Is cold email legal in Iceland? B2B rules 2026

Partly: generic company addresses such as info@ need no consent, but everyone else, named employees included, needs prior informed consent unless they are your existing customers. Article 94 of Iceland's Electronic Communications Act No. 70/2022 allows email for direct marketing only when the end user has agreed in advance, and its fourth paragraph carves out "almenn tölvupóstföng fyrirtækja og stofnana" (general email addresses of companies and institutions). The regulator, Fjarskiptastofa (the Electronic Communications Office), says email to addresses assigned to individual employees is prohibited, and so is an email asking for consent. We found no guidance on LinkedIn messages.

Checked on 2 November 2026 against the law texts, the regulator's guidance and its published decisions. This is not legal advice.

Iceland sits with Norway: generic company inboxes are open, named people are not. Denmark and Germany require consent even for those. All countries: cold email laws by country.

Iceland at a glance

Why the EEA matters

Iceland is not in the EU, but the EEA Agreement obliges it to adopt EU internal market law, which it does through its own acts. The ePrivacy Directive 2002/58/EC was incorporated by EEA Joint Committee Decision 80/2003 (EFTA EEA-Lex), and the GDPR has the force of law in Iceland "eins og hún er tekin upp í samninginn um Evrópska efnahagssvæðið" (as incorporated into the EEA Agreement; Act 90/2018, art. 2). Fjarskiptastofa says article 94 builds mostly on article 13 of the ePrivacy Directive (Decision 11/2025, para. 25, footnote 2), so it follows the same pattern as EU members' laws.

What the law says

Act No. 70/2022 (in force since 1 September 2022) holds the rule in article 94, headed "Óumbeðin fjarskipti" (unsolicited communications). The consolidated text of 1 October 2026 matches the original on this article.

"Notkun sjálfvirkra uppkallskerfa, símbréfa, tölvupósts og hvers konar rafrænna skilaboða fyrir beina markaðssetningu er einungis heimil þegar endanotandi hefur veitt upplýst samþykki sitt fyrir fram."

Our translation: "Use of automated calling systems, fax, email and any kind of electronic messages for direct marketing is permitted only when the end user has given informed consent in advance." The other paragraphs add:

• Paragraph 2: email to your customers about your own products or services is allowed if they could object free of charge at registration and in every message, and did not refuse at the start.
• Paragraph 3: other unsolicited direct marketing is prohibited to end users who do not want it.
• Paragraph 4: "er heimilt að nota almenn tölvupóstföng fyrirtækja og stofnana, séu þau fyrir hendi, fyrir beina markaðssetningu á vörum og þjónustu" (general email addresses of companies and institutions, where they exist, may be used for direct marketing of goods and services, despite paragraphs 1 to 3).
• Paragraph 5: email is prohibited where the name and address of the sender are not stated clearly.

The government bill that added paragraph 4 says its limit is clear: "veitir ákvæðið ekki heimild til að senda tölvupóst í markaðslegum tilgangi á tölvupóstföng sem fyrirtæki eða stofnun úthlutar einstaka starfsmönnum sínum" (the provision gives no permission to send marketing email to addresses that a company or institution assigns to its individual employees; parliamentary document 666, 152nd session, notes on article 94).

Are companies protected? The act defines a user as an "einstaklingur eða lögaðili" (individual or legal person) that uses or requests a public electronic communications service, and an end user as a user that offers no public networks or services (art. 5). In our reading, companies are end users, so the consent rule reaches them, and paragraph 4 is the exception for their generic addresses.

What the regulator says

Fjarskiptastofa's guidance booklet (dated January 2023) answers the B2B question:

"Óheimilt er að senda tölvupóst í markaðslegum tilgangi á tölvupóstföng sem fyrirtæki eða stofnun úthlutar einstaka starfsmönnum sínum."

Our translation: "It is prohibited to send email for marketing purposes to email addresses that a company or institution assigns to its individual employees." Its page on user rights says generic addresses such as info@ may receive marketing, but sending to employees' personal addresses is "almennt ekki heimilt ... án viðeigandi heimildar" (generally not permitted without appropriate authorisation; our reading: consent).

Consent must be "frjálst, upplýst, skýrt, ótvírætt" (free, informed, clear, unambiguous); silence and pre-ticked boxes do not count. Decision 11/2025 adds that the telecom act has no consent definition of its own, so the Personal Data Act's applies, and that the sender must prove consent.

Named employees, sole traders and the first email

Firstname@company.is is an address a company assigns to an employee, so it needs consent. We found no guidance on sole traders; our reading is consent for their personal address and no consent for a generic business address.

Can a first email ask for consent? The booklet says no:

"Ekki er heimilt að senda út tölvupóst til að óska samþykkis fyrir að senda viðkomandi tölvupóst sem lið í beinni markaðssetningu."

Our translation: "It is not permitted to send an email to ask for consent to send that person email as part of direct marketing."

The customer exception is narrow. In Decision 11/2025 (para. 20) Fjarskiptastofa calls paragraph 2 an exception that "túlkast þröngt" (is read narrowly) and covers only the sender's own customers, its own products or services, and email only. The text says "eigin vörum eða þjónustu" (own goods or services), not "similar" ones.

LinkedIn and social media messages

We found no Fjarskiptastofa guidance or decision naming LinkedIn or social media. Article 94(1) covers "hvers konar rafrænna skilaboða" (any kind of electronic messages). Our reading: a sales DM to a named person on LinkedIn needs consent like an email.

GDPR and Persónuvernd

GDPR and article 94 cover different things. Persónuvernd, the data protection authority, supervises the GDPR (Act 90/2018, art. 1). It forwarded a complaint about a marketing email to Fjarskiptastofa, as unsolicited communications are outside its remit (Decision 11/2025, para. 2). Article 21 of Act 90/2018 adds that marketing mail must show the sender's name prominently and where to object, gives recipients the right to know where the data came from, and points back to the telecom act: "Að öðru leyti fer um sendingu slíks markpósts samkvæmt lögum um fjarskipti" (in other respects the sending of such mail follows the telecom act). Persónuvernd's own page on marketing refers companies to Fjarskiptastofa for email marketing and says the national opt-out register (bannskrá Þjóðskrár) need not be checked when only email addresses are used.

For a personal address, legitimate interest under GDPR article 6(1)(f) cannot replace the consent article 94 requires (our reading; the bill calls article 94 a special rule in relation to the Personal Data Act). Say where you got the data (GDPR article 14) and keep a suppression list. More in GDPR and B2B email under legitimate interest.

Fines and real cases

Article 102 of Act 70/2022 gives Fjarskiptastofa the powers of the marketing act for breaches of article 94, including "að leggja á sektir og dagsektir" (to impose fines and daily fines). Since 16 May 2026 that means the Marketing Act No. 44/2026. Its article 33 allows fines of up to 4% of the previous year's turnover or the krona equivalent of EUR 2 million, whichever is higher, and article 32 allows daily fines of ISK 50,000 to 500,000 until a decision is followed. Our reading: those are the ceilings for article 94, but we found no decision applying them yet. Fjarskiptastofa's decisions name article 102 as the basis for sanctions (Decision 11/2025, paras. 29 and 30), and the 2021 fine below rested on its counterpart in the old act. GDPR breaches can be fined up to ISK 2.4 billion or 4% of worldwide turnover (Act 90/2018, art. 46).

In practice Fjarskiptastofa mostly educates; it says sanctions are for breaches that are serious, extensive, repeated, long-running or follow ignored guidance. Fjarskiptastofa lists 53 decisions and appeal rulings on unsolicited communications since 2004. The two on email under the current act, and the only fine:

• Decision 11/2025, BSV ehf., 22 December 2025: a marketing email to a person who said he had never been a customer or signed up; the company never answered the regulator. Breach of article 94(1), but no fine: more than eleven years separated it from the same complainant's earlier case, so it was not a repeat breach, it was not extensive, and the complainant had already been removed from the list.
• Decision 13/2023, Lífeyrissjóður verzlunarmanna, 22 December 2023: a pension fund emailed a member who had asked for no contact beyond carrying out his decision, pointing him to its own service. Breach of article 94(2) and (3), no fine, as it was not a repeat breach and the fund said it would review its procedure.
• Decision 7/2021, Happdrætti DAS, 10 May 2021: ISK 300,000, imposed by Fjarskiptastofa's predecessor (PFS), for at least five calls to people on the phone opt-out list, under the earlier act.

All three concerned individuals. Two other decisions issued since the current act took effect concerned phone calls under the old act; neither brought a fine. The nearest to B2B is from 2011: under the old act, which protected only the subscriber, the regulator dismissed a complaint about a marketing email sent to an address the complainant had through his job, because his employer would have had to complain (PFS Decision 5/2011). We found no decision on B2B cold email under the current act.

Checklist for B2B email to Iceland

1. Use generic company addresses (info@, skrifstofa@) only if they belong to no person, and give your name and address.
2. Get consent before emailing named employees, and keep proof; the burden is yours.
3. Do not email anyone to ask for consent.
4. Stop at once when someone asks.
5. Existing customers: email only, your own products or services, with a free opt-out at collection and in every message.
6. Inform people under GDPR article 14 and keep a suppression list.

How Leo handles Iceland

Leo, the buying-signal agent Revexa builds, applies its own automatic rule only to Germany, where nothing is sent without your approval, not even in autonomous mode. Iceland has no such rule. Icelandic law lets you email generic company addresses but requires consent for named employees, and in review mode, the default, you read and approve every draft, so whether an Icelandic lead is a generic address or a named person is yours to check. Leo writes to each lead in the lead's own language when your website exists in that language, and in English otherwise. Leo is the wrong choice if you need software that decides for you whether an Icelandic address is lawful to email.

More countries: Norway, Denmark, Sweden, Finland, Slovakia, Bulgaria, Croatia, Lithuania, Slovenia, Latvia, Cyprus and Malta.

Common questions

Is B2B cold email legal in Iceland?

Partly. Article 94 of Act No. 70/2022 allows email to the general addresses of companies and institutions, such as info@, without consent. Addresses assigned to individual employees need prior consent.

Can I email an Icelandic company's info@ address without consent?

Yes, if the address is not assigned to a specific employee. Article 94(4) allows marketing to general company addresses, Fjarskiptastofa gives info@ as an example, and article 94(5) requires the email to state the sender's name and address clearly.

Can I send a first email asking for consent in Iceland?

No. Fjarskiptastofa says it is not permitted to send email to ask for consent to marketing email.

Are LinkedIn messages covered in Iceland?

We found no guidance naming LinkedIn. Article 94 covers any kind of electronic messages, so in our reading a sales DM to a named person needs consent like an email.

What are the fines for cold email in Iceland?

Up to 4% of turnover or the krona equivalent of EUR 2 million, whichever is higher, under the new Marketing Act (our reading). The only fine we found was ISK 300,000 in 2021, for phone calls.