GDPR and Cold Email: B2B Rules, Legitimate Interest and Country Differences (2026)
GDPR and cold email, in short: GDPR does not ban B2B cold email. Emailing a named person at a company can rest on legitimate interests (Article 6(1)(f)) if you document a balancing test, tell them where you got their data in the first email (Article 14), and stop when they object (Article 21). But each EU country's e-marketing law decides whether you may send at all, and Germany, Austria, Italy, Spain and the Netherlands require opt-in consent even for B2B.
More on this topic: Cold email and deliverability, every guide in one place.
Most confusion about GDPR and cold email comes from treating it as one rule. It is two. GDPR governs whether you may process a person's data, and it is the same across the EU. The ePrivacy rules, written into each country's own law, govern whether you may send them unsolicited electronic marketing, and they differ by country. Pass both, and the email is lawful. This guide covers each layer and a practical checklist.
Key takeaways
- Two layers: GDPR (lawful basis for the data) and national ePrivacy law (whether you may send unsolicited email).
- Lawful basis: legitimate interests, Article 6(1)(f); Recital 47 says direct marketing may be a legitimate interest.
- Tell them the source: Article 14 requires a privacy notice, including where you got the data, at the latest in the first email.
- Objections are absolute: under Article 21, once a person objects to direct marketing you must stop.
- Country rules vary: Germany, Austria, Italy, Spain and the Netherlands require opt-in even for B2B; France allows B2B email on an opt-out basis.
- Fines: up to €20 million or 4% of worldwide annual turnover under GDPR; ePrivacy penalties are national.
Is cold email legal under GDPR?
Yes, GDPR permits B2B cold email when you have a lawful basis for processing the person's data — usually legitimate interests — and meet its transparency and objection rules. GDPR is not an opt-in law for email. Whether you may send without consent is decided separately, by the recipient's country.
GDPR applies because a named work address such as jane.doe@company.com is personal data: it identifies a living person. It applies to anyone processing the data of people in the EU, wherever the sender is based. The UK has its own version, covered in is cold email legal in the UK.
What lawful basis do you need for B2B cold email?
Most B2B cold email relies on legitimate interests under Article 6(1)(f). Recital 47 states that processing for direct marketing purposes may be regarded as a legitimate interest, but only after you weigh your interest against the person's rights and reasonable expectations.
That weighing is called a legitimate interests assessment, and you should write it down before the campaign. It answers three questions.
| Test | Question | What a B2B answer looks like |
|---|---|---|
| Purpose | What is the legitimate interest? | Offering a product relevant to the person's job |
| Necessity | Is processing this data needed for it? | A name, role, company and work email only; nothing personal |
| Balance | Would the person reasonably expect this, and is the impact low? | Someone in that role would expect relevant vendor emails; easy opt-out; few messages |
The balance fails quickly for private addresses, for people whose role has nothing to do with your offer, and for long, aggressive sequences. Consent is the alternative basis, but for a first cold email you do not have it, which is why legitimate interests is the practical route.
What must the first cold email say under GDPR?
Article 14 requires you to give people the privacy information when you did not get their data from them, and if you use the data to contact them, at the latest at that first contact. In practice: a short line in the first email and a link to a full notice.
- Who you are and how to contact you.
- Why you are processing their data and the legal basis (legitimate interests), with what that interest is.
- Where the data came from — for example, their company website or a named data provider.
- How long you will keep it, or how you decide.
- Their rights, including the right to object and to complain to a regulator.
A one-line version in the email might read: “I found your address on your company's website and am contacting you about [relevant topic] on the basis of legitimate interest. Reply ‘no’ or click unsubscribe and you won't hear from us again. Our privacy notice: [link].”
Under Article 21, a person can object to direct marketing at any time, and you must then stop processing their data for it — no balancing test. Keep their address on a suppression list so you never email them again; holding that minimal record is how you honour the objection.
Want to see what your own numbers look like? Start a workspace and price it against the table above.
Start free14-day free trial · No credit card required
Which EU countries require consent for B2B cold email?
Germany, Austria, Italy, Spain, the Netherlands, Poland, Denmark and several others require opt-in consent for marketing email even to business addresses, according to a country-by-country survey by the law firm Fieldfisher. France, Hungary, Estonia and Luxembourg allow B2B email on an opt-out basis, and Ireland and Sweden allow it when the email relates to the recipient's professional role.
| Country | B2B email from your own list (first party) | National law |
|---|---|---|
| Germany | Double opt-in; opt-out only where soft opt-in applies | Act Against Unfair Competition (UWG) |
| Austria | Double opt-in; opt-out only where soft opt-in applies | Telecommunications Act |
| Italy | Opt-in | Personal Data Protection Code |
| Spain | Opt-in; opt-out where soft opt-in applies | LSSI (Law 34/2002) |
| Netherlands | Opt-in; opt-out where soft opt-in applies | Telecommunications Act |
| Poland | Opt-in | Act on e-Services; Telecommunications Law |
| Belgium | Opt-in for an individual's work address | Code of Economic Law |
| France | Opt-out | Postal and Electronic Communications Code, L34-5 |
| Ireland | Opt-out if it relates to the recipient's professional role; otherwise opt-in | ePrivacy Regulations 2011 |
| Sweden | Opt-out if it relates to the recipient's professional role; otherwise opt-in | Marketing Practices Act |
| Finland | Opt-in for a personal work address; opt-out for generic or role-related addresses | Information Society Code |
| Hungary, Estonia, Luxembourg | Opt-out | National e-marketing laws |
Source: Fieldfisher, Email Marketing Across Europe, January 2024. “Soft opt-in” covers existing customers buying similar products, so it rarely helps a genuinely cold email. Treat the table as a starting point and check the regulator in each country you target. The rule that matters is where the recipient is: segment a mixed list by country and leave out opt-in countries unless you have consent.
Germany: is B2B cold email allowed?
No, not without consent. Section 7(2) no. 2 of the Act Against Unfair Competition (UWG) treats advertising by electronic mail without the recipient's prior express consent as an unreasonable nuisance, and it draws no line between consumers and businesses. The only exception, Section 7(3), covers existing customers: you got the address in a sale, you advertise your own similar products, the customer has not objected, and every email says they can object at any time. In practice the UWG is enforced by competitors and associations through cease-and-desist letters and court injunctions, while the state data protection authorities handle the GDPR side. A cold email to a German prospect is the riskiest case in this table. Our guide to cold email in Germany covers the court decisions, required email details and enforcement in full.
France: is B2B cold email allowed?
Yes, on an opt-out basis, if the message relates to the recipient's profession. The CNIL, France's data protection regulator, says professionals do not have to consent in advance but must be told their address may be used for prospecting and be able to object; its example is selling software to a company's IT director. Every message must identify the sender and offer an easy way to refuse further email. Generic company addresses such as contact@ or info@ belong to the company rather than a person, and the CNIL says these principles do not apply to them.
Germany: UWG Section 7, checked on gesetze-im-internet.de; France: CNIL guidance on commercial prospecting by email, checked on cnil.fr, both on 26 October 2026. Not legal advice.
What are the penalties for breaking GDPR with cold email?
GDPR fines reach €20 million or 4% of worldwide annual turnover, whichever is higher, for breaches of the lawful-basis and data-subject-rights rules. Breaches of national e-marketing laws carry national penalties, and in some countries competitors can sue too.
For a small company the realistic risks are a complaint to a regulator, an order to stop, a fine scaled to the business, and the deliverability damage that comes from recipients marking mail as spam. The last one tends to arrive first.
A GDPR cold email checklist
A GDPR-compliant cold email programme documents its basis, keeps data minimal, tells people where their data came from, and makes objecting easy. Work through this before the first send.
- Write the legitimate interests assessment for this campaign and keep it.
- Collect only name, role, company and work email.
- Record the source of every contact.
- Segment by country and drop strict-consent countries without consent.
- Put the Article 14 line and a privacy link in the first email.
- Keep sequences short and relevant; three or four touches, not ten.
- Honour objections everywhere, immediately, and keep a suppression list.
- Delete non-responders after a retention period you have set and stated.
For the US and Canada, see CAN-SPAM rules and CASL rules. For writing emails people want to receive, see what to personalise in cold email.
In Scalry, which publishes this guide, every cold email carries your business name, postal address and an unsubscribe link, and an unsubscribe suppresses the contact across all campaigns. The assessment, the source records and the country rules are yours.
Summarised from the GDPR (Articles 6, 14, 21 and 83 and Recital 47) and Fieldfisher's January 2024 survey of national e-marketing rules, checked on 25 October 2026. National positions change and are interpreted by each regulator; this is a plain-English summary, not legal advice.
Frequently asked questions
Is cold email legal under GDPR?
GDPR permits B2B cold email on the basis of legitimate interests if you document a balancing test, give the privacy information at first contact and honour objections. National e-marketing laws then decide whether you may send without consent.
Do I need consent to send B2B cold email in the EU?
It depends on the country. Germany, Austria, Italy, Spain, the Netherlands and Poland require opt-in even for B2B. France allows B2B email on an opt-out basis, and Ireland and Sweden allow it when it relates to the recipient's professional role.
Is a work email address personal data?
Yes, if it identifies a person, such as jane.doe@company.com. Generic addresses like info@ usually are not, though e-marketing rules still apply to them.
What is a legitimate interests assessment?
A written record of your purpose, why the data is necessary, and why the person's rights do not override your interest. Write one per campaign type before sending.
Do I have to say where I got someone's email?
Yes. Article 14 requires you to tell people the source of their data, at the latest when you first contact them.
What is the maximum GDPR fine?
Up to €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious breaches.
How Scalry handles identification, unsubscribes and suppression is described on the cold email page.
Write the assessment and segment by country before the next EU campaign — both take an hour and remove most of the risk. You can rebuild one real campaign inside Scalry before moving anything else.
Start your free trialSee pricing14-day free trial · No credit card required
Build a workspace, import a real list, and run one campaign end to end before you decide anything.
14-day free trial · No credit card required
