Is cold email legal in Norway? B2B rules for 2026

Only to generic addresses. Section 15 of Norway's Marketing Control Act (markedsføringsloven) requires prior consent for marketing email to natural persons, and the Consumer Authority (Forbrukertilsynet) and the Data Protection Authority (Datatilsynet) both apply it to named work addresses such as ola.nordmann@firmaX.no, even when the offer is for the business. Addresses that belong to no specific person, such as post@, need no consent, but the sender carries the risk. Sole traders need consent (our reading), and on LinkedIn, Forbrukertilsynet only says social media raises the same concerns as email.

Checked on 15 October 2026 against the law text and the regulator's guidance. This is not legal advice.

Norway is looser than Germany for company inboxes but just as strict for named people. The Nordic picture is in how to find B2B customers in the Nordics, other countries in cold email laws by country.

At a glance

What does the law say?

"I næringsvirksomhet er det forbudt, uten mottakerens forutgående samtykke, å rette markedsføringshenvendelser til fysiske personer ved elektroniske kommunikasjonsmetoder som tillater individuell kommunikasjon, som for eksempel elektronisk post, telefaks eller automatisert oppringningssystem (talemaskin)." (§ 15)

"In business activities it is prohibited, without the recipient's prior consent, to direct marketing communications to natural persons by electronic communication methods that allow individual communication, such as electronic mail, fax or automated calling systems (voice machines)." (our translation)

Source: markedsføringsloven on Lovdata. Electronic mail is defined broadly in the same section, as any text, speech, sound or image message that can be stored until the recipient collects it. The E-commerce Act § 9 adds that it must be clear "hvem markedsføringen skjer på vegne av" (on whose behalf the marketing is made), and that unsolicited marketing email must be recognisable as marketing when it arrives.

What does Forbrukertilsynet say?

Its guidance on marketing by email, SMS and similar (published 2 October 2019, updated 8 May 2026) draws the line by address (point 2.4):

"Det er imidlertid tillatt å sende markedsføring til e-postadresser som ikke tilhører en bestemt fysisk person, f.eks. post@firmaX.no."

"It is, however, permitted to send marketing to e-mail addresses that do not belong to a specific natural person, e.g. post@firmaX.no." (our translation)

"Det samme gjelder henvendelser som sendes til en fysisk persons individuelle e-postadresse på jobben, for eksempel til e-postadressen ola.nordmann@firmaX.no, uansett om e-posten inneholder tilbud til virksomheten."

"The same applies to communications sent to a natural person's individual e-mail address at work, for example ola.nordmann@firmaX.no, regardless of whether the e-mail contains an offer to the business." (our translation)

The ban applies even when a person's address is registered as a company's contact address in the Brønnøysund Register or another business register. Where it is unclear whether an address belongs to a person, the sender carries the risk: a breach is found if it did.

Company address or named person?

A company has no protection under § 15; people do, at work too. Datatilsynet describes consent as needed when "markedsføringen sendes til en bestemt person, enten en privatperson eller en arbeidstaker i en virksomhet (for eksempel navn@virksomhet.no)" (the marketing is sent to a specific person, either a private individual or an employee of a business, for example name@business.no, our translation).

Sole traders (enkeltpersonforetak) are not mentioned in the guidance; we found no use of the term there. Because the owner is a natural person, we read them as needing consent.

Can you send LinkedIn messages?

Partly answered. Forbrukertilsynet's guidance (point 2.2) says:

"Når det gjelder markedsføring via sosiale medier som Facebook og Twitter, er det Forbrukertilsynets vurdering at de samme hensynene i like stor grad gjør seg gjeldende som for de formene for kommunikasjon som listes opp i § 15."

"As regards marketing via social media such as Facebook and Twitter, the Consumer Authority's assessment is that the same considerations apply to the same extent as for the forms of communication listed in section 15." (our translation)

LinkedIn and private messages are not named, so for LinkedIn specifically we found no guidance. The cautious reading: treat a sales message to a named person on LinkedIn like email to a natural person, which needs consent.

GDPR: does legitimate interest help?

GDPR applies in Norway as Norwegian law (Personal Data Act). Datatilsynet says a valid § 15 consent also meets GDPR's requirements, and that for existing customers the specific marketing rules take precedence, so no separate GDPR basis is needed (it cites the EU Court of Justice without naming the case). It does not mention legitimate interest for cold B2B email, and a post@ address that identifies no one is not personal data. The general balancing test is in our guide to legitimate interest for B2B email.

Fines and real cases

Forbrukertilsynet enforces the act, with the Market Council above it. It can ban a practice with a coercive fine (§ 41) and impose an infringement fee for a breach of § 15 that is material or repeated (§ 42). We found no infringement fee for B2B email.

The real case concerns consumers. In FOV-2022-3801 (decided in 2023, published 18 April 2024), after 336 complaints about marketing SMS sent without consent, Forbrukertilsynet banned the sender, a private individual, under § 15, with a coercive fine of NOK 5,000 for each new breach. Its own example: 100 more such messages would cost NOK 500,000.

Checklist for B2B email to Norway

1. Without consent, email only addresses that belong to no specific person, and check that they really don't.
2. Get consent before emailing a named person, including addresses from the Brønnøysund Register.
3. Make clear who sends the email and that it is marketing (E-commerce Act § 9).
4. Use the existing-customer exception only for buyers, with an opt-out every time.
5. Keep one objection list across channels.
6. For calls, check the Reservation Register for consumers, respect direct opt-outs (§ 12), and say who gave you the data (§ 16).

How Leo handles Norway

Revexa, which publishes this guide, builds Leo, a buying-signal agent. Leo automatically blocks cold messages only to leads in Germany, not to leads in Norway. For Norwegian leads, as in every country except Germany, you read and approve each draft in review mode and decide yourself whether it is sent, so applying the consent rule above is your call. Leo writes in the lead's own language when your website exists in that language, otherwise in English, and in Swedish to Swedish buyers.

Common questions

Is cold B2B email legal in Norway?

Only to generic company addresses such as post@. Markedsføringsloven § 15 requires prior consent for marketing email to natural persons, named work addresses included, even when the offer is for the business. Existing customers are the exception.

Can I use email addresses from the Brønnøysund Register?

Not a person's address without consent. Forbrukertilsynet says the ban applies even when a natural person's email is registered as a company's contact address in the Brønnøysund Register or another business register.

Can I send LinkedIn messages to Norwegian prospects?

Forbrukertilsynet says social media marketing raises the same concerns as the channels in § 15, without naming LinkedIn or private messages. The cautious reading: consent first, as for email.

Can I cold call Norwegian businesses?

Yes. Manual phone calls need no consent under § 15, but you may not call consumers listed in the Reservation Register or a person who has opted out directly with you (§ 12).