Email and SMS prospecting: the GDPR rules for a French training organisation

Building a prospect list and launching an email or SMS campaign to fill training sessions is one of the first commercial reflexes of a newly created training organisation. It is also one of the areas where GDPR is most often misunderstood in practice: confusing the rules that apply to individuals with those that apply to client companies leads to non-compliant campaigns, exposed to a complaint filed with the CNIL (France’s data protection authority) or to a mailbox provider flagging the domain as spam. Here is what the regulation actually requires, and how to build effective prospecting without breaching it.

The baseline rule: opt-in for individuals

Article L34-5 of the French Postal and Electronic Communications Code, which transposes the EU “Privacy and Electronic Communications” directive, sets a simple principle for individuals acting outside a professional capacity: any prospecting by email, SMS or automated call requires prior, free, specific and informed consent — the opt-in regime. In practice, a prospective learner whose personal address you collected at a trade show, through a lead magnet or a contact form can only receive your marketing communications if they ticked a dedicated, non-pre-checked box at the time of collection.

A “soft opt-in” exception exists: if the contact details were collected in connection with a sale or a service (for example, a former learner), the organisation can send prospecting messages about similar products or services without new consent, provided the person was informed, at the time of the initial collection, of their right to object, and is offered that right in every message.

A different regime for companies (B2B)

When prospecting targets a client company — an HR department or a manager for their skills development plan — on a generic or role-based professional address, the regime changes: the opt-out (objection) rule applies instead of prior consent. A training organisation can therefore contact a training manager by email without having obtained their prior agreement, subject to two cumulative conditions:

• the message must relate to an offer connected to the recipient’s professional activity (a training course, not an unrelated product);
• every message must include a simple and free way to object to further prospecting, and the person must have been informed of this right when their address was collected.

This B2B/B2C distinction explains why the exact same campaign can be perfectly compliant when sent to firstname.lastname@company.fr addresses, and entirely irregular when sent without consent to the same people’s @gmail.com address.

What neither regime removes

Whether you operate under opt-in or opt-out, several GDPR obligations remain common to any prospecting campaign:

Obligation	What it requires in practice
Documented legal basis	Consent (B2C) or legitimate interest bounded by the right to object (B2B), logged in the processing register
Full information	Organisation’s identity, purpose of processing, retention period, data subject rights — accessible from the moment of collection
One-click unsubscribe	A working, immediate unsubscribe link in every email, with no unnecessary extra step
Traceability of the source	Proof of where each address came from (form, trade show, former client) and its collection date
Limited retention	Purging contacts who have shown no interest after a defined period, typically 3 years since the last active contact

These requirements sit alongside those detailed in our guide on GDPR obligations for a training organisation: commercial prospecting is just one of the processing activities the register must list, alongside the pedagogical tracking of learners.

The special — and much stricter — case of CPF telemarketing

This general prospecting regime must not be confused with the specific rules governing solicitation aimed at getting someone to use their Compte Personnel de Formation (CPF, the French personal training account). Since the anti-fraud law of 19 December 2022, any commercial solicitation by phone, SMS or unsolicited electronic message aimed at enrolling someone in a CPF-funded course is in principle banned, under heavy criminal and administrative penalties. Our article on the CPF telemarketing ban details this exceptional regime, considerably more restrictive than the ordinary commercial prospecting described here — an essential distinction for any organisation that sells both self-funded training and CPF-eligible courses.

Why respecting consent also serves your commercial efficiency

Beyond the risk of sanctions, a study by Avi Goldfarb and Catherine Tucker published in Management Science in 2011 (“Privacy Regulation and Online Advertising”, see the study), based on 3.3 million responses to nearly 9,600 online advertising campaigns, shows that poorly anticipated consent rules sharply reduce the effectiveness of untargeted campaigns — the effect being strongest for generic, poorly personalised and poorly segmented messages. In other words, a clean prospect list, properly consented and segmented by regime (B2B/B2C), is not just a legal constraint: it is also the condition for a decent open and conversion rate, whereas a mass untargeted send usually ends up in spam.

Building compliant prospecting from day one

• Separate your B2B and B2C lists in your CRM or email tool, with a dedicated field for the applicable regime and the collection date/source of each contact.
• Document B2C consent: keep proof of the ticked box, the timestamp and the exact wording shown at the time of collection — a simple form export is usually enough.
• Inform professional contacts from the start of their right to object, in the legal notice of the form or event where the address is collected.
• Purge your database regularly of inactive contacts or those who requested removal, to limit risk and stay credible with mailbox providers.
• Always keep prospecting separate from any communication about a CPF-eligible course, which falls under the specific, restrictive regime described above.

Take action

Compliant prospecting from your very first email avoids a CNIL complaint or having your sending domain blocked by mailbox providers — two incidents that cost far more than a well-placed checkbox. The Kit Certif Complet provides legal notice and processing register templates adapted to a training organisation, while the ebook Create your training organisation in 30 days structures your entire launch process, commercial prospecting included. The full Pack combines both resources to secure your commercial development from the very first contacts.