What is the applicable legislation on address files?
Updated on April 21, 2025
As a reminder, since our services are located in France, we ask you to comply with French legislation or that of your country if it is more restrictive. The key points of French legislation are summarized by the CNIL at this address.
The legislation varies depending on whether it is addressed to individuals or legal entities.
Rule #1 - For individuals: opt-in
In B To C (communication to individuals), your address file must not contain any recipients who have not requested your emailing.
The CNIL is very clear on this:
-
https://www.cnil.fr/fr/la-prospection-commerciale-par-courrier-electronique
-
https://www.cnil.fr/fr/les-regles-dor-de-la-prospection-par-courrier-electronique-0
In other words, you should only use addresses of individuals who have given their prior consent to receive direct marketing emails from you. This is what is called opt-in: with opt-in, the user’s agreement is explicit: they check a box, or scroll through a dropdown menu to allow their personal data to be used for commercial purposes.
You can create your own opt-in file, through a registration form on your website for example, or a checkbox on your online store… Don’t forget to keep a minimum of information such as the registration date and time, the IP address of the internet user who registered, as well as the web address of the registration form. This could be essential to prove, if necessary, the opt-in nature of your file, and thus make any complaint for spam from one of your recipients inadmissible.
You can also find many opt-in files for sale or rent on the market. These contain addresses of internet users who have clearly expressed their desire to receive commercial offers by email related to their interests.
You are also required to include an unsubscribe link in your messages so that your subscribers can unsubscribe at any time.
BEWARE OF SCAMS! When renting or buying an opt-in address file, make sure that the company selling you this file is legal and has a physical presence. Check with the commercial register or simply online by doing a search on Google. A significant number of stolen files or files that do not comply with the legislation are sold online by dubious companies (among others, avoid files qualified as “hard discount” or “low cost”…). In general, if you are offered a file of individuals supposedly “Opt-in” with several hundred or even millions of addresses for a few tens or hundreds of euros, steer clear. A file truly established under the opt-in regime is much more expensive, especially when purchased! Expect to pay at least €0.20 per address for a serious file. Finally, know that no one agrees to receive all the emails in the world, in other words “generalist” opt-in files do not exist, the interest(s) expressed by the subscribers must always be mentioned.
Also, be cautious of foreign companies selling opt-in files, or even double opt-in, “completely legal and declared”… These companies are subject to the laws of their country of origin and state in their terms that it is your responsibility to ensure compliance with the legislation of your country, thus absolving themselves of any potential issues.
In any case, especially for an opt-in file, make sure of its legality by contacting the CNIL or by contacting the technical support. You are solely responsible for the file you use, if we receive justified complaints following a send on an illegal file, you risk the suspension of the SMTP sending service and your OxiMailing license (in addition to legal fines in case of a complaint from the recipient to the public prosecutor!).
Rule #2 - For businesses: opt-out
This collection regime applies to professionals (B To B). Unlike individuals, the checkbox “I agree to receive commercial emails from…” can be pre-checked in the registration form. An unchecked box by default such as “I refuse to receive commercial emails…” can also suffice.
In other words, you are allowed to prospect a professional who has not previously objected to receiving emails from you, provided that they have had the opportunity to do so. Each email sent must then offer the possibility to unsubscribe from the file. Hence the mandatory presence of an unsubscribe link.
Only generic professional addresses such as info@, sales@, contact@… are not subject to opt-in or opt-out.
An important restriction: the products and services presented in your message must be related to the activities of the targeted companies. In other words, do not target florists if you sell construction helmets! Finally, the file must have been legally compiled: absolutely no scraping or copying of data from the Yellow Pages for example!
All these rules are reiterated in this excellent article by the CNIL: https://www.cnil.fr/fr/la-prospection-commerciale-par-courrier-electronique
Attention: Many address files of professionals at very attractive prices are sold on the web and many of them are of poor quality, or even totally illegal as they are often compiled through scraping.
Lastly, it cannot be stressed enough that the use of address scrapers is strictly prohibited. Read this article to learn more on this subject.