Is cold email legal in Latvia? B2B rules 2026

Yes, to company addresses, without prior consent; no, to people. Section 9 of Latvia's Law on Information Society Services bans commercial email without prior consent, but paragraph 6 limits that ban to commercial communications sent to natural persons. The regulator, the State Data Inspectorate (Datu valsts inspekcija, DVI), says a message to a legal person's email address may be sent without prior consent, provided the sender gives a valid address for stop requests and honours refusals. We found no guidance on named employees or sole traders, so in our reading they need consent. We found no guidance on LinkedIn messages and no published fine for B2B email.

Checked on 2 November 2026 against the law text, the regulator's guidance and its decisions. This is not legal advice.

Latvia draws the same line as Luxembourg and Hungary: company addresses on an opt-out basis, consent for natural persons and no guidance on named employees. It is the opposite of Poland, where consent comes first. All countries: cold email laws by country.

Latvia at a glance

What the law says

Latvia transposes article 13 of the ePrivacy Directive in section 9 of the Informācijas sabiedrības pakalpojumu likums (Law on Information Society Services, ISPL). We quote the current consolidated Latvian text (in force since 21 June 2024) on likumi.lv, run by the official publisher Latvijas Vēstnesis, which also carries an English translation. Paragraph 1:

"Aizliegts izmantot komerciāla paziņojuma sūtīšanai [...] elektronisko pastu [...], ja pakalpojuma saņēmējs iepriekš nav devis brīvu un nepārprotamu piekrišanu."

Our translation: "It is prohibited to use [...] electronic mail for sending a commercial communication if the service recipient has not given prior free and explicit consent." Paragraph 6 limits the reach:

"Šā panta pirmajā, otrajā un trešajā daļā noteiktie aizliegumi un ierobežojumi attiecas uz komerciālu paziņojumu sūtīšanu fiziskajām personām."

Our translation: "The prohibitions and restrictions in paragraphs one, two and three of this section apply to the sending of commercial communications to natural persons." Paragraph 6 was added by an amendment adopted on 12 June 2009 and in force since 1 July 2009 (likumi.lv). The Ministry of Justice explained it when the government approved the bill on 27 May 2009: for recipients that are legal persons, sending is prohibited "ja tām netiks nodrošināta iespēja atteikties" (if they are not given a way to refuse further messages) (Ministry of Justice).

The directive allows this: it requires consent only for "subscribers who are natural persons" (article 13(5)).

Two rules apply to every recipient. Paragraph 4 bans email with an invalid address for stop requests, or one that ignores a refusal. Section 8 requires the message to be recognisable as commercial, to name the person on whose behalf it is sent and to offer a way to refuse further messages. Each prohibited message is a separate breach (§ 9(5)).

What the regulator says

In a page published on 26 October 2020 on commercial communications, DVI states the split directly (DVI, our translation):

"komerciālu paziņojumu uz juridiskās personas elektroniskā pasta adresi ir atļauts sūtīt bez iepriekš saņemtas piekrišanas, taču ievērojot šā likuma 9.panta ceturto daļu"

"A commercial communication to the email address of a legal person may be sent without prior consent, provided paragraph 4 of section 9 is observed." For natural persons, the same page requires consent or the soft opt-in conditions of paragraph 2. The page still cites the data protection law that Latvia replaced on 5 July 2018, but section 9, which it explains, has read the same since 2009. It does not say how to treat a named address such as firstname.lastname@company.lv, and we found no decision on that.

Named employees, sole traders and the first email

Paragraph 6 protects "fiziskās personas" (natural persons). A sole trader (individuālais komersants) is a natural person entered in the commercial register (Commercial Law § 1(1)), and an address with a person's name identifies one, so in our reading both need prior consent. This is cautious: we found nothing on whether a named work address counts as the company's. Treat generic addresses (info@, sales@) as the only safe opt-out target.

Can a first email ask for consent? We found no guidance. To a company address the question rarely arises, because your offer can go directly. For a natural person, our reading is that a request to opt in promotes your business and is itself a commercial communication, so get consent another way, such as a form.

LinkedIn and social media messages

We found no DVI guidance or court decision naming LinkedIn. Paragraph 3 covers "cita veida komunikācija" (communication of other kinds) over publicly available electronic communications services, and DVI has applied it to messaging apps. In a decision of 29 July 2021, it found that a company had sent advertising by SMS and WhatsApp "bez galalietotāju sniegtas skaidras un nepārprotamas piekrišanas" (without the clear and unambiguous consent of the end users), breaching paragraph 3 (DVI, our translation). The recipients were natural persons. Our reading: a sales DM on LinkedIn to a named person follows the consent rule, and a DM to a company page follows the email rule.

Existing customers

Paragraph 2 lets a provider that obtained email addresses from recipients "savu komercdarījumu ietvaros" (in its commercial transactions) reuse them if the messages concern its similar products or services, the recipient did not object at the start, and every message offers a clear, free way to refuse. DVI points out that paragraph 2 covers email only, so marketing messages to a natural person's phone number need consent (DVI decision, 29 July 2021). A 2022 DVI explainer for consumers goes further than the law's wording: a new customer who gives no separate consent at purchase may not be sent commercial messages (DVI), so ask at checkout. Prospects are not customers.

GDPR and DVI

DVI enforces both the ISPL and the GDPR. It calls the ISPL the special law for commercial communications and the GDPR the rule for the personal data behind them. In a statement of 25 February 2021 it says legitimate interest under article 6(1)(f) can support email to customers who meet the soft opt-in conditions, and consent under article 6(1)(a) is the basis for "visiem pārējiem komerciālo paziņojumu sūtīšanas gadījumiem" (all other cases) (DVI). It does not mention business contacts, but it starts from messages to "identificētām vai identificējamām personām" (identified or identifiable persons), which in our reading includes a named work address.

When you process a named person's data, tell them where you got it at the latest at the first contact (GDPR article 14(3)(b)), and keep a suppression list. More in GDPR and B2B email under legitimate interest.

Fines and real cases

Section 12(1) names PTAC, DVI and other bodies as supervisors, each within its competence. Under § 13(1) the supervisory body may demand information and order the provider "izbeigt likuma pārkāpumu" (to stop the breach) within a deadline. Under § 13(6) it must check section 9 when one recipient got at least 10 commercial communications from one sender within a year and has complained.

No current law we found sets a fine for breaching section 9 itself. Until 30 June 2020, article 204.16 of the Administrative Violations Code let DVI warn a company or fine it EUR 700 to 7,100; that code was repealed on 1 July 2020 (likumi.lv), and the ISPL has no penalty of its own (its only administrative offences, § 20, concern terrorist content). PTAC's English page still cites the repealed article (PTAC). Its Latvian page, updated on 20 September 2026, points to article 38 of the Personal Data Processing Law instead (PTAC), but that article covers only public bodies (likumi.lv).

Two fines can still apply. Where the data of a natural person are processed unlawfully, GDPR fines can reach EUR 20 million or 4% of worldwide turnover (EDPB Guidelines 04/2022, p. 17). PTAC can also fine advertising that breaks legal requirements up to EUR 14,000 under § 20(1) of the Advertising Law (likumi.lv), and its Latvian page lists that fine for commercial communications; we found no case where it was used against an email that broke section 9.

DVI publishes its decisions. All those we found on marketing messages, from 2020 to 2026, concern consumers; the main ones:

DVI describes its approach as "Konsultē vispirms" (consult first). We found no published decision on B2B email.

Checklist for B2B email to Latvia

1. Use the opt-out rule for generic company addresses only (info@, sales@).
2. Get prior consent for named people and sole traders, and keep proof.
3. Use a valid sender address and honour every refusal (§ 9(4)).
4. Label every message as commercial, name the company behind it and offer a way to refuse (§ 8).
5. Existing customers: your own similar products, by email, with an opt-out in every message.
6. Inform people under GDPR article 14 and keep a suppression list.

How Leo handles Latvia

Leo, the buying-signal agent Revexa builds, applies its own automatic rule only to Germany, where nothing is sent without your approval, not even in autonomous mode. Latvia has no such rule. Latvian law lets you email company addresses, but named employees are unsettled, and you approve every draft in review mode, so checking whether a lead is a generic address or a named person is yours. Leo writes to each lead in the lead's own language when your website exists in that language, and in English otherwise. Leo is the wrong choice if you need software that checks Latvian rules for you.

More countries: Estonia, Finland, Sweden, Norway, Slovakia, Bulgaria, Croatia, Lithuania, Slovenia, Cyprus, Malta and Iceland.

Common questions

Is B2B cold email legal in Latvia?

Yes, to company addresses. Section 9(6) of the Law on Information Society Services limits the consent rule to natural persons, so a message to a legal person's email address needs no prior consent if the sender gives a valid address for stop requests and honours refusals. Named employees and sole traders need consent in our reading.

Can I email a Latvian company's info@ address without consent?

Yes. DVI says a commercial communication to a legal person's email address may be sent without prior consent, if the sender uses a valid address for stop requests and respects refusals.

Can I send a first email asking for consent in Latvia?

We found no guidance. To a company you can send your offer directly. For a natural person, our reading is that the request is itself a commercial communication, so get consent another way.

Are LinkedIn messages covered in Latvia?

We found no guidance naming LinkedIn. DVI applied the consent rule to SMS and WhatsApp messages to natural persons in 2021, so in our reading a sales DM to a named person needs consent.

What are the fines for cold email in Latvia?

No current law we found sets a fine for breaching section 9 itself; the old penalty ended in 2020. GDPR fines up to EUR 20 million or 4% of turnover apply to unlawful processing of personal data, and DVI fined an online shop EUR 15,000 under the GDPR in 2020, partly over its customer newsletters. We found no published fine for B2B email.