Is cold email legal in Estonia? B2B rules for 2026

Yes, to company addresses: section 103¹ of Estonia's Electronic Communications Act (Elektroonilise side seadus, ESS) lets you send marketing email to a legal person without prior consent, if every message gives a clear, free and easy way to refuse that works electronically. A named employee's address counts as the company's when your offer relates to their work and they have decision-making authority in that area, according to non-binding replies from the Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI) to individual enquirers; otherwise treat it as needing prior consent. Sole traders (FIE) are natural persons, so in our reading they need consent. We found no guidance on LinkedIn messages and no published fine for B2B email.

Checked on 25 October 2026 against the law texts and the regulators' guidance. This is not legal advice.

Estonia uses the room that Article 13(5) of the ePrivacy Directive leaves for legal persons, much like Finland and unlike Germany. All countries: cold email laws by country.

Estonia at a glance

What the law says

Section 103¹ has governed marketing email since 10 July 2010. The amendment that added it (RT I 2010, 38, 230) also repealed § 6 of the Information Society Services Act (Infoühiskonna teenuse seadus, InfoTS), the earlier consent rule for natural persons, so sources citing InfoTS § 6 describe repealed law. Subsection 1 allows marketing to a subscriber or user "who is a natural person" only "with the person's prior consent", which the sender must prove (subsection 5). Subsection 2 covers companies:

"Juriidilisest isikust sideteenuse kasutaja või kliendi elektrooniliste kontaktandmete kasutamine otseturustuseks on lubatud juhul, kui: 1) kontaktandmete kasutamisel antakse iga kord selge ja arusaadav võimalus tasuta ja lihtsal viisil keelata oma kontaktandmete selline kasutamine; 2) isikul võimaldatakse oma õigust keeldumisele realiseerida elektroonilise side võrgu kaudu."

Official translation: "The use of electronic contact details of a subscriber or user of communications services, who is a legal person, for direct marketing is allowed if: 1) upon use of contact details, a clear and distinct opportunity is given to refuse such use of contact details free of charge and in an easy manner; 2) the person is allowed to exercise its right to refuse over an electronic communications network."

Subsection 4 bans marketing email to anyone if the sender cannot be identified, if it lacks refusal instructions, if the recipient has refused, or if it breaks InfoTS § 5(2): a commercial communication, meaning information that promotes "the goods, services or image" of a business, must be "clearly identifiable as such" and name its sender. Sources: ESS in Estonian and the official English translation; InfoTS in Estonian and in English. Only the Estonian texts are authentic. The latest English ESS translation covers the version in force until 30 September 2026; § 103¹ reads the same in today's text and in the version that takes effect on 1 November 2026.

What the regulators say

AKI supervises § 103¹ under ESS § 133(4) and enforces it under the Personal Data Protection Act (IKS). TTJA, the Consumer Protection and Technical Regulatory Authority, handles misdemeanours over commercial communications (InfoTS §§ 15 and 16(2)); when it found lenders mailing offers without an opt-out, it informed AKI as the authority for electronic contact details (AKI, updated 27 September 2024). We found no TTJA guidance on email marketing.

AKI on generic addresses (reply of 6 June 2025 to an individual enquiry, not binding, our translation):

"Email addresses that point to a legal person's general contact (info@ettevote.ee, ettevote@ettevote.ee etc.) are the legal person's email addresses, to which no prior consent is needed for sending offers."

Its FAQ, updated 30 June 2026, repeats the conditions of § 103¹(2).

Named employees, sole traders and the first email

An address that points to a person, such as nimi.nimi@ettevote.ee, can be either kind of contact, depending on the recipient's position and what you market. AKI's reply of 11 February 2026 to another enquirer (our translation):

"If the person's function in the company relates, for example, to buying or selling particular products and the person has decision-making authority in that area, offers about products related to their work may be sent to them."

Their details then count as the company's; a theatre festival invitation to a building-materials firm's sales manager, by contrast, needs consent. Details entered in the Commercial Register as the company's contact details count as the company's. AKI notes that the law does not say which positions qualify, and that its answers to such requests give no binding legal assessment of a specific case, which only supervisory proceedings can (AKI, 11 February 2026).

Sole traders are natural persons ("Any natural person may be a sole proprietor", Commercial Code § 3(1)); with no AKI guidance on FIEs, our reading is consent first.

Can a first email ask for consent? AKI's 2026 reply says yes, with a limit: when you found a natural person's details yourself, for example online, give the article 14 information "and ask for consent to send direct marketing offers, but no offer may be sent in the first such contact" (our translation, same reply). Keep it free of any pitch, since anything promoting your image is a commercial communication (our reading).

LinkedIn and social media messages

No guidance found from AKI, TTJA or the courts. ESS § 2(8¹) defines electronic contact details as details for conveying information over an electronic communications network, "including by fax, electronic mail, SMS or MMS messages", an open list. Our reading: treat a LinkedIn sales DM like an email to the same person.

GDPR and AKI

A named employee's work address is personal data even when ESS treats it as the company's. AKI's legitimate interest guide (amended 5 July 2022) lists ordinary direct marketing among typical legitimate interests, but says email marketing to a person needs prior consent outside the existing-customer rule. For company contacts AKI names no GDPR basis; in our reading it is legitimate interest. Give the article 14 information, including where you got the details and why you are writing, as AKI's 2026 answer puts it, and stop on objection: objecting to direct marketing is "Teie absoluutne õigus" (your absolute right) (AKI, updated 13 October 2026), as GDPR article 21(3) provides.

Fines and real cases

ESS has had no offence for breaking § 103¹ since its § 184² was repealed on 1 January 2015. AKI enforces it through precepts backed by penalty payments of up to €20 million or, for a company, 4% of worldwide turnover if higher, each time (IKS § 60); ignoring a GDPR order can bring a misdemeanour fine of the same size (IKS § 69). TTJA can fine a company up to €400,000 for non-conforming commercial communications (InfoTS § 15).

Estonia still has no administrative fines in the GDPR's sense: under recital 151 the fine is "imposed by the supervisory authority in the framework of a misdemeanour procedure" (GDPR), as § 73(2) of the IKS (in force since 15 January 2019; current version since 1 October 2026) still provides; we found no law in force changing this. Such fines can be large: €3 million for Allium UPI, announced on 5 September 2025, over customer data security (B2C), upheld by Harju County Court on 2 September 2026 but not final that day, with 30 days to appeal to the Supreme Court (AKI 2025, AKI 2026).

The one B2B email case we found:

• Staffrent OÜ, 1 March 2024: a precept-warning under ESS § 103¹(4)(5). The staffing firm kept emailing offers to a legal person's address after refusals from 2021 on. AKI ordered it to stop by 8 March 2024, on pain of a €2,500 penalty payment that could be repeated; no fine (AKI, PDF).

We found no published fine for B2B email from AKI, TTJA or a court.

Checklist for B2B email to Estonia

1. Classify every address. General address: opt-out. Named employee: company contact if your offer fits their work and decision-making authority (record why) or the Commercial Register lists the address as the company's contact; otherwise consent. FIE: consent.
2. Name your company and make the email recognisable as marketing (InfoTS § 5(2)).
3. Give a clear, free, easy opt-out in every message that works electronically.
4. Ask natural persons for consent without pitching, with the article 14 information.
5. Keep a suppression list and stop at once for anyone who refuses or objects.

How Leo handles Estonia

Leo, the buying-signal agent Revexa builds, blocks only Germany automatically, not Estonia. In review mode, the default, you read and approve every draft before it is sent, so whether an Estonian address counts as the company's or needs consent is yours to check before you approve. A stop in one channel blocks the person in every channel. Leo writes to each lead in the lead's own language when your website exists in that language, and in English otherwise.

More countries: Czech Republic, Greece, Hungary and Romania.

Common questions

Is B2B cold email legal in Estonia?

To company addresses, yes. ESS § 103¹(2) allows marketing email to a legal person without prior consent if every message offers a clear, free and easy way to refuse. Natural persons need prior consent, which in our reading includes sole traders.

Can I email firstname.lastname@company.ee without consent?

Yes, if your offer relates to the person's work and they have decision-making authority in that area, or if the Commercial Register lists the address as the company's contact; AKI's non-binding replies to enquirers then treat it as the company's. Otherwise you need prior consent.

Can I send a first email asking for consent in Estonia?

In a non-binding 2026 reply, AKI says you may contact a natural person whose details you found, give the GDPR article 14 information and ask for consent, but the first contact must not contain an offer.

Who enforces cold email rules in Estonia?

AKI supervises § 103¹ and the GDPR; TTJA handles commercial communication misdemeanours. In 2024 AKI ordered Staffrent OÜ to stop emailing a company address after repeated refusals, on pain of a €2,500 penalty payment.

Are LinkedIn messages covered in Estonia?

No guidance or ruling found. The law's list of electronic contact details is open, so treat a sales DM like an email (our reading).