Is cold email legal in Italy? B2B rules for 2026

No, not without prior consent. Italy requires consent before the first marketing email to any recipient: article 130 of the Privacy Code protects the "contraente", a term that covers companies, so even an info@ address needs consent. The Garante, Italy's data protection authority, treats firstname.lastname@ addresses as personal, sole traders are natural persons with full protection, and the Garante has held that LinkedIn is not meant for selling.

Checked on 15 October 2026 against the law text and the regulator's guidance. This is not legal advice.

Italy is as strict as Germany. Other countries: cold email laws by country.

At a glance

What does the law say?

Article 130 of the Personal Data Protection Code (Legislative Decree 196/2003) implements the EU ePrivacy Directive. Paragraph 1 allows automated marketing calls only "con il consenso del contraente o utente" (with the consent of the contracting party or user), and paragraph 2 extends that to email:

"La disposizione di cui al comma 1 si applica anche alle comunicazioni elettroniche, effettuate per le finalità ivi indicate, mediante posta elettronica, telefax, messaggi del tipo Mms (Multimedia Messaging Service) o Sms (Short Message Service) o di altro tipo."

"The provision of paragraph 1 also applies to electronic communications made for the purposes stated therein by electronic mail, fax, MMS (Multimedia Messaging Service) or SMS (Short Message Service) messages or of any other type." (our translation)

Source: article 130 on Normattiva, in force since 19 September 2018.

The EU directive requires consent only for natural persons. Italy protects companies too, because article 121(1-bis)(f) defines the contraente as "qualunque persona fisica, persona giuridica, ente o associazione" (any natural person, legal person, body or association). Volume does not matter either: whether messages go out in bulk is "irrelevant", the Garante's guidelines say.

What does the Garante say?

Its guidelines on promotional activity and spam of 4 July 2013 (official English version) predate the GDPR but are still cited. They say:

• Named work addresses are personal. Addresses such as firstname.lastname@company.com "should be regarded as 'personal' email accounts and the respective holders as 'data subjects'".
• Public or guessed addresses do not help. Consent is needed even for addresses from public registers, directories or websites. In G&P Consulting (18 December 2025), about an address guessed from a name and a company domain, the Garante held that the rule applies even to an address "generated at random" (our translation).
• The first email cannot ask for consent. Requesting consent "jointly with such a communication" is unlawful.

Company address or named person?

For email, Italy makes no difference: companies and people are both "contraente o utente". A general decision of 20 September 2012 confirmed that article 130 applies to legal persons.

What differs is who can complain: since December 2011 a company cannot complain to the Garante, though it can go to court and the Garante can act on its own initiative. Named employees and sole traders are natural persons with full rights.

Can you send LinkedIn messages?

Not sales messages without consent, according to the Garante:

• La Prima (16 September 2021). An estate agent messaged a property owner on LinkedIn about her property. No legal basis, said the Garante: "Non è invece previsto che gli utenti di Linkedin possano utilizzare la piattaforma per inviare messaggi ad altri utenti con lo scopo di vendere prodotti o servizi" ("It is not, however, envisaged that LinkedIn users may use the platform to send messages to other users for the purpose of selling products or services", our translation). An open profile made no difference. The Garante's note calls the final Milan judgment (2024) "favorevole"; we read that as in its favour but have not read the judgment.
• Aesir (17 April 2026). An IT consultancy found a lawyer through LinkedIn Sales Navigator and his addresses through Sales Navigator and Snov.io. Sales email, the Garante held, is not something a LinkedIn member "can reasonably expect" (our translation).
• PromoBulls (2017): joining a social network, "anche professionali" (professional ones included), is not consent to marketing. The 2013 guidelines put marketing messages on social networks, private or public, under the same Code.

We found no guidance on connection requests with a sales note.

GDPR: does legitimate interest help?

Not for email. In Aesir the Garante said that sending commercial email:

"non può essere fondato sul contratto o su legittimo interesse del titolare, ma unicamente sul consenso dell’interessato."

"cannot be based on a contract or on the controller's legitimate interest, but solely on the data subject's consent." (our translation)

In Bakeca (2023) it called article 130 a lex specialis, and in Grizzaffi (2023) it held that GDPR recital 47 cannot be relied on for email. Our guide to legitimate interest for B2B email explains the balancing test; in Italy it does not make cold email lawful.

Fines and real cases

• Grizzaffi Management, 17 May 2023: €10,000, a processing ban and an erasure order for sales emails to construction professionals whose names came from public lists. The unsubscribe link was irrelevant: "it is the very sending of the email that is unlawful" (our translation).
• OneDirect, 25 March 2021: €30,000 for sales emails without consent, including to a firm's generic address, and other breaches.
• G&P Consulting (2025) and Aesir (2026): reprimands for the emails; Aesir was also fined €1,000 for not answering an access request.

Breaching article 130 for profit or to cause harm, and thereby harming the person, can also mean six to 18 months in prison (article 167).

Checklist for B2B email to Italy

1. Get consent before the first marketing email and keep proof of when and how; a legitimate interests assessment does not replace it.
2. Do not use the first email to ask for consent.
3. Guessed addresses, and addresses from registers or LinkedIn, need consent too.
4. Use the existing-customer exception only for buyers, and only by email.
5. Never hide who you are, and give an address where people can exercise their GDPR rights (art. 130(5)).
6. Mark each email as commercial and say the recipient can object (Legislative Decree 70/2003, art. 9).
7. Keep one objection list across channels.
8. Before calling, check the RPO monthly and before each campaign.

How Leo handles Italy

Revexa, which publishes this guide, builds Leo, a buying-signal agent. Leo automatically blocks cold messages only to leads in Germany. For leads in Italy, as in every other country (Denmark and Norway included), you read and approve each draft in review mode and decide yourself whether it is sent. Leo writes in the lead's own language when your website exists in that language, otherwise in English, and in Swedish to Swedish buyers.

Common questions

Is B2B cold email legal in Italy?

Not without prior consent. Article 130 of the Privacy Code requires consent for marketing email to any "contraente o utente", companies included, so generic addresses, named employees and sole traders are all covered. The exception is existing customers.

Can I send LinkedIn sales messages to Italian prospects?

Not without consent, according to the Garante. In La Prima (2021) it held that LinkedIn is not meant for selling, whether or not a profile is open to messages, and in Aesir (2026) that LinkedIn members cannot reasonably expect sales email.

Is an unsubscribe link enough in Italy?

No. In Grizzaffi (2023) the Garante called the link irrelevant because sending the email was itself unlawful.

What are the fines for cold email in Italy?

Up to €20 million or 4% of worldwide annual turnover, the GDPR scale. Real B2B cases are smaller: €10,000 for Grizzaffi (2023), €30,000 for OneDirect (2021) and reprimands in 2025 and 2026.