, without their having to give reasons.
For AppH
- A domiciliation agency prospecting accounting firms or business founders may be tempted to fill out its lists by guessing addresses: that is exactly the case the CNIL has in mind.
- AppH does not need to guess addresses to be useful: the assistant prepares messages and follow-up from the contacts your agency already has and can legitimately use, and a person at the agency approves every message sent.
Against / the honest limit
- The CNIL gives criteria, not a numerical test: these pages state no time limit, threshold or penalty, and the assessment stays case by case.
- These pages do not replace the view of your DPO or your advisers, and AppH gives no legal advice: whether your prospecting is lawful remains your responsibility.
An address you guess is not an address you are entitled to use. Before automating prospecting, check where each contact came from: an assistant is just as fast on a doubtful list as on a good one.
Reviewed by an AppH human