Short answer: for prospecting professionals, the French data protection authority (CNIL) accepts that the approach can rest on the company's legitimate interest, provided the message relates to the person's job, the person is informed (including where their data came from) and they can refuse easily. For a private individual, electronic prospecting requires prior consent. And complying with GDPR does not make automation acceptable to LinkedIn, whose terms forbid it separately.
This page is for information only and is not legal advice. Texts and guidance change: for your situation, have your practice checked by a lawyer or your data protection officer. It reflects French authority guidance; rules differ in other EU countries.
Can you prospect professionals on LinkedIn without their consent?
Yes, within the framework set by the CNIL. On its page about electronic prospecting, it writes that prospecting professionals can rest on the organisation's legitimate interest "when the subject of the approach relates to the profession of the person contacted". Its example: a call presenting software to a company's IT director (our translation, CNIL, "La prospection commerciale par courrier électronique, SMS-MMS et automate d'appel", 10 June 2026, accessed 5 October 2026, in French).
The link with the person's profession matters as much as their status as a professional. Offering a recruiting tool to an HR director is defensible. Offering them car insurance for personal use is not.
The rules to follow within this framework, per the CNIL, are information (for example when the address or number is collected) and simple, free objection. Every message must make the sender's identity known and allow the person to refuse further messages by a simple means.
This regime has a limit that the CNIL pages do not lift: they speak of email, text messages and automated calls, and do not say expressly whether a private message on a social network belongs to that list. The information and objection principles apply in every case, so they are the safest basis.
What about private individuals?
Their prior consent is needed. The CNIL is clear: electronic prospecting of private individuals requires free, specific, informed and unambiguous consent, and accepting general terms of use is not enough. The phone follows its own rule since 11 August 2026: our article on France's new phone consent rule covers it. A LinkedIn message to a private individual remains an area to have a lawyer check before any volume sending.
What information should you give the people you contact?
The information required by article 14 of the GDPR, including the source of the data, at the latest at the first communication. The CNIL says so in its page on reusing publicly accessible data: the information must be "concise, understandable and easily accessible" (our translation, CNIL, 30 April 2020, accessed 5 October 2026, in French).
In an invitation or a first message, space is short. One possible set-up: a clear sentence on the origin ("I found your profile on LinkedIn") and a link to a short page saying who you are, why you are writing, how long you keep the data and how to have it deleted. This layout is ours, not a template validated by the CNIL.
Is public data on LinkedIn free to reuse?
No. The CNIL says it without ambiguity: data that is "publicly accessible" remains personal data, and it is not freely reusable or exploitable without the people knowing. It also recommends minimising collection, avoiding irrelevant or sensitive information (health, religion, sexual orientation).
For a tool like ours, which extracts the profiles of a search, that gives two reflexes. Keep in your database what prospecting needs: a name, a job title, a company, a profile link. Do not note what you will not use.
What do LinkedIn's terms say, separately from GDPR?
That no third-party tool is allowed to automate or extract. In its page "Prohibited software and extensions", LinkedIn says it does not allow third-party software, including bots, plug-ins and browser extensions, that scrapes, modifies or automates activity on the site. It cites section 8.2 of its User Agreement, which also targets automated sending of messages and adding of contacts (LinkedIn Help, accessed 5 October 2026).
These are two separate grounds. A GDPR-compliant campaign can still breach LinkedIn's terms, and the other way round. The first falls under a public authority, the CNIL; the second is a contract between you and the platform, with sanctions ranging from account restriction to closure. No tool, ours included, guarantees zero risk for your account: our LinkedIn limits page describes the caps and delays that limit exposure.
Where is the data hosted with Sales Farmer?
The application and its data are hosted in the European Union, in Frankfurt. That is an infrastructure fact, not a compliance label: when you prospect, you remain the one who decides why and how the data is used, so generally the data controller under GDPR. Hosting in Europe avoids one question (transfer outside the Union); it does not settle the others.
How long can you keep a prospect's data?
Three years, according to the CNIL's reference framework on managing commercial activities: the data of a prospect who is not a customer can be kept "for a period of three years from their collection" or from the last contact coming from them. A request for documentation or a click on a link counts as contact; merely opening an email does not. After three years you may get back in touch to ask whether the person wants to keep being contacted; otherwise you delete (CNIL, reference framework on commercial activities, accessed 5 October 2026, in French).
What checklist should you follow before launching a campaign?
Five points, in this order:
- Purpose. You know why you are contacting this person, and the subject relates to their profession.
- Minimisation. You keep only the data the campaign needs, and no sensitive data.
- Information. The person knows who you are, where you got their contact and where to read the details, from the first message.
- Objection. A "no" is honoured without discussion: according to the CNIL, a person who objected must not be solicited again, which means keeping an exclusion list. For email, add an unsubscribe link; in Sales Farmer, the sequence stops at a reply anyway.
- Retention. You have set a duration (three years at most per the CNIL for a prospect) and delete what exceeds it.
This list does not cover everything. It does not deal with contracts with your providers, the impact assessment where one is required, or the record of processing activities.
Keep reading
- LinkedIn automation limits in 2026
- France's new phone consent rule: finding sellers without cold calls
- How to define your ICP and build a LinkedIn prospect list
- Limits and account safety
FAQ
Is B2B prospecting on LinkedIn legal in France?
It can be, under conditions: a message related to the person's profession, clear information including the source of the data, and a simple way to object. This answer is a pointer drawn from CNIL pages, not legal advice.
Do you need consent to send a LinkedIn invitation?
For a professional contacted about their job, the CNIL accepts legitimate interest without prior consent. For a private individual, consent is required for electronic prospecting, and the case of a private message on a social network is not expressly addressed in the pages we read.
Can you extract LinkedIn profiles with a tool?
GDPR applies to extracted data, public or not. LinkedIn's terms also forbid scraping and automation by third-party tools: the risk falls on your account.
How long can you keep a prospect in your database?
Three years from collection or from the last contact coming from them, according to the CNIL, then deletion or a new contact to obtain their agreement.
How do you handle a refusal?
By recording it in an exclusion list and not contacting the person again. On LinkedIn, a "no thanks" reply also stops the sequence in Sales Farmer.
Is Sales Farmer GDPR compliant?
We host the application and the data in the European Union, in Frankfurt. The compliance of a campaign also depends on how you use the tool: targeting, message, information, retention.
Prospect with clear limits
Try Sales Farmer free for 14 days, no credit card needed: you set the invitation and message caps, the time slots and the delays between actions yourself.