Is B2B Cold Email Legal in the EU? GDPR, ePrivacy and Country Rules

Short answer: B2B cold email is not legal everywhere in the EU, and the rules differ by country. The ePrivacy Directive requires consent for e-mail marketing to individuals but lets each member state decide how far that protection extends to businesses. Poland, Germany and Spain require prior consent for marketing e-mails to companies too. France allows B2B e-mail on an opt-out basis if the message relates to the recipient’s job. Replying to inquiries and contacting people who left their details with consent is fine everywhere.

This is not legal advice. This article summarises the legal texts and public guidance from regulators and law firms as of October 2026. Before any campaign that contacts people who haven’t approached you, talk to a lawyer in each target country.

Two layers of EU law

Cold outreach in Europe sits under two sets of rules that are often confused.

• GDPR governs personal data. A named business address such as jane.doe@company.com is personal data, so you need a legal basis to use it, you must inform the person (art. 14 GDPR when you didn’t collect the data from them) and you must honour objections. GDPR recital 47 accepts that direct marketing can be a legitimate interest, which is why some people say “GDPR allows cold email”.
• The ePrivacy Directive (2002/58/EC), art. 13 governs unsolicited communications. E-mail, SMS, fax and automated calls for direct marketing need prior consent from individual subscribers, with a narrow exception for existing customers buying similar products. For human phone calls, and for how much of this protects legal persons (companies), each member state chooses its own approach.

That second point is the key. Because the directive left B2B to national law, a campaign that is defensible in one country can breach the law in the next.

Country by country

Poland: art. 398 PKE

Since 10 November 2024 art. 398 of the Electronic Communications Law (Prawo komunikacji elektronicznej) bans using telecom terminal equipment, including e-mail and phone, for direct marketing without the subscriber’s or end user’s prior consent. Commentaries agree that end users include businesses and their employees, so there is no B2B exception. The Polish telecom regulator (UKE) can fine up to 3% of the previous year’s revenue (art. 446(5) PKE), and the consumer authority (UOKiK) acts where consumers are targeted. In a July 2026 decision UOKiK fined a company and a board member a combined PLN 408.7k for telemarketing without consent and said that buying a phone database was not proof of consent (coverage at interaktywnie.com).

Germany: §7 UWG

§7(2) no. 2 UWG requires prior express consent for advertising by e-mail and makes no distinction between consumers and companies. For phone calls to businesses, §7(2) no. 1 accepts “presumed consent”, which courts read narrowly: there must be a concrete reason to assume this company is interested in this offer. Consequences in B2B come mainly through cease-and-desist letters (Abmahnungen) from competitors and associations, and claims by the company you e-mailed. The Federal Court of Justice (BGH) has held that even a single unwanted advertising e-mail to a business can support an injunction (I ZR 218/07, VI ZR 721/15).

France: CNIL and opt-out for professionals

The CNIL distinguishes professionals from consumers. E-mail prospecting to a professional is allowed without prior consent if the subject relates to the person’s job, as long as they are informed and can object easily. Consumers must opt in. For phone calls, law no. 2025-594 of 30 June 2025 requires prior consent for calls to consumers from 11 August 2026; according to published analyses, calls between professionals are not covered, but GDPR and the right to object still apply.

Spain: LSSI art. 21

Art. 21 of the LSSI prohibits advertising e-mails that the recipient has not requested or expressly authorised, unless there is a prior contractual relationship and you market similar products. Spanish guidance and the data protection authority (AEPD) apply it to B2B too. Mass sending in breach of art. 21 is a serious infringement under the LSSI, with fines of €30,001 to €150,000. For calls, art. 66.1.b of the General Telecommunications Law (Ley 11/2022) gives end users the right not to receive unsolicited commercial calls unless they consented or there is another GDPR basis; AEPD Circular 1/2023 says a legitimate interest must be weighed and documented.

What is allowed almost everywhere

Five myths about B2B cold email

• “Only consumers are protected.” Not in Poland, Germany or Spain, where the rules cover companies too.
• “The address is public, so they want offers.” An address on a website or in an imprint is there for customers, not for marketing.
• “An unsubscribe link is enough.” In consent-based countries, an opt-out link does not replace consent before the first message.
• “The list we bought has consent.” Consent is given to a specific sender for a specific channel.
• “It’s just one e-mail asking for permission.” In Poland and Germany that request can itself count as marketing.

Collecting consent properly

• Separate by channel. One unticked checkbox for e-mail, one for phone.
• Plain wording. Who will contact the person, by which channel, for what.
• Records. Date, source, consent text and person. Under GDPR you must be able to prove consent.
• Easy withdrawal. As easy as giving consent, and effective in every channel at once.

Your website form is the simplest place to do this well. See how we build landing pages with a qualifying form and separate consents.

What works instead of cold email

When cold outreach is off the table, the channels left are the ones where buyers come to you: search and AI answers, ads on buying-intent keywords, tenders and RFQ platforms, events and webinars, and referrals. We compare nine methods in the best way to generate B2B leads, and cover the basics in what is lead generation. If you’re thinking of buying leads instead, read buying B2B leads: what to check first.

Our position

We work with inbound leads only: inquiries from companies that stated a need and agreed to be contacted. We don’t send cold e-mails, don’t call lists and don’t sell contact data. Partly because the law is strict, and partly because a company that asked for a quote turns into a customer far more often than one that received an unsolicited offer.

Checklist for your sales team

• No marketing e-mails or calls without documented consent in consent-based countries.
• No bought contact lists for e-mail or phone marketing.
• Forms with separate, unticked consents for e-mail and phone.
• A register of consents and withdrawals.
• Legal review per target country before any outbound campaign.

This is not legal advice. Laws and enforcement practice change, and every case depends on its facts.

Leads without the consent headache

We build inbound channels for B2B companies: search, AI answers, landing pages and lead qualification, with consent collected from the first contact. See how our B2B lead generation works and book a free discovery call about lawful lead sources in your market.