Is cold email legal in the Czech Republic? B2B rules 2026

No, not without prior consent. Section 7(2) of the Czech Act No. 480/2004 Coll. on certain information society services allows electronic commercial communications only to "users" who gave prior consent, and the act defines a user as any natural or legal person. The regulator, ÚOOÚ (the Office for Personal Data Protection), says the law does not distinguish between types of recipient, so info@ addresses, named employees and sole traders all need consent, and an email asking for consent counts as marketing too. Existing customers can get offers for your own similar products under a soft opt-in. We found no guidance on LinkedIn messages.

Checked on 25 October 2026 against the law text, the regulator's guidance and its annual reports. This is not legal advice.

The Czech Republic sits with Poland, Austria and Germany: consent first, even in B2B. All countries: cold email laws by country.

The Czech Republic at a glance

What the law says

Section 7(2) of Act No. 480/2004 Coll. implements article 13 of the ePrivacy Directive:

"Podrobnosti elektronického kontaktu lze za účelem šíření obchodních sdělení elektronickými prostředky využít pouze ve vztahu k uživatelům, kteří k tomu dali předchozí souhlas."

Our translation: "Electronic contact details may be used for disseminating commercial communications by electronic means only in relation to users who have given their prior consent." The official collection, e-Sbírka, lists the wording in force since 23 March 2023 as current (readable copy).

The directive requires consent only for "subscribers who are natural persons" (article 13(5)). The Czech act protects more: a user is "každá fyzická nebo právnická osoba" (any natural or legal person) using an information society service (§ 2(e)). A commercial communication is anything intended to promote, directly or indirectly, the goods, services or "image podniku" (image of the business) of an entrepreneur (§ 2(f)).

Every marketing email must also be clearly labelled as commercial, must not hide the sender and must give a valid address for stop requests (§ 7(4)). The offence covers sending "hromadně nebo opakovaně" (in bulk or repeatedly, § 11(2)(a)); ÚOOÚ reads "repeatedly" as sending more than once, even to different people, so any outreach programme qualifies (our reading).

A replacement is pending. The Digital Economy Bill (Chamber print 69) keeps consent for non-customers, limits the customer exception to 2 years from the last commercial message and, as submitted, raises the maximum fine to EUR 20 million or 4% of worldwide turnover. On 25 October 2026 its third reading had not taken place.

What the regulator says

ÚOOÚ's FAQ on the act answers the B2B question directly (ÚOOÚ, our translations):

• Natural or legal person as recipient: "Zákon č. 480/2004 Sb. nerozlišuje mezi typem adresáta" (the act does not distinguish between types of recipient; question 25).
• Contact details freely available online: "Nelze" (you cannot use them; question 10). A bought database of businesses: "Prakticky to není možné" (in practice it is not possible; question 11).
• Consent must come first, relate to a specific sender and be provable by the sender (question 14), and the business being promoted is liable alongside whoever sends (question 21).

A case summary of 23 March 2026 quotes the act's explanatory report: such messages may not go even to addresses that are "obecný kontakt na osobu právnickou" (a general contact of a legal person) (UOOU-05287/24).

Named employees, sole traders and the first email

A named employee's work address is treated like info@: consent first. We found no guidance on whose consent counts for a work address, the employer's or the employee's. Sole traders are covered the same way: ÚOOÚ treats directory offers sent to the email addresses of "společností či podnikajících fyzických osob" (companies or sole traders) as unsolicited commercial communications (annual report 2024).

Can a first email ask for consent? ÚOOÚ (question 13):

"Ne, takovou žádost použít nelze."

Our translation: "No, such a request cannot be used." The request promotes the business, so it is itself a commercial communication. What does not count: a reply that matches a specific inquiry the recipient sent you, if you can prove it (question 2). A like on your LinkedIn post is not such an inquiry (our reading).

LinkedIn and social media messages

We found no ÚOOÚ guidance or court decision on LinkedIn (a search of uoou.gov.cz for the word returns nothing). The act defines electronic mail as any text, voice, sound or image message sent over a public network that can be stored until the user collects it (§ 2(b), our translation), and § 7(2) covers all electronic means. ÚOOÚ's English page adds: "the form of electronic communication is immaterial" (ÚOOÚ). Our reading: a LinkedIn sales message to a Czech recipient needs consent, like an email.

GDPR and ÚOOÚ

ÚOOÚ accepts that processing customers' contact data for direct marketing rests on legitimate interest under Article 6(1)(f), and that after an objection the data may no longer be processed for that purpose (ÚOOÚ, 1 June 2018). That does not settle the sending: GDPR governs the processing of personal data, while Act 480/2004 governs the sending itself (FAQ question 24). For a prospect, legitimate interest cannot replace § 7(2) consent.

Whoever takes contacts from a public database becomes the controller of that data and needs its own GDPR basis (annual report 2024). Say where you got the data "at the latest at the time of the first communication" (Article 14(3)(b) GDPR), and keep a suppression list, which ÚOOÚ calls a "seznam robinsonů" (FAQ question 19). More in GDPR and B2B email under legitimate interest.

Fines and real cases

The maximum fine is CZK 10,000,000 for a company or sole trader and CZK 100,000 for any other individual (§ 11(5)). In 2025 ÚOOÚ received 1,430 complaints and closed 27 proceedings with final fines totalling CZK 12,109,000 (annual report 2025, published 17 March 2026).

The largest B2B cases concern "catalogue" emails: offers to businesses with an attached advance invoice for a directory entry, which ÚOOÚ treats as unsolicited commercial communications.

• 2024: four companies fined for sending without a legal basis, CZK 5,465,000 in total, all final (annual report 2024).
• 2025: three final fines totalling CZK 11,000,000, and two totalling CZK 5,200,000 that were not final at the end of 2025; the senders "cílí výlučně na podnikatelské subjekty" (target businesses exclusively), says ÚOOÚ (annual report 2025).
• UOOU-01642/24, published 23 March 2026: 226 complaints in 2024, contacts from a company-data portal; CZK 5 million, under appeal at the end of 2025 (ÚOOÚ).

Those senders dressed offers up as invoices. Closer to ordinary sales email is UOOU-05287/24, published 23 March 2026: solar subsidy offers emailed to company contacts taken from their websites and search engines. ÚOOÚ found a breach of § 7(2) and imposed a sanction; the amount is not published.

The Supreme Administrative Court held on 2 September 2025 (6 As 68/2025-28, a case about SMS offers) that the sender must be identified in the message itself and that consent must meet the GDPR standard in article 4(11).

Checklist for B2B email to the Czech Republic

1. Get prior consent before the first commercial message, for your company specifically, and keep proof.
2. Do not use addresses from websites, search engines, registers or bought lists.
3. Do not email or message anyone to ask for consent.
4. Answer real inquiries and keep them as evidence.
5. Existing customers: your own similar products only, with an opt-out at collection and in every message.
6. Label every commercial email, name the company behind it and include a working unsubscribe.
7. Inform people under GDPR article 14 and keep a suppression list.

How Leo handles the Czech Republic

Leo, the buying-signal agent Revexa builds, blocks only Germany automatically, not the Czech Republic. Czech law requires prior consent even for company addresses, and you read and approve every draft in review mode, so whether a Czech lead has consented is yours to check before you approve. Leo writes to each lead in the lead's own language when your website exists in that language, and in English otherwise. Leo is the wrong choice if you need software that checks Czech consent for you.

More countries: Estonia, Greece, Hungary and Romania.

Common questions

Is B2B cold email legal in the Czech Republic?

No, not without prior consent. Section 7(2) of Act No. 480/2004 Coll. requires prior consent from every user, and the act counts companies as users too.

Can I email a Czech company's info@ address without consent?

No. ÚOOÚ quotes the act's explanatory report: unsolicited commercial communications may not go even to a general contact of a legal person. ÚOOÚ also says addresses found online or in bought databases cannot be used.

Can I send a first email asking for consent in the Czech Republic?

No. ÚOOÚ says such a request "cannot be used", because it promotes your business and is itself a commercial communication. Replying to a specific inquiry the recipient sent you is different.

Are LinkedIn messages covered in the Czech Republic?

We found no guidance naming LinkedIn, but ÚOOÚ says the form of electronic communication is immaterial, so in our reading a sales DM needs consent too.

What are the fines for cold email in the Czech Republic?

Up to CZK 10,000,000 for companies and sole traders and CZK 100,000 for other individuals. In 2025, ÚOOÚ's final fines for unsolicited commercial communications totalled CZK 12,109,000.