Is cold email legal in Croatia? B2B rules 2026

Yes for companies, with conditions. Article 50(4) of Croatia's Electronic Communications Act (ZEK, NN 76/22) lifts the prior-consent rule for direct marketing messages sent to legal persons, so cold B2B email to a company address needs no consent as long as you name the sender and give a free way to stop. HAKOM and AZOP both read the exemption that way in 2019. Consent is still the rule for natural persons, in our reading including sole traders (obrtnici). Whether a named employee's work address counts as the company's is unclear. We found no guidance on LinkedIn messages.

Checked on 2 November 2026 against the law text, the regulators' guidance and decisions. This is not legal advice.

Croatia sits with Hungary: the law protects natural persons only, and the named work address is the open question. All countries: cold email laws by country.

Croatia at a glance

What the law says

Croatia transposes article 13 of the ePrivacy Directive in Article 50 of the Electronic Communications Act, NN 76/22. The later amendments, NN 14/24 and NN 45/26 (in force since 7 May 2026), leave Article 50 untouched (consolidated text, unofficial). Paragraph 1:

"Uporaba ... elektroničke pošte, uključujući SMS poruke i MMS poruke, u svrhu izravne promidžbe i prodaje dopuštena je samo uz prethodno pribavljenu privolu krajnjeg korisnika."

Our translation: "The use of ... electronic mail, including SMS and MMS messages, for direct promotion and sales is permitted only with the end user's prior consent."

Paragraph 4 removes legal persons from that rule:

"Odredbe stavaka 1. i 2. ovoga članka ne primjenjuju se na komunikaciju iz stavka 1. ovoga članka prema pravnim osobama u svrhu izravne promidžbe i prodaje."

Our translation: "The provisions of paragraphs 1 and 2 of this article do not apply to the communication referred to in paragraph 1 towards legal persons for the purpose of direct promotion and sales." Until 2022, the old act's Article 107(4) said "pozive" (calls) instead.

The line matches the ePrivacy Directive, which requires consent only for "subscribers who are natural persons" (article 13(5)).

Paragraph 3 applies to every recipient, companies included: no false or hidden sender, and no email without a valid address or number to which the recipient can send, "bez naknade" (free of charge), a request to stop.

A second law points back to the first. Article 8 of the E-commerce Act allows unsolicited email only with "prethodni pristanak osobe" (the prior consent of the person) it is meant for, "u skladu sa zakonom" (in accordance with the law) on electronic communications. Read alone, "person" can include a company. Our reading: that reference brings in the ZEK and its paragraph 4, but it can also be read as adding the ZEK on top of consent. We found no decision applying Article 8 to B2B email, so a residual risk remains (company fines HRK 5,000 to 100,000, art. 23, still in kuna).

What the regulators say

HAKOM's consumer page says marketing by phone, email, SMS or MMS needs "Vašu prethodno dobivenu privolu" (your prior consent) (HAKOM). It does not mention companies, but HAKOM's inspector did in a decision of 4 March 2019 against a seller of business databases: under the legal person exemption, the consent rules "primjenjuju se samo na potrošače" (apply only to consumers) (KLASA UP/I-344-07/19-01/03).

The data protection authority AZOP said the same in a reply on marketing that its site dates 19 April 2019: "Citirane odredbe predmetnog članka ne primjenjuju se na pozive pravnim osobama" (the cited provisions do not apply to calls to legal persons; "calls" was the old act's word). It adds that a business address identifying a person is personal data under GDPR (AZOP); it is a reply to an enquiry, not a binding decision.

AZOP's 2026 legitimate interest recommendation says that for newsletters "pravilo je prethodna privola iz članka 50. stavka 1." (the rule is prior consent under Article 50(1)) and does not mention paragraph 4 (AZOP). Our reading: it does not withdraw the 2019 statements, but do not rely on silence.

Named employees, sole traders and the first email

Named employees. A firstname.lastname@company mailbox is the company's, but it names a natural person, and AZOP calls it personal data. No regulator says which view wins. Our reading: opt-out is arguable, consent is the cautious route, and the message should fit the person's role either way.

Sole traders. The Crafts Act defines an obrtnik as a "fizička osoba" (natural person) working in their own name (Zakon o obrtu, art. 4). Paragraph 4 covers only legal persons, so our reading is that a sole trader needs consent. No regulator has ruled on a registered sole trader: HAKOM's 2019 decision required consent for a freelance photographer listed in a freelancers' database who had no registered business, and its "only consumers" wording is looser than the law.

Soft opt-in. Paragraph 2 covers addresses obtained in a sale from "svojih potrošača" (its consumers), for own similar products, with a free objection at collection and in every message. Companies do not need it; whether a sole trader customer is a consumer is unclear.

A first email asking for consent. No guidance found; companies need no consent anyway.

LinkedIn and social media messages

No guidance found from HAKOM, AZOP or a court on LinkedIn or other social platforms. In our reading a LinkedIn message is electronic mail under the ZEK, which covers any text, voice, sound or image message sent over a public network that can be stored until collected (art. 5(1) point 15). Its recipient is a person, so treat it like email to a named employee.

GDPR and AZOP

GDPR covers the data, the ZEK the channel. Say where you got a named person's data "at the latest at the time of the first communication" (GDPR art. 14(3)(b)). After an objection to direct marketing the data "shall no longer be processed for such purposes" (art. 21(3)), with no further balancing, says AZOP. More in GDPR and B2B email under legitimate interest.

Fines and real cases

Article 170(1) of the ZEK fines a company EUR 13,270 to EUR 132,720 for marketing email sent without the required consent or without a valid stop address (points 13 and 15; 19 and 21 before NN 45/26). A responsible person risks up to EUR 13,270 and a natural person up to EUR 6,630 (double if done for gain), and equipment can be confiscated (art. 170(2) to (5)). GDPR fines reach EUR 20 million or 4% of turnover (art. 83(5)).

The one B2B case we found: HAKOM, 7 July 2020 (KLASA UP/I-344-07/20-01/26). A company complained that the 2019 database seller had emailed it for seven years. The inspector found that it had replied "Odjava" (unsubscribe) on 28 November 2016 and still got offers on 7 December 2018 and 19 January 2020, with no clear stop address; the seller called them B2B offers to a published generic address. The complaint invoked the consent rule, but the inspector found a breach of paragraph 3 only (then art. 107(3)), ordered the seller to stop and add a stop address, and set no fine. After a new complaint, an enforcement order of 31 July 2020 threatened its responsible person with a HRK 50,000 fine if it did not comply. Applying only paragraph 3 fits the legal person exemption (our reading).

HAKOM's other recent Article 50(1) decisions ban robocalls (28 August 2024 example). We found no published fine for B2B email from HAKOM or AZOP, and AZOP's 2025 report gives no B2B breakdown.

Checklist for B2B email to Croatia

1. Check the legal form. A d.o.o. or d.d. is a legal person; an obrt is a natural person.
2. Company addresses (info@): no consent needed, in our reading of Article 50(4).
3. Sole traders: get consent first (our reading).
4. Named people and LinkedIn: consent is the cautious route; at the least, write only about their role.
5. Name the sender, give a free way to stop and act on a stop at once, in every channel; the B2B decision we found was about ignored unsubscribes.
6. Say where you got the data and keep a suppression list.

How Leo handles Croatia

Leo, the buying-signal agent Revexa builds, applies its own automatic rule only to Germany, where nothing is sent without your approval, not even in autonomous mode. Croatia has no such rule. For each Croatian lead the question is whether the address is the company's, a named person's or a sole trader's. In review mode, the default, you approve every draft, so that check is yours. Leo writes in the lead's own language when your website exists in it, and in English otherwise. Leo is the wrong choice if you need software that checks Croatian recipient types for you.

More countries: Czech Republic, Greece, Hungary, Romania, Slovakia, Bulgaria, Lithuania, Slovenia, Latvia, Cyprus, Malta and Iceland.

Common questions

Is B2B cold email legal in Croatia?

Yes for companies, with conditions. Article 50(4) of the Electronic Communications Act (NN 76/22) lifts the consent rule for marketing messages to legal persons. You must still name the sender and give a free way to stop.

Can I email a Croatian company's info@ address without consent?

In our reading, yes. Article 50(4) exempts communication to legal persons, and HAKOM and AZOP both said in 2019 that the consent rules do not apply to them. A named sender and a free stop address are still required.

Can I email a sole trader or a named employee without consent?

In our reading a sole trader needs consent, as the Crafts Act makes them natural persons. For a named employee's work address we found no guidance; consent is the cautious route.

Are LinkedIn messages covered in Croatia?

We found no guidance naming LinkedIn. In our reading a sales DM to a person follows the rule for email to that person.

What are the fines for cold email in Croatia?

Up to EUR 132,720 for a company under the ZEK, plus GDPR fines up to EUR 20 million or 4% of turnover. We found no published fine for B2B email.