Is cold email legal? B2B rules by country (2026)

Cold B2B email is legal in some European countries and illegal in others, and GDPR is not what decides it. GDPR governs how you process the contact data, usually on legitimate interest under Article 6(1)(f) with a documented balancing test. Whether you may send the email at all is decided by each country's ePrivacy law, which implements Article 13 of Directive 2002/58/EC. In Austria, Denmark, Germany, Italy, the Netherlands, Poland and Spain, that law requires prior consent even when the recipient is a company.

Checked on 15 October 2026 against the law texts and the regulators' guidance. This is not legal advice.

This guide compares 20 countries: 17 in Europe plus the US, Canada and Australia. Germany has its own page, cold email in Germany (UWG §7). Revexa builds Leo, a buying-signal agent for LinkedIn and email outreach; the last section explains how Leo applies these rules.

The three models in Europe

The ePrivacy Directive requires consent for marketing email only for "subscribers who are natural persons". For everyone else, each member state decides how to protect their "legitimate interests" (Article 13(5)). That is why the answers split into three groups:

1. Consent for every recipient, companies included: Austria, Denmark, Germany, Italy, the Netherlands, Poland and Spain. Switzerland requires consent for automated "mass advertising"; whether one hand-written email counts is unclear.
2. Consent for natural persons only: Belgium and Norway. You may email a generic company address on an opt-out basis, but firstname.lastname@company is a person's address and needs consent, according to the government's report on Belgium's Royal Decree of 4 April 2003 and Norway's Consumer Authority. Luxembourg and Portugal draw the same line in their laws, but no regulator has said where a named employee falls; our cautious reading is consent.
3. Opt-out for companies, including named employees, in some countries only when the message fits their job: the United Kingdom, where an employee's work address belongs to a "corporate subscriber" (ICO); France, under CNIL guidance rather than the law text (CNIL); Finland, only when the offer essentially relates to the person's duties, checked and documented first (Data Protection Ombudsman); Ireland, under regulation 13(2), which the regulator's guidance never mentions (S.I. 336/2011); and Sweden, where only the industry's ethical rules say so (SWEDMA).

Sole traders are natural persons, so they need consent in nearly every country; France and Ireland are unclear. And the directive bans marketing email that hides the sender or lacks "a valid address to which the recipient may send a request that such communications cease" (Article 13(4)).

Poland's rule dates from 10 November 2024: Article 398 of its Electronic Communications Law protects companies and sole traders on equal terms (Ministry of Digital Affairs). Older guides that call Polish B2B email opt-out describe the repealed law.

Which country's rules apply?

Plan for the recipient's. The EU's e-commerce directive lets online services follow their home country's rules, but it excludes "the permissibility of unsolicited commercial communications by electronic mail" (Directive 2000/31/EC, Annex). Austria treats a breach sent from abroad as committed where the message arrives, and Canada and Australia apply their laws to messages read there. In our reading, a Swedish company emailing a Danish prospect follows Danish rules.

GDPR or ePrivacy: which one decides?

Both apply, to different things.

• GDPR covers the data. A name and a work address are personal data. Recital 47 says direct marketing "may be regarded as carried out for a legitimate interest", so B2B outreach can rest on Article 6(1)(f) if your three-part test holds: interest, necessity, balance. Say where you got the data "at the latest at the time of the first communication" (Article 14(3)(b)); an objection is final (Article 21(3)) (GDPR). More in GDPR and B2B email under legitimate interest.
• ePrivacy covers the channel. Where the national rule requires consent, legitimate interest cannot replace it. The UK regulator says legitimate interests can apply "only where the Privacy and Electronic Communication Regulations (PECR) don't require consent" (ICO). Germany's data protection authorities say that if the UWG forbids a channel, "there is no legitimate interest in the first place" (DSK, our translation), and Italy's Garante says marketing email cannot rest on legitimate interest at all (Garante, 2026).

An info@ address with no person behind it is often outside GDPR, but the ePrivacy rule still applies. So the common claim that legitimate interest makes B2B cold email legal across the EU answers only the data question, and lists that put Denmark, the Netherlands, Spain or Italy among the permissive countries miss that their laws require consent even for companies.

Cold email rules by country

"Consent" means prior consent before the first sales email. "Opt-out" means you may send without consent if you name yourself, offer a working unsubscribe and stop when asked. "No guidance found" means none from a regulator or court.

Check the legal form in the company register; for the Nordics, see how to find B2B customers in the Nordics.

Are LinkedIn messages covered?

Five regulators and courts have said in terms that private messages on social platforms fall under the email rule:

• Denmark. The Consumer Ombudsman: "Privatbeskeder er elektronisk post" (private messages are electronic mail) (guidance, 2021). Even a chat message asking whether someone wants marketing is not allowed (Consumer Ombudsman).
• United Kingdom. The ICO counts "direct messaging on social media (ie private messages)" as electronic mail (ICO) and says that messaging someone who uses a professional network "in their personal, albeit professional, capacity" is "not considered B2B marketing". LinkedIn is not named.
• Canada. The CRTC lists "LinkedIn messaging" as sending messages to "electronic addresses" under CASL (CRTC).
• Germany. The Higher Regional Court of Hamm listed LinkedIn among the social media services whose messages are electronic mail (OLG Hamm, 3 May 2023), in a case about private recipients that ended without a final judgment.
• Italy. The Garante's 2013 guidelines put marketing messages to social network users under the consent rule. In 2021 and again in April 2026 it said LinkedIn users are not expected to use the platform "for the purpose of selling products or services" (our translation; La Prima, Aesir).

Weaker signals: Norway's Consumer Authority says social media raise "the same considerations" as email (our translation); Belgium's economy ministry, the Dutch ACM and Spain's AEPD apply their email rules to chat or WhatsApp; and a 2015 FTC blog post cites US district courts. We found no guidance in the other ten countries, and none anywhere on connection requests with a sales note.

The safe reading: a sales DM on LinkedIn follows the same rule as an email to that person in that country. For LinkedIn's own limits, see LinkedIn outreach without restrictions.

Real penalties for B2B email

Penalties grow with volume: Ireland counts each email as a separate offence, and a Danish court started from DKK 100 per email. The B2B cases we could document from primary sources, all email except Finland's text messages:

Germany has no fining authority for B2B email; enforcement is civil, through warning letters (Abmahnung) and injunctions from competitors, associations or the recipient. We found no B2B email fine in Australia, Belgium, France, Luxembourg, Norway, Portugal, Sweden, Switzerland or the UK; where cases exist, they concern consumers, data collection or calls.

The UK in 2026: new regulator, higher fines

• New name. On 30 September 2026 the Information Commission replaced the Information Commissioner's Office, with the same "role, responsibilities, or powers" (gov.uk). The website is still ico.org.uk.
• Higher fines. For PECR breaches on or after 5 February 2026, the cap is £17.5 million or 4% of worldwide annual turnover, whichever is higher (DPA 2018 s. 157 as applied to PECR; transition in SI 2026/82). Earlier breaches keep the old £500,000 cap, which the regulator's own What are PECR? page, marked as under review, still gives. We found no decision under the new cap.
• The B2B rule is unchanged. Email to corporate subscribers needs no consent; sole traders and ordinary partnerships do. UK GDPR Article 6(11) now names direct marketing as an example of a legitimate interest; the balancing test still applies.

The US, Canada and Australia

• United States: opt-out. CAN-SPAM does not ban cold email, and "the law makes no exception for business-to-business email" (FTC). Each message needs honest headers and subject line, an ad label, a physical postal address and an opt-out honoured within 10 business days. Penalties reach $53,088 per email.
• Canada: consent. CASL requires express or implied consent. Consent can be implied when the person published their address conspicuously, or gave it to you, without a no-spam note and the message fits their role. An email asking for consent is itself a commercial message. Companies face up to CAD 10 million per violation.
• Australia: consent. Under the Spam Act, consent "may not be inferred from the mere fact that the relevant electronic address has been published", but a conspicuously published work address can give inferred consent for messages about the person's work. ACMA says: "You cannot send an electronic message to ask for consent" (ACMA).

Checklist for B2B email in Europe

1. Find the recipient's country and legal form. A limited company and a sole trader fall under different rules in most countries.
2. Match the address to the table. Where consent is required, do not send, and do not email to ask for it: Denmark, Austria and Italy treat that as marketing too.
3. Write about their job. France, Finland, Ireland and the Swedish industry rules make relevance to the role a condition, and in our reading it also weighs in the GDPR balancing test.
4. Document your legitimate interest assessment before the first send: purpose, necessity, balance.
5. Name the sender and include a working opt-out in every message, and say where you got the data in the first one at the latest.
6. Honour objections at once, in every channel, and keep a suppression list so a person who said no never returns.
7. Check opt-out registers: Austria's ECG list (RTR) and Portugal's list of companies that refuse marketing (DGC).
8. Treat LinkedIn messages like email in the recipient's country.
9. Keep evidence of where and when you found each address and why the message fit the role; Finland's regulator expects it.

How Leo handles this

• Germany is blocked automatically. Leo sends no cold messages to leads in Germany (UWG §7). It is the only country Leo blocks automatically.
• Everywhere else, you decide. Review mode is the default: you read and approve every draft before it is sent. A lead in Denmark, Poland or Spain is not stopped automatically, so the judgement in this table is yours. Autonomous mode can be switched on per channel; if your list includes consent countries, keep review mode on.
• A stop is a stop. An opt-out in one channel blocks the person in every channel.
• Language. Leo writes to each lead in the lead's own language when your website exists in that language, for example German, French, Spanish or Dutch, and otherwise in English.

Leo is the wrong choice if you need software that enforces every country's consent rules for you. The verified facts about Leo, including its compliance rules, are on our facts page.

Common questions

Is B2B cold email legal in Europe?

It depends on the recipient's country. Austria, Denmark, Germany, Italy, the Netherlands, Poland and Spain require prior consent even for companies. The UK, France, Sweden, Finland and Ireland allow opt-out email to companies, and Belgium and Norway only to generic addresses.

Does GDPR legitimate interest make cold email legal?

Not on its own. Legitimate interest under Article 6(1)(f) can cover processing the contact data, but where a national ePrivacy law requires consent for email, it cannot replace that consent. The UK regulator says legitimate interests apply "only where" PECR does not require consent.

Which European countries require consent for B2B cold email?

For every recipient: Austria, Denmark, Germany, Italy, the Netherlands, Poland and Spain, plus Switzerland for automated sending. For named employees, also Belgium and Norway, and in our cautious reading Luxembourg and Portugal. Sole traders need consent in nearly every country.

Can I send cold LinkedIn messages to European prospects?

Treat them like email. Denmark and the UK count private messages on social media as electronic mail, as a German appeal court did for LinkedIn; Canada's CRTC puts LinkedIn messaging under its anti-spam law, and Italy's Garante says LinkedIn is not meant for selling. Most other countries have no guidance.

Do my country's rules apply, or the recipient's?

Plan for the recipient's. The EU e-commerce directive excludes unsolicited commercial email from its home-country principle, and Austria, Canada and Australia apply their laws to messages that reach recipients there.