Is cold email legal in Austria? B2B rules for 2026

No. Austria requires the recipient's prior consent for email sent for direct marketing, and since 2006 that has applied to businesses as well as consumers. A generic info@ address, a named employee's work address and a sole trader all need consent under §174(3) of the Telecommunications Act 2021 (TKG 2021). We found no Austrian authority or court ruling on LinkedIn messages, but the Austrian Economic Chamber (WKO) says direct messages on social media are covered.

Checked on 15 October 2026 against the law text and the regulator's guidance. This is not legal advice.

Unlike Germany, where the consent rule is enforced mostly through private warning letters, Austria has an authority that fines senders, the Fernmeldebüro. For other countries, see cold email laws by country.

At a glance

What does TKG §174 say?

The core rule is §174(3) TKG 2021:

"Die Zusendung einer elektronischen Post [...] ist ohne vorherige Einwilligung des Empfängers unzulässig, wenn die Zusendung zu Zwecken der Direktwerbung erfolgt."

Our translation: "Sending electronic mail (including SMS) without the recipient's prior consent is unlawful if it is sent for the purposes of direct marketing."

• "Empfänger" means any recipient. The Supreme Administrative Court (VwGH) has noted that an amendment in force since 2006 removed the old limit to consumers: "Die Einschränkung auf Verbraucher im Abs 2 entfiel" (VwGH 2012/03/0052).
• Sender and opt-out are always required. Under §174(5), marketing email is unlawful "jedenfalls" (in any case) if the sender's identity is concealed or there is no "authentische Adresse" for stop requests.
• Foreign senders are covered. Under §174(6), an offence committed abroad counts as committed where the message reaches the recipient's connection.

What do the authorities say?

The clearest statements come from the Federal Administrative Court (BVwG), which hears appeals against the Fernmeldebüro's fines. In 2023 it held that even a first email asking for permission is advertising:

"So hat daher bereits die erste E-Mail des Werbenden, die bloß der Erhebung der Kontaktinformation für spätere Werbung dient bzw. mit der um Einwilligung dafür ersucht wird, werblichen Charakter."

Our translation: "Even the advertiser's first email, which merely collects contact information for later advertising or asks for consent to it, is therefore advertising." (BVwG 2 August 2023, W157 2255772-1)

The same decision says contact at a trade fair is not consent, although the WKO, the statutory chamber of commerce (not a regulator), treats business cards handed over at events as at least implied consent. We would follow the court. On B2B, the WKO is clear: "Es gibt keinen Unterschied zwischen Unternehmer:innen und Verbraucher:innen", no difference between businesses and consumers (WKO, page dated 12 October 2026).

Company, employee or sole trader: does it matter?

No. §174(3) protects every recipient, as the decisions show:

• A company address. An advertising email to a GmbH's address led to a fine that stood on appeal (BVwG 19 July 2024, W295 2276552-1).
• A named employee. A sole trader sent one sales email to a named lawyer at an address taken from the law firm's website. The €500 fine stood, because the sender had no consent from the only person entitled to dispose of the address (BVwG 27 May 2025, W603 2304292-1).
• A sole trader. The statute makes no distinction: consent is needed.

Can you send LinkedIn messages to Austrian prospects?

We found no guidance from an Austrian authority or court, after searching the published decisions for LinkedIn, XING, Facebook, Instagram and WhatsApp.

Two things point towards consent anyway. The statute defines electronic mail broadly, as any text, voice, sound or image message sent over a public network that can be stored until collected (§160(3) no. 13). And the WKO writes: "Elektronische Post umfasst E-Mails, SMS, Direktnachrichten via Soziale Medien usw." Our reading: treat a sales DM to an Austrian prospect like an email.

How does GDPR apply?

Austria splits the question in two:

• Sending is a TKG question. The DSB held in October 2025 that sending marketing email is governed "ausschließlich nach den Bestimmungen des TKG 2021", exclusively by the TKG, so Article 6 GDPR is not assessed for the sending (DSB 10 October 2025, 2025-0.813.131).
• Collecting and storing contact data is a GDPR question, judged under legitimate interest (Article 6(1)(f)). The BVwG accepts the trade of address publishers and direct marketers (§151 Trade Act) as a legitimate interest, yet the DSB still ordered a B2B health-sector database to delete a member of parliament's professional data, on purpose limitation and necessity grounds (DSB 3 October 2025).

Ignoring objections is what gets expensive. The BVwG accepted legitimate interest in principle for recruitment contacts, but upheld a €12,800 fine because the contacts continued after the person objected under Article 21 GDPR (W292 2285487-1, 2024). More in GDPR and B2B email under legitimate interest.

Have senders been fined?

Yes, in small amounts that rise with repetition:

• Three emails to a managing director, 2024. A sole trader sent cold sales emails on 9, 13 and 21 August 2024 to the managing director of a GmbH whose address was on the ECG list. The Fernmeldebüro imposed €700 and €800. The BVwG cut the first to €600 and confirmed €800, because the third email went out after the sender had learned the mailings were unlawful (BVwG 23 December 2024, W282 2299749-1).
• One email to a lawyer, upheld in 2025. €500 (W603, above).
• Volume. The VwGH lets the authority raise fines with the number of emails and recipients, up to the maximum. That case concerned 31 advertising emails, originally fined €500 each (VwGH 3 May 2017, Ra 2016/03/0108).

The ceiling is €50,000 per email offence (§188(4) no. 28). According to the WKO, civil claims under the Unfair Competition Act are also possible.

Checklist: B2B email to Austria

1. Get consent before the first email, from the person who controls the address. An email asking for consent is already advertising.
2. Record each consent: when, how and for what.
3. Existing customers only under §174(4): details from a sale or service, your own similar products, an opt-out at collection and in every email, and the address checked against RTR's ECG list.
4. Name yourself and give an authentic stop address in every email (§174(5)).
5. Keep a suppression list and honour objections at once.
6. Document your legitimate-interest assessment for the contact data.
7. Do not cold call businesses either: advertising calls need consent too.

How Leo handles Austrian leads

Revexa builds Leo, a buying-signal agent. Leo blocks only Germany automatically, so Austrian leads are not blocked. In review mode, the default, you read and approve every draft before it is sent and decide yourself; since Austrian law requires consent, skip Austrian leads you have no consent from. Leo writes to each lead in their own language when your website exists in that language, so most Austrian leads get German if your site has German, and otherwise English.

Common questions

Is B2B cold email legal in Austria?

No. §174(3) TKG 2021 requires the recipient's prior consent for marketing email, and since 2006 that has applied to businesses too. The only exception covers existing customers, under four conditions.

Can I send one email asking for permission?

No. The BVwG held in 2023 that a first email asking for consent to future advertising is itself advertising (W157 2255772-1).

What are the fines for cold email in Austria?

Up to €50,000 per offence under §188 TKG 2021. Published B2B fines have been smaller: €500 for one email to a lawyer (upheld in 2025), and €600 plus €800 for three emails to a managing director (2024).

Does GDPR legitimate interest allow cold email in Austria?

No. The data protection authority says sending marketing email is governed exclusively by the TKG, which requires consent. Legitimate interest matters only for collecting and storing the contact data.