What does "reconstructing" a work email address mean?
It means deducing someone's work address from information found online: first name, last name, employer, and the pattern that employer uses for every address. If a company writes its addresses as firstname.lastname@company.com and you know the name of one of its managers, you can produce that manager's address even if it is published nowhere. Email permutators and most email finder tools do exactly this: they list the likely formats, then check which one exists.
The CNIL makes a point many sales teams miss: a named address, even a work one, identifies a person, and the fact that the information is available online does not exempt you from the GDPR. Generic company addresses (info@, contact@) are treated differently: on its page about email prospecting, the CNIL states that these addresses, which concern legal entities, are not subject to the same principles.
Can you guess a prospect's address and email them without consent?
Yes, in some cases, under conditions reviewed one by one. The CNIL page "in what context is it allowed?" says reconstruction can rest on legitimate interest, a legal basis that does not require prior consent. Two conditions follow: a real and legitimate interest in contacting the person, such as developing your business, and no disproportionate impact on their rights, assessed case by case.
When reconstruction serves B2B prospecting that itself relies on legitimate interest, it can generally rely on the same basis. The CNIL adds that this rule is "neither automatic nor systematic": you still have to look at what the person could expect and at your safeguards. If those conditions are not met, the guidance is plain: the organisation must refrain from building the address unless it can obtain the person's consent.
The usual rules of business-to-business email then apply to the message. According to the CNIL, it can rely on legitimate interest when the message relates to the recipient's job, and the recipient must be informed and able to object simply and at no cost, with every message.
Six questions to ask before building an address
The table follows the criteria of the two CNIL pages of 16 October 2026, in the order a small business meets them. Use it to decide address by address, and to write the rule that whoever prepares your outreach, person or AI agent, will follow.
| Question | What the CNIL says | If the answer is a problem |
|---|---|---|
| 1. Why do you want to reach this person? | You need a real and legitimate interest. The overall purpose (B2B prospecting, institutional contact) guides the choice of legal basis. | Your offer has nothing to do with their job: do not prospect them. |
| 2. Do they have an identifiable online presence (company website, professional network)? | No online presence can be a "strong indication" that they did not want to be easy to reach. | They cannot be presumed to expect it: refrain, or ask your data protection officer. |
| 3. Have they restricted access to their contact details? | Stronger privacy settings, or a contact form instead of a direct address, can signal that they want to control how their data spreads. | Same conclusion. Use the channel they chose, the contact form for instance. |
| 4. Will you keep the address if you never contact them? | Example of a safeguard: keep the address only if a first actual contact happens within a reasonable time. | Delete guessed addresses that were never used. |
| 5. What happens if they say no? | Any objection must exclude them immediately from any further reconstruction, without them having to give a reason. | Keep a suppression list and check it before building an address, not only before sending. |
| 6. What will the first message tell them? | They must be informed as soon as possible and clearly: purpose, how the address was obtained, their rights and how to use them. | Every message says who is writing and gives a simple way to refuse further messages. |
One difference between the two pages is worth knowing. The page for organisations concludes that if you cannot meet the conditions, you refrain unless you have consent. The page for individuals says that, for someone who protects their details, reconstruction "would only be possible if" the organisation applies safeguards. For a small business, the cautious reading is not to build those addresses without discussing it with your data protection officer or a lawyer.
What can the person whose address was guessed ask for?
The CNIL's second page, "what are your rights?", lists what the business must do. It stops using the address if the person objected or withdrew consent, and removes it from its contact database. It handles requests for access, correction, erasure and restriction within the GDPR deadlines. With no answer within a month, or an unsatisfactory one, the person can file a complaint with the CNIL.
For a small business, this is concrete: someone reads the replies to prospecting emails and handles "please remove me" without delay, including when it arrives as a plain reply rather than through the unsubscribe link.
When an AI agent prepares your outreach, which rules should it follow?
An AI prospecting agent does in seconds what a salesperson did by hand: find a manager's name, spot the company's address format, produce the likely address. The CNIL's criteria stay the same. The difference is that they have to be written down in advance, as rules the agent applies and cases where it stops and asks.
- Record the source. For each address, the agent keeps where the name and the format came from (company page, professional profile). That is what lets you tell the person how you got their address.
- Stop when there is no online presence or the details are protected. The agent does not decide these cases: it drops them, or sets them aside for a person.
- Check the suppression list before building an address. Someone who said no is never processed again.
- Delete what was not used. The CNIL speaks of a "reasonable time" without a number: the business sets that period with its data protection officer, and the agent applies it.
- Write the first message with the required information: who is writing, why, how the address was obtained, how to refuse further messages.
- Hand over to a person for every reply, starting with objections and access requests.
These rules are decided when the agent is scoped, before any technical question. We have described what an AI sales agent prepares and what the salesperson keeps, and the four questions to ask before connecting an AI agent to your tools. If you are thinking of handing over the preparation of your outreach, the AI prospecting agent page explains how the scope and the approval steps are written with you.
What "find any email" guides leave out
On 17 October 2026, we took the top 10 results returned by our search engine for a French query on guessing a work email address from the firstname.lastname format. In the text of each page (scripts removed), we looked for mentions of the GDPR, the CNIL, legitimate interest and address reconstruction.
- 4 pages out of 10 mention neither the GDPR nor the CNIL. They are tools or guides that only explain how to produce the address.
- 3 pages out of 10 mention legitimate interest.
- None cites the CNIL pages of 16 October 2026, or the criteria they set: online presence, protected details, keeping only addresses used for a first contact.
These pages answer "how do I find the address?". The question "am I allowed to build it for this particular person?" comes next, and that is the one the CNIL has just clarified. Limits of this check: one search engine, one query, French-language results, a word search in the retrieved text without running the pages' JavaScript; a page may cover the topic in other words.
When is it better not to guess at all?
Often. If the company publishes a generic address or a contact form, that is the channel it chose: use it. If you met the person at a trade show, through a referral or in an earlier exchange, ask for their address. And if your target list is a few dozen accounts you know by name, a spreadsheet and some method are enough: automating address building adds nothing except the risk of writing to someone who did not want to be reached.
What this guidance does not settle
The two CNIL pages describe criteria and examples of safeguards. They set neither how long an unused address may be kept, nor the list of situations where a person "could reasonably expect" to be contacted. They apply alongside the rest of the GDPR: informing people, retention periods, respecting their rights, data security. For your business, the decision belongs with your data protection officer or a lawyer.
FAQ
Is it legal to use an email finder tool?
The CNIL's guidance of 16 October 2026 is about the practice, whatever the tool: building an address can rest on legitimate interest if the person could reasonably expect it and safeguards limit the impact. A tool does not run that check for you.
Do I need the prospect's consent before guessing their address?
Not necessarily. The CNIL accepts legitimate interest, without prior consent, when the conditions are met. When they are not, for instance for someone who protects their contact details, the business must refrain unless it obtains consent.
How long can I keep a guessed address?
One safeguard the CNIL gives is to keep the address only if a first actual contact happens within a reasonable time. It does not put a number on that time: set it in writing with your data protection officer or a lawyer, and delete addresses that were never used.
What should I say when a prospect asks how I got their address?
The truth, quickly. The CNIL says the business must explain how the address was obtained, as soon as possible. Record where the name and the address format came from when you build the address.
Sources : CNIL, "Reconstitution d'adresses électroniques professionnelles : dans quel cadre est-ce autorisé ?", 16 October 2026, read 17 October 2026 (in French) · CNIL, "Building work email addresses: what are your rights?" (title translated), 16 October 2026, read 17 October 2026 (in French) · CNIL, "La prospection commerciale par courrier électronique, SMS-MMS et automate d'appel", 10 June 2026, read 17 October 2026 (in French) · Équipage IA check of 17 October 2026: top 10 results of a web search, word search in each page's text. Quotations are our translation. This article is not legal advice.