Cold Email Infrastructure for France

France sits in the middle of the European cold email spectrum: more permissive than Germany, stricter than the United Kingdom. Two laws apply simultaneously: the Loi pour la Confiance dans l'Économie Numérique (LCEN) of 2004 and the French implementation of GDPR, supervised by the Commission Nationale de l'Informatique et des Libertés (CNIL).

The key rule for French cold email: LCEN distinguishes between messages to natural persons in a private capacity (requires prior consent) and messages to professionals at their work address (allowed under specific conditions). CNIL has published clear guidance, the prospection commerciale B2B page: confirming that cold email to a professional is legal when:

1. 1The recipient is a professional contacted in their professional role.
2. 2The message relates to a product or service connected to the recipient's profession or business.
3. 3The recipient is informed, at the time of data collection and in every subsequent message, of their right to object to processing.
4. 4The recipient can object via a simple, free mechanism (typically an unsubscribe link).

This is close to the UK's PECR corporate subscriber exemption, with the addition of the relevance-to-role test from GDPR legitimate interest.

• Cold email to generic addresses (contact@, info@, sales@) as a practical matter, CNIL treats these as non-targeted and outside the professional exemption
• Cold email to personal addresses (@gmail.com, @orange.fr for private use)
• Cold email to French individuals acting in a private capacity regardless of the pitch
• Messages that fail to identify the sender clearly
• Messages that do not offer an immediate opt-out

InboxKit pricing in USD. A 2,000/day French cold email operation typically lands around €250-€320/month total cost.

LCEN Article 22 sets the baseline: commercial prospection by email requires either prior express consent from the recipient, or the recipient's professional status combined with relevance of the pitch. GDPR adds the lawful basis requirement (legitimate interest works for B2B prospection in France, unlike Germany), transparency obligations, and the Art. 21 right to object.

CNIL's four pillars of compliant B2B prospection:

1. 1Information at first contact. The recipient must be told, at the very first message, who the sender is, what data is being processed, and how they can exercise their Art. 15-22 GDPR rights. CNIL accepts a short privacy notice in the message body or a link to a full privacy page on the sender's website.

1. 2Easy right to object. One-click unsubscribe minimum. CNIL has repeatedly enforced the 'free and simple' requirement: unsubscribe workflows that require login, account creation, or multi-step confirmation have been fined.

1. 3Legitimate interest balancing test documented. For each cold email program, the sender should document: (a) the commercial purpose, (b) why email is the least intrusive means, (c) the balancing analysis weighing sender interest against recipient expectations. CNIL does not require this document to be shared unless asked, but in inspections, inability to produce it is treated as non-compliance.

1. 4Suppression list with indefinite retention. Opt-outs must be honored permanently. A sender who re-emails an unsubscribed address has committed a documented LCEN + GDPR violation visible in their own records.

CNIL enforcement in 2026 is led by its répressive actions division. Published sanctions in the past two years include fines from €3,000 to €600,000 for unsolicited commercial email violations, with pattern fines concentrated on senders who ignored opt-outs, failed to provide privacy notices, or used data obtained from illegal scraping.

The maximum GDPR fine is 4% of global annual turnover or €20 million, whichever is higher. CNIL has not applied the maximum to a cold email violation but has issued multi-hundred-thousand-euro fines to mid-size French companies that ignored its guidance.

France's inbox mix is distinct from both the UK and Germany. Gmail dominates B2B as elsewhere, but Orange (formerly France Télécom / Wanadoo), Free, and SFR still account for a meaningful share of business email, especially in SMB and regional markets.

Orange is the main French-specific delivery problem. Orange Mail has historically had one of the most aggressive filter engines in Europe and maintains a distinct postmaster contact (abuse@orange.fr) that senders must use to escalate reputation issues. A single high-complaint campaign can cause Orange to rate-limit a sender for weeks, and the escalation path requires email correspondence in French with evidence of consent.

Data residency considerations. French law does not require recipient data to stay in France or the EU for cold email purposes. GDPR does require disclosure of cross-border transfers and adequacy of the destination, which for US-based mailbox providers means relying on EU-US Data Privacy Framework certification. Google Workspace and Microsoft 365 both offer EU-region tenants for customers who want to minimize cross-border transfer complexity. InboxKit's Microsoft 365 provisioning supports EU regions natively.

• 2-3 .fr domains for France-native outreach (French recipients open .fr addresses at meaningfully higher rates)
• 3-5 .com, .eu, or .io domains for pan-European outreach
• Register .fr domains through an AFNIC accredited registrar
• Meet AFNIC's EU presence requirement (EU-based registrant or authorized agent)
• Publish a mentions légales page on every domain's redirect target, French law requires this disclosure on any commercial website
• 301 redirect secondary domains to the primary brand

• Google Workspace default
• Microsoft 365 at 30-40% to reach enterprise recipients
• Consider EU-region Microsoft 365 tenants for Schrems II comfort
• Per-mailbox volumes ramp: 20/day week 1 → 40/day week 2 → 60/day week 3 → 80+/day after week 4
• Isolated warmup for 14-28 days

• SPF: v=spf1 include:_spf.google.com ~all
• DKIM: two selectors published
• DMARC: p=none to start, p=quarantine after 30 days
• MX: matches mailbox provider

• Mentions légales link in every commercial email
• French-language subject line and body for French recipients (English-only cold email to France underperforms 2-3x on open and reply rates)
• Unsubscribe link labeled 'Se désabonner' or 'Retirer mon consentement'
• Privacy notice link in the message footer, not only on the landing page
• SIREN / SIRET number disclosure if the sender is a French entity

French cold email is a Gmail + Microsoft 365 + Orange delivery problem. Volume math works the same as elsewhere, with French-specific risk drivers.

Risk 1: Complaint rate. CNIL opens investigations based on recipient complaints forwarded through the signal-spam.fr platform and direct complaints to CNIL's online form. A sustained pattern of complaints against a single domain triggers an investigation. Keep complaint rate under 0.1% as a target; the enforcement ceiling is somewhere in the 0.3-0.5% range based on published sanctions.

Risk 2: Unsubscribe processing delay. CNIL has fined senders for opt-out processing delays. The expectation is that the next message after an unsubscribe should already be suppressed: not 'within 10 business days' as with CAN-SPAM. Same-day suppression is the operating standard.

Risk 3: Privacy notice visibility. Every cold email must carry a privacy notice link. CNIL has specifically fined senders who buried the notice or linked to a generic corporate privacy page without specifying how recipient data was obtained.

• Week 1: 10-20/day per mailbox, warmup only
• Week 2: 20-40/day per mailbox, 5-10 real cold touches
• Week 3: 40-60/day per mailbox, 70/30 warmup-to-cold
• Week 4+: 60-100/day per mailbox, 30/70 warmup-to-cold

• ~35 active mailboxes at 60/day each
• ~10 domains at 3-4 mailboxes each
• InboxKit Agency ($99/mo, 30 slots) + 5 extras at $3.25 = $115/mo
• Warmup: 35 × $3 = $105/mo
• InfraGuard: ~$10/mo for 10 domains
• Total: ~$230/month (~€210/month) for 2,000 French cold emails/day: about €0.005 per sent message.

CNIL inspections, when they happen, test whether the sender can document compliance. A well-run French cold email program retains:

• Email address
• Source (URL, professional directory, LinkedIn Sales Navigator export, manual capture)
• Capture date
• Role and employer of the recipient
• Relevance of pitch to role (one-liner)
• Send history
• Unsubscribe date if applicable

• Sender legal entity (SIREN if French)
• Mentions légales link used
• Privacy notice version and URL
• Sending domain(s)
• Message content template
• Legitimate interest assessment document

• GDPR compliance policy
• Data Protection Officer (DPO) contact: required for some French senders under GDPR Art. 37
• Record of Processing Activities (ROPA) under GDPR Art. 30
• Training log for staff with access to the cold email program
• Suppression list audit

Records should be retained for at least 3 years: the statute of limitations for CNIL to open a proceeding based on a complaint. Some records (consent logs, opt-out logs) should be retained for as long as the sender is still processing the relevant data.

• [ ] Register 5-10 domains (mix of .fr, .com, .eu)
• [ ] Publish mentions légales on every domain redirect target
• [ ] Provision Google Workspace mailboxes (60%) + Microsoft 365 mailboxes (40%)
• [ ] Consider EU-region Microsoft 365 tenants
• [ ] Automated DNS via InboxKit
• [ ] Enable isolated warmup and InfraGuard on every mailbox and domain

• [ ] Document legitimate interest assessment and ROPA entry
• [ ] Build list from professional directories and role-relevant sources only
• [ ] Draft French-language email templates with privacy notice link
• [ ] Test unsubscribe flow: confirm same-day processing
• [ ] Establish Orange postmaster contact pathway

• [ ] Start sequences at 40-60/day per mailbox
• [ ] First-touch plain text, relevant pitch in French, clear sender identity, free opt-out
• [ ] Daily opt-out processing into suppression list
• [ ] Weekly deliverability review (Gmail, Microsoft 365, Orange, Free)
• [ ] Quarterly suppression list audit and ROPA update

• Any CNIL correspondence or signal-spam.fr forwarded complaint
• Google Postmaster domain reputation drops to Medium
• Orange rate-limiting on any sending IP
• Complaint rate above 0.15%