A prospecting tool tries firstname.lastname@, f.lastname@, lastname.firstname@ and every other variant until an address responds, and the person being targeted usually knows nothing about it. On the sender side, the symptom is familiar: campaigns that land in spam with no one knowing why, and a hard bounce rate that climbs on contacts that were “found” rather than collected.
Prior consent is not required by default. In its guidance of October 16, 2026, the CNIL (the French data protection authority) accepts legitimate interest as a basis for reconstructing a professional email address, case by case: the person must be able to expect it, and the address is kept only if a first actual contact takes place within a reasonable time. An objection closes the door for good. Without these conditions, what remains is consent or abstention.
Address reconstruction according to the CNIL
Two public addresses at the same company follow the pattern “firstname.lastname@company.fr”; the third team member has published no address. Applying the pattern to their name is address reconstruction. The CNIL describes it as deducing an address from a person’s name and employer.
The guidance, titled “Reconstructing professional email addresses: what is the authorized framework?”, cites two uses: a prospecting database or a one-off contact in institutional relations. A name tied to an employer identifies someone, so the GDPR (applicable since May 25, 2018) applies.
Why isn’t consent required upfront?
The most natural legal basis is legitimate interest, Article 6.1.f of Regulation (EU) 2016/679, the GDPR. Reconstruction serves a main processing activity, often B2B prospecting, and it can rely on the same basis. The CNIL sets a limit in one phrase:
“neither automatic nor systematic” (CNIL, guidance of October 16, 2026)
The analysis weighs the organization’s real interest against the impact on the person’s rights, then adds the question of what the person can reasonably expect. The reasoning is conducted case by case, and the organization must be able to justify it.
The guidance sets out an analysis method with no scoring scale. Growth Hacker’s analysis of B2B prospecting covers cold calls and guessed emails from the prospecting side; this article stops at the reconstruction itself.
When the person doesn’t expect to be reached this way
A contact form in place of an address. A profile whose privacy settings have been tightened.
The CNIL reads these as signals of refusal. A person with no identifiable online presence, or who has protected their contact details and points to a form, cannot reasonably expect their address to be reconstructed. In principle, they fall outside the scope. These signals must be checked before producing the address, so before any sending.
A gray area remains: a half-filled profile, an address published in 2019 and never updated. No mechanical threshold settles these cases.
Retention, information and objection
The address is kept only if a “first actual contact” takes place within a reasonable time. The October 16, 2026 guidance does not put a number on this period. The prospecting organization therefore sets its own purge period for addresses that got no response, and documents it.
On information, the address was not obtained from the person: under the GDPR, Article 14.3.b requires telling them where the data comes from and how to object, at the latest at the first communication. The first email in the sequence is the last possible moment; Article 14.3.a sets a cap of one month in any case. A sentence like “your address was deduced from the format of your company’s addresses” is enough to name the source; it must come with a way to refuse.
The right to object, opened by Article 21 of the GDPR for prospecting, excludes the person from any future reconstruction, without them having to justify it. Deleting the address is therefore not enough, since the same pattern would regenerate it at the next import. A sister CNIL guidance, “Reconstructing professional email addresses: what are your rights?”, is addressed to the individuals concerned: the two texts should be read together. A permanent objection list, limited to what is strictly necessary to recognize the person, is the practical condition of this guarantee. Public administrations have their own basis, “public interest mission” (Article 6.1.e), with the same safeguards.
The message sent afterward
Sending falls under the prospecting rules: for a professional, Article L.34-5 of the French Postal and Electronic Communications Code governs sending, and the CNIL does not require prior consent if the message relates to their role, provided you inform them and offer a simple way to unsubscribe. Our article on GDPR in email marketing covers proof and unsubscription in detail.
Outside France the rule on sending the email changes. The GDPR applies across the EU, but the ePrivacy Directive (Article 13) requires prior consent only for natural persons and leaves the protection of companies to each member state. In the United States, the FTC says the CAN-SPAM Act does not require recipients’ consent before a commercial email, but every message must offer an opt-out honoured within 10 business days and show a valid postal address. The CNIL sheet is a French authority’s reading of the GDPR and does not bind other regulators.
A source notice fits in one line, for example “Your address was deduced from the format of your company’s public addresses; reply STOP to stop being contacted”. If the sequence also measures opens with a pixel, the CNIL’s recommendation on open-tracking pixels sets its own conditions, separate from those of reconstruction.
The LinkedIn Sales Navigator case
Sales Navigator shows a person’s name and job title at a company, with no email address. The tool alone reconstructs nothing. The extensions plugged into it extract profiles and guess the address.
They run into two obstacles. LinkedIn’s user agreement prohibits automated extraction. The guidance’s criteria apply to each person extracted. The CNIL fined the company Kaspr on December 5, 2024 (€240,000, decision made public on December 19) for collecting contact details of LinkedIn members who had restricted their visibility. According to the CNIL, this collection exceeded what members of a professional network can reasonably expect: the same reasonable-expectation logic as in the guidance. The legal framework for scraping social data is covered in a separate article.
Responsibility is shared. The publisher of an extension or an address-finding service decides for itself to collect and keep the contact details of the people targeted. In the Kaspr decision, the CNIL treats it as the controller of that file and holds against it the lack of a valid legal basis and late information to the individuals, with data retention judged excessive. The sales team using it remains responsible for its own sending: it justifies its legitimate interest and informs the person from the first message. The contract signed with the tool shifts none of these obligations. The Kaspr decision is the only CNIL sanction cited here, and it targets the tool’s publisher. The contractual risk comes from elsewhere: LinkedIn has taken extraction providers to court. Proxycurl had to delete the data obtained and stop accessing it under a permanent injunction; ProAPIs was accused in October 2025 of creating millions of fake accounts to scrape profiles.
Tools that reconstruct or extract addresses are not all equal. The table summarizes what each publisher says about its method on its own pages (as of October 21, 2026), except for Kaspr, Proxycurl and ProAPIs, documented above. None is illegal by nature: the fragility depends on where the data comes from and how the sender uses it. The CNIL guidance names none of these tools.
| Tool | How the address is obtained | Weak point |
|---|---|---|
| Hunter | Deduces the address from the company’s format and from addresses found on the public web; claims to use no third-party database. | Declares a suppression list: a removed address does not come back through collection or deduction. The user remains responsible for their use. |
| Dropcontact | Generates and tests addresses with its own algorithms, with no third-party database according to the publisher. | Compliance claim by the publisher, unverified. The guidance’s criteria apply to whoever uses it. |
| lemlist | Looks up the address in a cascade across several providers. Its Chrome extension sends the profiles from a Sales Navigator search into a campaign. | The origin of the data gets lost in the cascade. The extension runs up against LinkedIn’s contract. |
| Snov.io | Chrome extension on profiles and Sales Navigator searches, deduction by address format then verification, database advertised at 500 million addresses. | Extraction from LinkedIn: LinkedIn’s contract and the reasonable-expectation criterion. |
| Evaboot | Exports Sales Navigator searches in one click, then looks up the address. Says it uses no database and caps exports per day. | Automated extraction from Sales Navigator, the case targeted by LinkedIn’s contract. |
| PhantomBuster | Automates actions and extractions on LinkedIn using the user’s session. | Its own blog talks about a gray area and leaves responsibility for use to the user. |
| Waalaxy | Cascade of providers (BetterContact, FullEnrich, then Dropcontact according to its January 2026 article). | You must be able to tell the person where the address comes from (Art. 14), which the cascade complicates. |
| Lusha | Community of users who share their email signatures, licensed directories, public sources. Says it does not scrape social networks. | Relies on legitimate interest, with an opt-out form and a suppression list. |
| Apollo | Network of contributors, public web crawling and third-party providers. | Relies on legitimate interest. Data already exported remains, according to the publisher, under the customer’s responsibility. |
| Kaspr | Extension displaying the contact details of LinkedIn profiles. | €240,000 fine from the CNIL (December 5, 2024) for collecting profiles with restricted visibility. |
| Proxycurl, ProAPIs | LinkedIn profile extraction services. | Sued by LinkedIn on contract grounds (Proxycurl in January 2025, ProAPIs in October 2025). |
In practice, a few targeted public profiles, contacted quickly with a source notice, remain defensible under the 2026 guidance, to be assessed case by case. Entire lists extracted then sent in an automated sequence are fragile: nothing in that setup checks for signals of refusal. Retention without a first contact becomes the norm.
Does address verification settle the question?
No. An SMTP test sends no email. But the address has already been produced from personal data, so the legal basis and informing the person still have to be established beforehand. Verification limits bounces and says nothing about compliance.
On the technical side, an address guessed on a domain that has no such mailbox comes back with error 550 5.1.1 (unknown recipient, a code defined by RFC 3463), reported by a non-delivery report: that is a hard bounce. Attempts multiplied across variants produce them in a chain. Gmail and Outlook, like other mailbox providers, factor these bounces into the sending domain’s sender reputation; the effects then show up in Google Postmaster Tools. The usual objection, “can’t we just filter afterward?”, falls flat: the bounce has already been counted by the time you see it.
Another trap is catch-all domains: they accept any message addressed to the domain. A guessed address looks valid there in a test, with no guarantee that a human reads it. How catch-all domains work explains why these addresses are kept separate in serious list hygiene. Email Finder vs Email Verifier details the difference between finding an address and verifying it.
Before your next campaign on a reconstructed list, run a sample of 200 addresses through verification and compare its hard bounce rate with that of the addresses you collected from the people themselves.
A guessed address is still someone’s name.
