Is cold email legal in Lithuania? B2B rules 2026

Yes for companies, since 22 April 2026: Lithuanian law no longer requires prior consent for direct marketing to a legal entity, but every message must offer a clear, free and easy way to opt out. Natural persons still need prior consent, with a narrow exception for existing customers. Law No. XV-815 rewrote article 81 of the Law on Electronic Communications, and the regulator, VDAI (the State Data Protection Inspectorate), published guidance on 19 May 2026 that, according to secondary summaries, covers named employees' work addresses too. We found no guidance on LinkedIn messages or on sole traders.

Checked on 2 November 2026 against the official text of the law and of the Code of Administrative Offences (via the Register of Legal Acts' open data) and VDAI's list of decisions. VDAI's guidance and one decision blocked automated access, so those parts rest on secondary sources, as marked. This is not legal advice.

Lithuania now sits with the United Kingdom, Estonia, Finland and Sweden: opt-out for companies. All countries: cold email laws by country.

Lithuania at a glance

What the law says

The rule is article 81 of the Law on Electronic Communications (Elektroninių ryšių įstatymas, ERĮ), which implements article 13 of the ePrivacy Directive. Article 81(1) keeps prior consent as the general rule for "elektroninių ryšių paslaugas, įskaitant elektroninio pašto pranešimų siuntimą" (electronic communications services, including sending email messages) used for direct marketing. Law No. XV-815 of 16 April 2026 added a second sentence, which the consolidated text gives as:

"Tokio sutikimo nereikia, kai abonentas ar registruotasis viešųjų elektroninių ryšių paslaugų gavėjas yra juridinis asmuo, tačiau jam turi būti sudaryta aiški, nemokama ir lengvai įgyvendinama galimybė atsisakyti tolesnio elektroninių ryšių paslaugų, įskaitant elektroninio pašto pranešimų siuntimą, naudojimo tiesioginės rinkodaros tikslu."

Our translation: "Such consent is not needed where the subscriber or registered user of public electronic communications services is a legal entity, but it must be given a clear, free and easy way to refuse further use of electronic communications services, including sending email messages, for direct marketing." A subscriber is whoever signed the contract with the service provider (article 3(1)). Article 81(3) still bans marketing email that hides the sender or gives no valid address for stop requests.

The date. Some commentary gives 1 July 2026. That is when the rest of Law XV-815 took effect (its article 14); the article 81 change applied from 22 April 2026, the day after publication, as the register records. The register's open data, current to 30 October 2026, shows one later amending law, No. XV-920, which leaves article 81 unchanged.

The ePrivacy Directive requires consent only for "subscribers who are natural persons" (article 13(5)). Until 21 April 2026, Lithuania required it from every subscriber, companies included, and VDAI wanted it from the company's director or an authorised person, according to emailexpert (19 August 2026).

What the regulator says

VDAI published an FAQ dated 19 May 2026 on the amendment (VDAI news; FAQ). Its site blocked our requests and we found no archived copy, so what we say about the FAQ comes from secondary summaries.

Named employees. The exception turns on who the subscriber is, not on whose name is in the address, and for a work mailbox the company normally holds the contract (our reading). emailexpert, summarising the FAQ, and ExpertLab, a Lithuanian compliance consultancy (29 June 2026), say the exception covers firstname.lastname work addresses as well as info@, and that the employee "kuriam priskirtas konkretus kontaktas" (to whom a specific contact is assigned) can opt out, not only management. The law firm Ecovis called the point unclear in an article first published on 7 May 2026, before the FAQ.

Sole traders, existing customers and the first email

Sole traders. No guidance found. An individual enterprise (individuali įmonė, IĮ) is by law a "privatusis juridinis asmuo" (private legal entity) with unlimited liability (Law on Individual Enterprises, article 2(1)), so in our reading the opt-out rule applies to it. Someone working under individual activity (individuali veikla) has no separate legal entity, so in our reading consent applies.

Soft opt-in. Article 81(2) lets a seller use the email address of a customer "kuris yra fizinis asmuo" (who is a natural person), obtained when selling goods or services, to market its own similar products, if the customer could refuse at collection and can refuse in every message. Before April 2026 it covered all customers.

A first email asking for consent. For companies there is nothing to ask. For natural persons we found no current guidance. Before the amendment, VDAI held that you could not even ask a company for consent to use its email address for marketing, according to a Kaunas chamber of commerce note of 24 May 2021 (chamber.lt). Our reading: for a private individual, a consent request is not safe.

LinkedIn and social media messages

We found no guidance from VDAI or a Lithuanian court on LinkedIn or social media direct messages. Our reading: since article 81 covers electronic communications services in general, a sales message to a company contact follows the same opt-out rule as email and one to a private individual needs consent; no authority has confirmed that a platform message counts.

GDPR and VDAI

Article 81 decides whether you may send. GDPR decides whether you may process the contact data, and a named work address is personal data, as Ecovis notes. Say where you got the data "at the latest at the time of the first communication" (GDPR article 14(3)(b)), and stop after an objection: "the personal data shall no longer be processed for such purposes" (article 21(3)). More in GDPR and B2B email under legitimate interest. VDAI supervises both.

Fines and real cases

Article 83 of the Code of Administrative Offences punishes breaches of the ERĮ's personal data and privacy rules (in our reading, article 81 included, as it sits in that chapter), and article 589 lets VDAI investigate them. The code in force since 1 November 2026 sets EUR 150 to 580 for a person and EUR 300 to 1,150 for a company's manager or other responsible person; for a repeat offence, EUR 550 to 1,200 and EUR 1,100 to 3,000. Our reading: these fines fall on individuals, not on the company.

ERĮ article 90(8) also lets VDAI impose up to EUR 60,000 for article 81 breaches covered by the EU consumer protection cooperation regulation (2017/2394), which targets breaches that harm consumers in other member states. In our reading, that rarely fits B2B email.

VDAI's list of 2026 decisions, as archived on 6 August 2026, shows 15 article 81 complaints decided from January to July, 11 of them finding a breach; it shows neither sanctions nor recipient types. Cases we found, both under the old consent rule:

• VDAI decision 3R-183, 2 February 2026: the list confirms a breach of article 81 by Printera, UAB. An AI-generated summary on The DPO says a newsletter went to a company's address on 7 June 2024 without consent, and that VDAI rejected "human error" as a defence but made only a formal finding of breach, no fine, as the breach was isolated and harmless. We could not open the decision.
• LVAT, reported on 24 May 2021: a company emailed an offer to another company at the address on its website. VDAI held that publishing an address is not consent to marketing; the Supreme Administrative Court agreed and said consent must be asked for "aiškiai ir nedviprasmiškai" (clearly and unambiguously) and cannot be implied (chamber.lt). The report gives no case number or fine.

We found no Lithuanian B2B cold email fine with an amount.

Checklist for B2B email to Lithuania

1. Check who the recipient is. A company's address falls under the opt-out rule; a private individual needs consent, and so, in our reading, does a self-employed person without a legal entity.
2. Put a clear, free and easy opt-out in every message, name yourself, give a valid stop address and stop at once when anyone opts out, an employee included.
3. Inform people under GDPR article 14 and keep a suppression list and proof of each opt-out.

How Leo handles Lithuania

Leo, the buying-signal agent Revexa builds, applies its own automatic rule only to Germany, where nothing is sent without your approval, not even in autonomous mode. Lithuania has no such rule. Lithuanian law lets you email companies without prior consent as long as each message offers an opt-out, and in review mode, the default, you read and approve every draft, so whether a lead is a company, a self-employed person or a private individual is yours to check before you approve. A stop in one channel blocks the person in every channel. Leo writes to each lead in the lead's own language when your website exists in that language, and in English otherwise. Leo is the wrong choice if you need software that checks Lithuanian rules for you.

More countries: Estonia, Finland, Sweden, Poland, Slovakia, Bulgaria, Croatia, Slovenia, Latvia, Cyprus, Malta and Iceland.

Common questions

Is B2B cold email legal in Lithuania?

Yes for companies since 22 April 2026. Article 81 of the Law on Electronic Communications no longer requires prior consent when the recipient is a legal entity, but each message needs a clear, free and easy opt-out. Natural persons still need consent.

Can I email a Lithuanian company's info@ address without consent?

Yes, if each message offers a clear, free and easy opt-out and you stop when asked. Secondary summaries of VDAI's May 2026 guidance say the same applies to named employees' work addresses.

Can I send a first email asking for consent in Lithuania?

Companies need no consent, so there is nothing to ask. For private individuals we found no current guidance.

Are LinkedIn messages covered in Lithuania?

We found no guidance naming LinkedIn. In our reading, a sales message to a company contact follows the same opt-out rule as email and one to a private individual needs consent, but this is untested.

What are the fines for cold email in Lithuania?

Up to EUR 580 for a person and EUR 1,150 for a company's manager, or EUR 1,200 and EUR 3,000 if repeated (Code of Administrative Offences, article 83). Breaches that harm consumers across borders can cost up to EUR 60,000. We found no B2B email fine with an amount.