Cold Email

B2B cold email: what the law allows in France, Switzerland, Luxembourg and Andorra

Scalead·October 31, 2026·10 min read

B2B cold email: what the law allows in France, Switzerland, Luxembourg and Andorra

The question comes up every time a client widens its territory: can we prospect in Switzerland the way we prospect in France? The answer is no, and the gap is not a compliance footnote. Across four neighbouring French-speaking markets, the same email sent to the same kind of decision maker moves from a regime where it is lawful by default to a regime where it needs prior agreement.

Here is what the texts and the regulators of each territory actually say, with the sources. This is not legal advice. It is a reading of published rules, useful for knowing where a prospecting system has to change shape.

France: opt-out, as long as you speak to the job

In France, emailing a private individual for marketing purposes requires their prior consent. For a professional, the CNIL applies a different logic: prospecting can rest on the organisation's legitimate interest when the subject of the solicitation relates to the profession of the person being contacted.

Three duties frame that regime. The person must have been told their address could be used for prospecting. They must be able to object simply and free of charge, when the data is collected and in every message. And every message must make clear who is sending it.

The CNIL adds a point that is often misread: generic addresses such as info@, contact@ or commande@ belong to legal persons and fall outside these principles.

The operational implication is more interesting than the rule itself. In France, targeting relevance is not a performance question, it is the legal basis. A message that is off topic for the recipient's role leaves the B2B regime and falls back under the rules for private individuals, which means prior consent. A badly segmented list does not merely produce poor results, it weakens the legal footing of the campaign.

Switzerland: opt-in, and the text draws no line for professionals

Switzerland does not reason from data protection first, it reasons from unfair competition. Article 3 paragraph 1 letter o of the Federal Act against Unfair Competition, in force since 1 April 2007, makes it unfair to send mass advertising by telecommunications with no direct link to requested information while failing to obtain the customers' prior consent, to state the sender correctly, or to inform them of their right to refuse easily and free of charge.

The text says customers, not consumers. It carves out no exception for professional recipients. The Federal Data Protection and Information Commissioner states the principle plainly: email advertising is possible provided people have explicitly given their consent before being approached. Accepting general terms and conditions is not enough, and a dedicated box that is not pre-ticked is the expected way to collect that consent.

The only exception covers the existing customer. A business that obtained contact details when selling goods or services, and said at that point that the customer could object, may send advertising for its own similar goods or services.

That leaves the question which decides everything: at what point does advertising become mass advertising? This is where online guidance diverges, and several sources assert that a single, hand written email falls outside the rule. The Federal Office of Communications is more careful than that. It writes that no limit has been set to define mass advertising, that advertising may be considered mass advertising as soon as a send is addressed to several recipients, and that the threshold will be settled case by case by the courts.

In other words, the idea that a hand crafted send sits outside the scope is an interpretation, not a settled rule. Complaints are filed with the State Secretariat for Economic Affairs, and the sender is exposed to civil or criminal sanctions. The Federal Act on Data Protection applies in parallel, since collecting and using addresses is processing of personal data.

For a French team opening Switzerland, this is the tipping point. Reusing a system designed for French law, unchanged, is the expensive mistake, because the Swiss reasoning does not run through how relevant the message is to the role. It runs through consent.

Luxembourg: the line runs between the company and the person

Luxembourg applies the amended law of 30 May 2005 on electronic communications networks and services. Article 11 paragraph 1 sets out opt-in: using electronic mail for direct marketing is only possible where it targets a subscriber or user who has given prior consent. Paragraph 5 then narrows the reach of that rule, stating that paragraphs 1 and 3 apply to subscribers who are natural persons.

That articulation produces the Luxembourg dividing line. A company address, belonging to a legal person, sits outside the consent requirement. A named employee's address is exactly where the law becomes unsettled.

The National Commission for Data Protection, for its part, uses wording broader than the text: where no link exists between a controller and a user, prior consent must be sought before sending electronic mail. That sentence does not separate professionals from private individuals. The same note recalls that where a contractual relationship already exists, a company may use its customer's address for advertising without prior consent, provided the customer can object at any time and is told so both at collection and in every message.

In practice, and for as long as the regulator has not settled the case of the named address, the cautious reading treats firstname.lastname@company.lu as requiring consent, and keeps the objection regime for impersonal addresses. In every case the sender must not be disguised, and a valid address must let the recipient ask for the sending to stop.

Andorra: the regulator asks for consent, including from the future customer

Andorra is almost always missing from these comparisons, even though its regime is the clearest of the four. The country applies Qualified Law 29/2021 of 28 October on the protection of personal data, in force since May 2022, together with Decree 391/2022 approving its implementing regulation. The supervisory authority is the Andorran Data Protection Agency.

In its own model clauses published for businesses, the Agency writes that sending commercial advertising by email requires the express consent of each customer or future customer, and that prior, free, specific and unambiguous consent must be held.

The words that matter are future customer. The Andorran authority does not limit the requirement to people with whom a relationship already exists. It extends it explicitly to the prospect. The door that French doctrine leaves open for B2B is closed here by the regulator itself.

One point is worth clearing up, because it is often confused with the previous one. Andorra benefits from a European Commission adequacy decision of 19 October 2010, which the Commission confirmed in January 2024 when it reviewed eleven adequacy decisions predating the GDPR. Personal data can therefore flow between the Union and Andorra with no additional safeguard. What is constrained is not the transfer of the data, it is the solicitation.

The consequence is blunt. In Andorra, cold email is not the entry channel. The phone, LinkedIn, referrals and professional gatherings are, and email comes afterwards, once agreement has been given.

What changes when you prospect across all four

One prospecting list cannot be worked with one rulebook. Segmenting by the recipient's country of establishment has to come before the copy is written, not after.

In practice that comes down to a handful of things worth checking before a launch.

Segment sends by the recipient's country of establishment, not by language. A French speaking decision maker can fall under four different regimes.
Separate impersonal addresses from named ones, since that is the boundary on which Luxembourg flips the regime.
Identify the sender in every message, with no assumed name and no domain that hides who is writing.
Offer a simple, free way to refuse, and honour it immediately, which means keeping a suppression list and applying it across every campaign.
State where the data came from when it was not collected from the person.
Check that the subject of the message attaches to the recipient's role, which is a duty in France and good practice everywhere.
For Switzerland and Andorra, treat cold email as unable to open the relationship, and build the first contact on another channel.

That last point is the one that stings, because it questions the mechanism. It does not question the objective. A prospecting system can run across several channels and still produce meetings in a market where email cannot open the conversation.

Summary table

Territory	Generic address	Named address	Existing customer	Authority
France	Outside the consent rule, per the CNIL	Objection, if the subject relates to the profession	Similar products, with an objection route	CNIL
Switzerland	Prior consent, no professional carve-out in the text	Prior consent	Own similar services, with an objection route	SECO on complaint, FDPIC for the data
Luxembourg	Outside the consent rule, by article 11 paragraph 5	Unsettled, cautious reading: consent	The company's own products, with an objection route	CNPD
Andorra	Express consent, including from a future customer	Express consent	Express consent	APDA

Frequently asked questions

Does the GDPR settle the cold email question?

No, not on its own. The GDPR frames the processing of contact details and requires a legal basis, often legitimate interest. What permits or forbids the sending itself comes from national texts, which is why two countries under the same European regulation can reach opposite answers. Andorra and Switzerland, which are not EU members, show the same mismatch from the other direction.

Can an address published on a website be prospected freely?

A public address is not consent. The CNIL advises against prospecting from addresses collected in the public spaces of the internet. Making data public changes how available it is, not the regime that applies to the solicitation.

Does prospecting Switzerland from France change anything?

Where the sender is established does not make the recipient's national law disappear. A French company approaching Swiss decision makers meets the Swiss regime, and the reverse holds too. That is why segmenting by the recipient's country comes before every other consideration.

What if someone replies positively to a first message?

A favourable reply does not retroactively cure a send that did not follow the applicable rules. It does open a relationship in which the following exchanges rest on evident agreement. That is exactly the logic to use in opt-in markets: obtain agreement through another channel, then move to email.

How we work these four territories

Scalead runs prospecting campaigns for B2B companies in France, French-speaking Switzerland, Luxembourg and Andorra. Segmentation by country of establishment happens while the list is being built, before any copy is written, because it determines the entry channel and the shape of the first message.

Our commitment is on meetings and leads qualified by you, against your criteria, and you only pay for the ones you validate. What we do not promise is a volume detached from the rules that apply to your market. In an opt-in territory, the system changes shape before it changes objective.