Is cold email legal in the Netherlands? B2B rules for 2026

No, not without prior consent, and that includes business recipients. Since 1 October 2009, Article 11.7 of the Dutch Telecommunications Act (Telecommunicatiewet) has required prior consent for commercial email to every "end user", a term that covers companies, their named employees and sole traders. The B2B exceptions are narrow: an address the company itself published for receiving offers, a recipient established outside the EEA, and your own customers. We found no Dutch guidance on LinkedIn, but the regulator applies the ban to email, apps and WhatsApp.

Checked on 15 October 2026 against the law text and the regulator's guidance. This is not legal advice.

Like Germany, the Netherlands requires consent for business email, and here a regulator, the ACM, enforces it with fines. For other countries, see cold email laws by country.

At a glance

What does Article 11.7 say?

Article 11.7(1) Telecommunicatiewet, in the version in force since 15 August 2026:

"Het gebruik van automatische oproep- en communicatiesystemen zonder menselijke tussenkomst, faxen en elektronische berichten voor het overbrengen van ongevraagde communicatie voor commerciële, ideële of charitatieve doeleinden is verboden, tenzij de verzender kan aantonen dat de desbetreffende eindgebruiker daarvoor voorafgaand toestemming heeft verleend."

Our translation: "The use of automatic calling and communication systems without human intervention, faxes and electronic messages to transmit unsolicited communications for commercial, idealistic or charitable purposes is prohibited, unless the sender can demonstrate that the end user concerned gave prior consent."

The key word is "eindgebruiker", end user, defined in art. 1.1 as a "natuurlijke persoon of rechtspersoon", a natural or legal person. For businesses and professionals, paragraph 3 lifts the consent requirement only for contact details they designated and published for receiving such offers, or for recipients established outside the EEA. Paragraph 7 requires every message to state "de werkelijke identiteit" of the sender and "een geldig postadres of nummer" for stop requests.

What do the regulators say?

The Dutch Data Protection Authority (AP) is direct on its page on digital direct marketing (updated 4 April 2025):

"Wilt u als organisatie andere organisaties of bedrijven benaderen met digitale direct marketing? Ook dan heeft u hiervoor voorafgaande toestemming van de ontvangers nodig."

Our translation: "Do you as an organisation want to approach other organisations or businesses with digital direct marketing? Then too you need the recipients' prior consent." (AP)

Its example of an address that qualifies for the exception is one a company has "bewust" (deliberately) published for offers, such as salesaanbiedingen@bedrijfsnaam.nl. A listing in a business directory or the Chamber of Commerce (KvK) register is not consent: the government told the Senate in 2008 that such registers exist to make businesses reachable and "mag niet worden gezien als toestemming" (Kamerstukken I 2007/08, 30 661, E).

The ACM, which enforces Article 11.7, tells business customers that unsolicited advertising by email, SMS or app without consent is spam, and "Spam is verboden" (ACM).

Company, employee or sole trader?

For email, Dutch law has made no distinction since 2009. The explanatory memorandum says "het opt-in regime zal gelden" for marketing messages "aan natuurlijke en rechtspersonen", to natural and legal persons alike (MvT 30 661, nr. 3). Sole traders fall under the same rule and the same narrow exception, and a named address is also personal data under GDPR.

One source points the other way: the KvK, which is not a regulator, says on a page updated 2 July 2026 that protection against unwanted marketing does not apply to a bv or nv. That matches the phone rule, not the email rule.

Can you send LinkedIn messages to Dutch prospects?

No guidance found: nothing from the ACM or the AP on LinkedIn, and no court ruling. The ACM tells advertisers to avoid spam "via e-mail, whatsappjes of andere elektronische berichten" (ACM), and the statute defines an "elektronisch bericht" in technology-neutral terms. Our reading, untested: a sales DM on LinkedIn falls under the same consent rule.

How does GDPR apply?

GDPR governs the contact data; Article 11.7 governs the message. The AP once held that a purely commercial interest could never be legitimate, and fined the tennis association KNLTB €525,000 in 2019 on that basis. The EU Court of Justice disagreed in 2024 (C-621/22), ruling, in the AP's summary, that "onder bepaalde omstandigheden ook een commercieel belang kan worden aangemerkt als gerechtvaardigd belang" (AP). The AP's guidance now says the interest in direct marketing "kan in veel gevallen worden beschouwd als een gerechtvaardigd belang", but it must be current, not hypothetical (AP).

None of that removes the consent requirement for the email itself. The AP also notes that GDPR does not apply to data about businesses "die niet te herleiden zijn naar personen", so a pure info@ address is usually outside GDPR, while Article 11.7 still covers it. More in GDPR and B2B email under legitimate interest.

Sanctions

The ACM can fine up to €900,000 or, if higher, 1% of turnover (Tw art. 15.4(2)), and the maximum doubles for a repeat within five years. A B2B example: OPTA, now part of the ACM, fined Companeo €100,000 "voor het versturen van spam aan voornamelijk zakelijke ontvangers", for sending spam to mainly business recipients, nearly 15 million advertising emails between late 2009 and early 2011 (ACM, 2 October 2012). The Trade and Industry Appeals Tribunal set the fine at €75,000 in 2016 (ECLI:NL:CBB:2016:60). We may have missed newer decisions.

Checklist: B2B email to the Netherlands

1. Get prior consent for every address, info@ included, and keep proof: the sender must be able to show it.
2. Use the exception only for addresses published for offers; a directory or KvK listing is not consent.
3. Existing customers: your own similar products only, with an opt-out at collection and in every message. A newsletter sign-up or user account does not make someone a customer (AP).
4. State your true identity and a valid address or number for stop requests in every message.
5. Keep a suppression list and honour objections at once.
6. Calls: bv and nv without consent; sole traders, vof and maatschap only with prior consent.

How Leo handles Dutch leads

Revexa builds Leo, a buying-signal agent. Leo blocks only Germany automatically, so Dutch leads are not blocked. In review mode, the default, you read and approve every draft before it is sent and decide yourself; since Dutch law requires consent for business email, skip Dutch leads you have no consent from. Leo writes in the lead's own language when your website exists in that language, Dutch for Dutch leads if your site has a Dutch version, and otherwise in English.

Common questions

Is B2B cold email legal in the Netherlands?

No, not without prior consent. Article 11.7 Telecommunicatiewet protects every end user, companies included, and the exceptions are narrow: an address published for offers, a recipient outside the EEA, and existing customers.

Can I email a Dutch company's info@ address?

Only with consent, unless the company itself published that address for receiving commercial offers. A listing in the KvK register or a business directory is not consent.

Can I cold call Dutch businesses?

Yes, if the business is a legal entity such as a bv or nv. Sole traders and partnerships (vof, maatschap) need prior consent, and a number in the KvK register is not consent.

What are the fines for spam in the Netherlands?

The ACM can fine up to €900,000 or 1% of turnover, whichever is higher. Companeo's fine for spam to mainly business recipients was set at €75,000 on appeal in 2016.