Is cold email legal in Finland? B2B rules for 2026

Yes, to an organisation's address: Finnish law lets you send marketing email to a company without consent, as long as every message offers an easy, free way to refuse (section 202 of the Act on Electronic Communications Services, 917/2014). A named employee's address such as firstname.lastname@company.fi counts as a natural person's, so you need prior consent unless your offer is essentially related to their duties, which the Data Protection Ombudsman says you must check and document first. Sole traders are natural persons and, by our reading, need consent. We found no Finnish guidance on LinkedIn messages.

Checked on 15 October 2026 against the law text and the regulator's guidance. This is not legal advice.

Unlike Germany, Finland leaves company inboxes open. All countries: cold email laws by country.

Finland at a glance

What the law says

Electronic direct marketing falls under the Act on Electronic Communications Services (Laki sähköisen viestinnän palveluista, 917/2014). Section 200(1) protects natural persons:

"Automatisoitujen soittojärjestelmien sekä telekopiolaitteiden, sähköpostiviestien, tekstiviestien, puheviestien, ääniviestien tai kuvaviestien avulla toteutettua suoramarkkinointia saa kohdistaa vain sellaisiin luonnollisiin henkilöihin, jotka ovat antaneet siihen ennalta suostumuksensa."

In the ministry's English translation: "Direct marketing by means of automated calling systems, facsimile machines, or email, text, voice, sound or image messages may only be directed at natural persons who have given their prior consent."

Section 202 sets a different rule for organisations:

"Suoramarkkinointia yhteisölle saa harjoittaa, jollei tämä ole sitä nimenomaisesti kieltänyt."

"Direct marketing to legal persons is allowed if the recipient has not specifically prohibited it." The organisation must be able to refuse "easily and at no separate charge" with every message, and you must tell it so clearly. Section 203 adds that the recipient must be able to recognise the message as marketing "clearly and unambiguously". Sources: 917/2014 in Finnish, in Swedish and the English translation (binding only in Finnish and Swedish). The Finnish word yhteisö covers any organisation.

What the Data Protection Ombudsman says

The Ombudsman, who supervises these rules (section 305), confirms the B2B rule in its FAQ:

"The customer's consent is not required if the customer is a corporation. Corporations also have the right to opt out of electronic direct marketing. The controller must provide the corporation or its employee with an easy and free option to prohibit the use of their contact details in connection with every electronic direct marketing message."

Its example of an organisation's address is ostot@yritysx.fi, a purchasing inbox. Source: the Ombudsman's FAQ (archived copy of 30 November 2025; the live site blocked automated access).

Named employees and sole traders

The Ombudsman's FAQ:

"As a rule, email addresses of the form firstname.lastname@company.fi are considered to belong to natural persons. Because the email address belongs to a natural person, you will need their advance consent to direct marketing. Consent for electronic direct marketing is not required, however, if the person in question works in a position essentially related to the goods, services or other commodities being offered via direct marketing."

The Ombudsman calls this "authorisation by position" (asemavaltuus). You "must confirm the individual's position before sending", and "The controller must be able to demonstrate the lawfulness of the processing, for example by documenting their assessment of the authorisation by position."

Section 200 applies to natural persons ("luonnollisiin henkilöihin"), which includes sole traders. We found no guidance on sole traders specifically, so our reading is that they need consent.

LinkedIn and social media messages

No guidance found: the Ombudsman does not mention LinkedIn, social media or private messages, and we found no court ruling. Whether a LinkedIn message counts as one of the "email, text, voice, sound or image messages" in the Act is untested. If it does, the rule for named employees applies: consent, unless the offer is essentially related to the person's duties (our assessment).

GDPR and legitimate interest

The Ombudsman applies 917/2014 and the GDPR together: a legitimate interest under GDPR article 6(1)(f) does not replace consent where section 200 requires it. In its FAQ example, a company with a legitimate interest in its customers' data still "will need to request the customer's consent" to email them direct marketing (we read this as concerning customers who are natural persons outside section 200(3)).

For organisations and for employees covered by authorisation by position, the Ombudsman names no GDPR basis; legitimate interest is the natural one in our assessment. More in GDPR and B2B email under legitimate interest.

Fines and real cases

Breaches of sections 200 to 203 can be punished with a fine for a "data protection violation in electronic communications" (section 349). Processing personal data without a valid legal basis can also bring a GDPR fine of up to €20 million or 4% of worldwide annual turnover, whichever is higher (article 83(5)).

The clearest B2B case: in 2020 the Ombudsman's sanctions board fined Acc Consulting Varsinais-Suomi (Independent Consulting Oy) €7,000 "for sending electronic direct marketing messages without prior consent as well as neglecting the rights of the data subject". It had texted employees about courses, claiming to target corporations; the Deputy Ombudsman found that it "should have separately determined the position of the person in question in the corporation and assessed especially whether the marketed courses were significantly linked to the person’s duties" (press release of 5 August 2020, archived copy).

Checklist for B2B email to Finland

1. Classify every address. Organisation (info@, ostot@): opt-out. Named employee: consent, or a documented authorisation by position. Sole trader: consent.
2. Check the role before the first message and record why your offer relates to it.
3. Make the message recognisable as marketing (section 203) and give "the identity and the contact details of the controller" (GDPR article 14(1)(a)).
4. Offer an easy, free opt-out in every message and say clearly that it exists.
5. Keep a suppression list of everyone who refused.
6. Document your legitimate interest assessment, give privacy information at the latest in your first message (GDPR article 14(3)(b)) and stop at once on objection (article 21(3)).

How Leo handles Finland

Leo, the buying-signal agent Revexa builds, blocks only Germany automatically. For leads in Finland you read and approve every draft in review mode, so you decide whether an address belongs to an organisation, is covered by authorisation by position or needs consent. Leo writes to each lead in the lead's own language when your website exists in that language, and in English otherwise.

Common questions

Is B2B cold email legal in Finland?

To organisations, yes: section 202 of Act 917/2014 allows it unless the organisation has refused, with an easy, free opt-out in every message. Named employees and sole traders need prior consent, unless the offer is essentially related to the employee's duties.

Can I email firstname.lastname@company.fi without consent?

Only if the person's position is essentially related to what you sell. The Data Protection Ombudsman calls this authorisation by position: confirm the position before sending and document your assessment.

Does Finland have a soft opt-in for existing customers?

Yes. Section 200(3) lets you use contact details a customer gave you in a sale to market your own similar products, if you offer an easy, free opt-out when you collect the details and in every message.

Who enforces the cold email rules in Finland?

The Data Protection Ombudsman. In 2020 its sanctions board fined Acc Consulting Varsinais-Suomi €7,000 for marketing courses to employees without assessing whether they related to their duties.

Are LinkedIn messages covered in Finland?

No Finnish guidance or ruling found. Cautiously, treat a sales DM like an email to a named person: consent, unless the offer is essentially related to their job.