Is cold email legal in Luxembourg? B2B rules for 2026
2026-10-15 · updated 2026-10-15 · 6 min read · Adam Axelsson, founder of Revexa
To company addresses, yes, on an opt-out basis: Luxembourg's law of 30 May 2005 (art. 11) limits the consent requirement for marketing email to subscribers who are natural persons. A company's info@ address needs no consent if you identify yourself, give a valid address for stop requests and label the email as advertising. For a named employee the law is unclear, because the e-commerce law of 14 August 2000 (art. 48(2)) requires consent for marketing email to a natural person; sole traders are natural persons and need consent. We found no guidance on LinkedIn messages and no published fine for sales email.
Checked on 15 October 2026 against the law text and the regulator's guidance. This is not legal advice.
That makes Luxembourg far more open towards companies than Germany, where business recipients need consent too. For other countries, see cold email laws by country.
At a glance
| Situation | Rule in Luxembourg | Source |
|---|---|---|
| Generic address (info@) | Opt-out: identify yourself, give a valid stop address, label the email as advertising | Law of 30 May 2005, art. 11(4) and (5); e-commerce law, art. 48(1) |
| Named employee | Unclear; the cautious reading is consent | art. 11(5) against e-commerce law art. 48(2) |
| Sole trader | Prior consent | Both laws protect natural persons |
| Existing customers (soft opt-in) | Allowed: details obtained from customers in a sale, your own similar products, an opt-out at collection and in every message | art. 11(2) |
| LinkedIn and social DMs | No guidance found | |
| Cold calls to businesses | No consent needed for legal persons; sole traders need consent | art. 11(3) and (5) |
| Regulator | CNPD; criminal penalties are imposed by the courts | art. 12 |
| Maximum penalty | Eight days to one year in prison and/or a fine of €251 to €125,000 | art. 11(6); e-commerce law, art. 48(4) |
What does the law say?
Article 11 of the amended law of 30 May 2005, which implements the EU's ePrivacy Directive:
"(1) L'utilisation de systèmes automatisés d'appel et de communication sans intervention humaine (automates d'appel), de télécopieurs ou de courrier électronique à des fins de prospection directe n'est possible que si elle vise l'abonné ou l'utilisateur ayant donné son consentement préalable."
"(5) Les paragraphes (1) et (3) s'appliquent à l'abonné qui est une personne physique."
Our translation: "(1) The use of automated calling and communication systems without human intervention (automatic calling machines), fax machines or electronic mail for direct marketing purposes is only possible if it targets a subscriber or user who has given prior consent." and "(5) Paragraphs (1) and (3) apply to subscribers who are natural persons."
The parliamentary committee's report confirms that paragraph 5 was a government amendment "pour l'aligner sur les directives européennes", to align it with the EU directives (doc. parl. 5181).
Two duties apply whoever the recipient is. Art. 11(4) bans marketing email that disguises the sender or comes "sans indication d'adresse valable" for stop requests. And art. 48(1) of the e-commerce law requires unsolicited commercial email to be identified as such "d'une manière claire et non équivoque" as soon as it is received. Legilux notes that its consolidated texts have documentary value only.
What does the CNPD say?
We found no guidance on B2B email from the CNPD, the data protection authority. Its ePrivacy page (last updated 26 July 2023) speaks of natural persons: "A défaut d'avoir préalablement donné leur consentement, les personnes physiques sont en droit de ne pas recevoir de courriers électroniques commerciaux non sollicités (les spams)" (CNPD).
A 2018 news item, updated 5 June 2025, is broader: "Dans le cas où il n'existe aucun lien entre un responsable du traitement et un utilisateur, le consentement préalable doit être demandé avant l'envoi de courriers électroniques (« opt-in »)" (CNPD). Since the 2005 law defines a "utilisateur" as a natural or legal person using the service for private or professional purposes, that wording reads stricter than art. 11(5).
Company, employee or sole trader?
- Company addresses: outside the consent rule, per art. 11(5).
- Named employees: unclear. Read literally, art. 11(5) leaves out an employee whose employer is the subscriber. Against that, the e-commerce law says unsolicited commercial email "à une personne physique n'est autorisé qu'en cas de consentement préalable de celle-ci", and the CNPD's 2018 wording does not separate B2B. With no guidance or decision found on the point, the cautious reading is consent.
- Sole traders: natural persons, so consent under both laws.
Can you send LinkedIn messages to Luxembourg prospects?
No guidance found. The nearest text is the CNPD's guidance on political canvassing, which requires prior consent for telephone, email "ou tout autre moyen de communication électronique" (CNPD, updated 23 February 2023). That concerns political messages, not sales.
How does GDPR apply?
The CNPD names marketing as an example of a legitimate interest under Article 6(1)(f): "p.ex. à des fins de marketing" (CNPD, updated 26 March 2026). The right to object is absolute: an organisation "ne peut pas refuser votre objection et doit cesser de vous envoyer des e-mails ou courriers de prospection commerciale" (CNPD). We found no CNPD guidance specific to B2B prospecting; the general method is in GDPR and B2B email under legitimate interest.
Sanctions
Breaching art. 11 is a criminal offence: eight days to one year in prison and a fine of €251 to €125,000, or one of the two (art. 11(6)); the e-commerce law has the same scale (art. 48(4)). The CNPD can ask a court for an injunction (art. 12bis) and fines under GDPR. We found no real case: none of the 92 decisions on the CNPD's list from 2021 to 2025 concerns marketing or spam by its title (CNPD decisions).
Checklist: B2B email to Luxembourg
- To company addresses, identify yourself, give a valid stop address and mark the email clearly as advertising.
- Get consent from named employees and sole traders, until guidance says otherwise.
- Existing customers: your own similar products only, with an opt-out at collection and in every message.
- Tell people where you got their data, at the latest in the first message (GDPR art. 14).
- Keep a suppression list and honour every objection.
- Document your legitimate-interest assessment.
How Leo handles Luxembourg leads
Revexa builds Leo, a buying-signal agent. Leo blocks only Germany automatically, so Luxembourg leads are not blocked. In review mode, the default, you read and approve every draft before it is sent and decide yourself, including whether to treat a named person as needing consent. Leo writes in the lead's own language when your website exists in that language, otherwise in English.
Common questions
Is B2B cold email legal in Luxembourg?
To company addresses, yes: the consent rule in art. 11 of the 2005 law covers only subscribers who are natural persons. You must identify yourself, give a valid stop address and label the email as advertising. For named employees the law is unclear.
Do I need consent to email a named employee in Luxembourg?
Possibly. The e-commerce law requires consent for unsolicited commercial email to a natural person, while the 2005 law exempts company subscribers. With no CNPD guidance, the cautious choice is consent.
What are the penalties in Luxembourg?
Criminal penalties of eight days to one year in prison and/or a fine of €251 to €125,000. We found no published sanction for sales email.