Is cold email legal in Bulgaria? B2B rules 2026

Yes for companies, as long as the address is not in the opt-out register. Article 6 of the Bulgarian Electronic Commerce Act forbids unsolicited commercial email to consumers without their prior consent and to any address entered in the register of legal persons that refuse such messages, which the Commission for Consumer Protection (KZP) keeps. A message sent without prior consent must also be identifiable as unsolicited when it arrives. A work address is not a consumer's, so in our reading a named employee can be emailed without consent too; we found no guidance on named employees, sole traders, consent requests or LinkedIn. Fines under the act reach EUR 2,045.17 for a repeat offence by a company.

Checked on 2 November 2026 against the law texts, the regulators' pages and annual reports. This is not legal advice.

Bulgaria sits with the United Kingdom and Ireland: opt-out for companies, consent for consumers. Like Portugal, it keeps a national opt-out list of companies. All countries: cold email laws by country.

Bulgaria at a glance

What the law says

The act that matters for B2B is the Electronic Commerce Act (Закон за електронната търговия, ZET). The State Gazette's site did not respond, so we read it on lex.bg, a private legal database consolidated up to State Gazette no. 55 of 16 June 2026, and in the ministry's English translation. Article 6 is unchanged since 2006:

"(3) Забранява се изпращането на непоискани търговски съобщения на електронни адреси, вписани в регистъра по ал. 2."

"(4) Забранява се изпращането на непоискани търговски съобщения на потребители без предварителното им съгласие."

Our translation: "(3) Sending unsolicited commercial messages to email addresses entered in the register under paragraph 2 is forbidden. (4) Sending unsolicited commercial messages to consumers without their prior consent is forbidden." Under paragraph 2, KZP keeps that register for legal persons.

Paragraph 1 surprises senders: email sent without prior consent must be clearly recognisable "като непоискано" (as unsolicited) on arrival. The rule follows article 7 of the E-Commerce Directive, written for countries that permit unsolicited email. Article 5(3) adds that commercial messages must be recognisable as commercial and identify who sent them.

The line between consent and opt-out is the consumer: a natural person acquiring goods or services not intended for trade or professional activity (Consumer Protection Act § 13(1) no. 1, read in a secondary database).

The Electronic Communications Act (ZES), which implements the ePrivacy Directive, allows marketing calls, messages or email only with the prior consent of the "потребител" (article 261(1), lex.bg, consolidated up to 21 July 2026, article 261 unchanged since 2011): a natural person using the service for purposes outside their "занятие, стопанска дейност, служба или професия" (occupation, business, office or profession; § 1 no. 49). Our reading: the rule protects people in their private capacity, not business contacts. Article 261(5) forbids any marketing message that hides the sender or lacks a valid opt-out address, in our reading for every recipient.

What the regulator says

KZP's page for traders (KZP) tells senders to get the consumer's prior consent and warns that sending to "юридическите лица, вписани в Регистъра" (legal persons entered in the register) is forbidden too.

KZP's online form checks up to 100,000 addresses per request against the register (KZP). A legal person registers addresses and domains it owns (KZP), protected from the registration date, not the application date (KZP). A 2014 opinion of the data protection authority (KZLD) says the register admits legal and foreign legal persons and is public; the request behind it noted that a registered domain puts every personal address on it in the register (KZLD, 31 January 2014). Check every address, not only info@.

KZP's spam page handles only email and refers Viber, WhatsApp and phone complaints to the Communications Regulation Commission (KRC); complainants must declare that they use the address "за лични нужди" (for personal needs) (KZP).

Named employees, sole traders and the first email

Named employees. We found no guidance from KZP, KRC or KZLD. Our reading: an employee using a work address acts in their job, not as a consumer, and KZP's complaint route asks for a declaration of personal use. GDPR still applies to the name.

Sole traders. A sole trader (едноличен търговец) is a natural person (ZES § 1 no. 50). In our reading, acting in business they are not a consumer and need no consent, but cannot join the register. The ePrivacy Directive protects every subscriber who is a natural person (article 13(5)), so this is the least certain row.

A first email asking for consent. We found no Bulgarian guidance. Our reading: it is an ordinary unsolicited commercial message, allowed to a company outside the register if labelled as unsolicited, and forbidden to a consumer, since it is itself sent without consent.

LinkedIn and social media messages

We found no guidance or court decision on LinkedIn. Article 6 ZET covers "електронната поща" (electronic mail), defined as messages stored and transferred over the internet through standardised protocols (§ 1 no. 8); whether a platform message qualifies is open. Article 261 ZES covers messages generally, but only for consumers. Our reading: a LinkedIn message to a business contact needs no consent; follow the register and labelling rules anyway.

GDPR and KZLD

A name and work address are personal data; legitimate interest under Article 6(1)(f) can support B2B outreach if your balancing test holds. We found no KZLD guidance on B2B email. Say where you got the data when you first write (Article 14) and honour objections. More in GDPR and B2B email under legitimate interest.

The one KZLD decision we found on marketing email concerns a consumer: on 1 December 2022 (complaint PPN-01-70/2022) it warned a bank, without a fine, for emailing a loan offer to a former customer a month after he closed his account and asked for erasure, a breach of Article 24 GDPR (KZLD).

Fines and real cases

Article 24 ZET penalises breaches of article 6(1), (3) or (4); KZP issues the penal decrees (article 25). The act still states leva, but since the euro arrived on 1 January 2026, leva amounts in existing legal instruments count as euro at the fixed rate of 1.95583, rounded to the cent, and fines keep applying on that basis (Euro Introduction Act, articles 11(2), 12 and 13 and § 5(1), consolidated text on a district court's site; rate in Regulation (EU) 2025/1409). Our conversion:

KZP's annual reports give counts and revenue, not names. In 2024 it made 80 inspections on unsolicited messages and missing provider identification, drew up 8 acts establishing an offence, issued 1 penal decree and collected BGN 1,000 in fines under the whole act (report 2024, pp. 14 and 32). In 2025: 87 inspections, 10 acts, 4 penal decrees and BGN 2,000 (report 2025, pp. 18 and 36). The most frequent offences, both say, are messages to consumers and registered legal persons, and missing provider identification. We found no published decision naming a company.

Under the ZES, a seller using the customer exception who ignores a refusal (article 261(4)) faces EUR 2,556.46 to 5,112.92 (BGN 5,000 to 10,000, article 340); breaches with no specific penalty, in our reading including article 261(5), carry EUR 255.65 to 2,556.46 (BGN 500 to 5,000, article 335), also for companies (article 336). We found no published KRC marketing decision. GDPR fines can reach EUR 20 million or 4% of worldwide turnover (Article 83(5)).

Checklist for B2B email to Bulgaria

1. Check every address and domain against the KZP register before each send, and keep the result.
2. Mark the message as unsolicited when sent without prior consent (article 6(1)), and as commercial (article 5(3)).
3. Name the company behind the message and give a valid opt-out address (ZES article 261(5)).
4. Get prior consent for consumers, including a sole trader writing about a private matter.
5. Stop at once when someone objects, and keep a suppression list.
6. Inform people under GDPR Article 14 and document your legitimate-interest test.

How Leo handles Bulgaria

Leo, the buying-signal agent Revexa builds, applies its own automatic rule only to Germany, where nothing is sent without your approval, not even in autonomous mode. Bulgaria has no such rule. In review mode, the default, you read and approve every draft before it is sent, so the KZP register check, the unsolicited label and whether the recipient acts in business or privately are yours to settle before you approve. A stop in one channel blocks the person in every channel. Leo writes to each lead in the lead's own language when your website exists in that language, and in English otherwise. Leo is the wrong choice if you need software that checks the KZP register for you.

More countries: Estonia, Greece, Hungary, Romania, Slovakia, Croatia, Lithuania, Slovenia, Latvia, Cyprus, Malta and Iceland.

Common questions

Is B2B cold email legal in Bulgaria?

Yes, for companies. Article 6 of the Electronic Commerce Act forbids unsolicited email only to consumers without consent and to legal persons entered in the KZP opt-out register. Without prior consent, the message must be identified as unsolicited.

Can I email a Bulgarian company's info@ address without consent?

Yes, unless the address or its domain is in the KZP register, which you can check in bulk on KZP's website. We found no guidance specific to info@, so this is our reading of article 6(3) and (4).

Can I send a first email asking for consent in Bulgaria?

We found no guidance. In our reading it is an ordinary unsolicited message: allowed to a company outside the register if labelled as unsolicited, not allowed to a consumer.

Are LinkedIn messages covered in Bulgaria?

We found no guidance naming LinkedIn. Both Bulgarian consent rules protect only consumers, so in our reading a LinkedIn message to a business contact needs no consent.

What are the fines for cold email in Bulgaria?

Under the Electronic Commerce Act, up to EUR 766.94 for a person, EUR 1,022.58 for a company and EUR 2,045.17 for a company's repeat offence: the act's BGN 1,500, 2,000 and 4,000 at the fixed rate of 1.95583, since Bulgaria adopted the euro on 1 January 2026. Ignoring a customer's refusal under the Electronic Communications Act costs up to EUR 5,112.92. KZP issued 4 penal decrees under the Electronic Commerce Act in 2025.