Is cold email legal in Poland? B2B rules for 2026

No, not without prior consent. Since 10 November 2024, article 398 of Poland's Electronic Communications Law (Prawo komunikacji elektronicznej, PKE) bans sending commercial information by electronic means, email included, to any subscriber or end user, companies included, unless they consented first. That covers info@ addresses, named employees and sole traders alike: the Ministry of Digital Affairs says they are protected "on equal terms". There is no soft opt-in for existing customers, and we found no guidance on LinkedIn, but the law names interpersonal communications services, so we treat a sales DM as covered.

Checked on 15 October 2026 against the law text and the regulator's guidance. This is not legal advice.

Poland now sits with Germany: consent first, even in B2B. All countries: cold email laws by country.

Poland at a glance

What the law says

Article 398(1) of PKE (Dz.U. 2024 poz. 1221) replaced older rules, one of which protected only natural persons:

"Zakazane jest używanie: 1) automatycznych systemów wywołujących, 2) telekomunikacyjnych urządzeń końcowych, w szczególności w ramach korzystania z usług komunikacji interpersonalnej ... do celów przesyłania informacji handlowej ... w tym marketingu bezpośredniego, do abonenta lub użytkownika końcowego, chyba że uprzednio wyraził on na to zgodę."

Our translation: "The use of: 1) automated calling systems, 2) telecommunications terminal equipment, in particular when using interpersonal communications services ... for the purpose of sending commercial information ... including direct marketing, to a subscriber or end user is prohibited, unless that person has given prior consent."

Commercial information is "any information intended directly or indirectly to promote goods, services or the image of an entrepreneur" (article 2(2) of the 2002 Act). Under article 398(2), consent may be given by making an address available "for the purpose of sending commercial information". An address published on a website was not made available for that purpose, so in our reading it is not consent; a practitioner commentary on Prawo.pl agrees (a secondary source). The government bill adds that consent must be specific and name the channel, the purpose and the company it is given to. Sources: PKE on the Sejm's ELI service and ISAP; government bill, print no. 423. In our reading, no later amendment has changed article 398.

What the Ministry says

The clearest official statement we found is not regulator guidance but the Ministry of Digital Affairs' answer to interpellation no. 12146 of 30 September 2025 (our translation):

"In addition, natural persons (including sole proprietorships) and organisational units (legal persons, including for example capital companies, foundations or universities) are now covered on equal terms by the protection against receiving commercial information without consent."

A business "should also be able to demonstrate that it holds prior consent, even if it uses a database", and asking by phone is out: "Nor is it permitted to ask for consent to present a commercial offer during a telephone call", citing decisions of UKE and UOKiK without case numbers (answer, PDF).

Named employees, sole traders and the first email

Because PKE makes no distinction, a named employee's work address is treated like info@: consent first. We found no guidance on whose consent counts for a work address, the employer's as subscriber or the employee's as user.

Can a first email ask for consent? We found no decision on email. Since commercial information includes anything that promotes the image of a business, and the Ministry rules out asking by phone, a consent-request email is risky too (our reading).

LinkedIn and social media messages

No guidance found from UKE, UOKiK, UODO or any court. Article 398(1) covers terminal equipment "in particular when using interpersonal communications services", and the government bill lists the forms direct marketing may take, ending with "all other forms of communication". Whether LinkedIn messaging is "merely an ancillary feature to another principal service", which the definition excludes, is undecided. Our reading: a LinkedIn sales message to a recipient in Poland needs consent.

GDPR and UODO

UODO accepts that processing personal data for direct marketing is "an activity carried out in the legitimate interest referred to in its Article 6(1)(f)" (decision DKE.523.38.2021, our translation). In Poland that does not settle the sending: PKE consent is a separate requirement, and the government bill notes that UODO and the administrative courts "stressed the need to separate consents for different purposes". An objection ends all marketing use of the data (UODO).

In the Bisnode case, UODO held that a company taking personal data from public registers (KRS, CEIDG, REGON) "must comply with the information obligation in relation to these persons set out in Article 14 of the GDPR" by "directly providing information to the data subject" (UODO). A court annulled the fine amount, so it is not a final penalty. More in GDPR and B2B email under legitimate interest.

Fines and real cases

The President of UKE imposes "a financial penalty of up to 3% of the penalised entity's revenue in the previous calendar year or up to PLN 1,000,000, whichever is higher" for failing to obtain consent (article 446(5), our translation). Sending without consent is also a petty offence prosecuted at the request of the injured party (article 448), and an act of unfair competition (article 398(4)).

We found no published UKE decision under article 446(5). Two cases under the older law:

• Tani Opał sp. z o.o., published 5 November 2019: PLN 500,000 for 2,180,360 marketing calls without consent; not final at the time (UKE).
• Polkomtel sp. z o.o.: PLN 2.85 million for calls, text messages and 1,021,256 emails sent without consent in 2020 and 2021, in a decision dated 30 June 2024 according to the Ministry's answer to interpellation no. 12182 (PDF). We found no UKE press release on it.

Checklist for B2B email to Poland

1. Get prior consent before the first commercial message, specific to channel, purpose and your company, and keep proof.
2. Do not treat a published address, a public register or a bought database as consent.
3. Avoid "may we send you an offer?" emails and calls.
4. Keep PKE consent separate from your GDPR basis.
5. Inform people directly (GDPR article 14) when you take data from KRS, CEIDG or REGON.
6. Honour every objection through a suppression list.

How Leo handles Poland

Leo, the buying-signal agent Revexa builds, blocks only Germany automatically, not Poland. Polish law requires prior consent even for company addresses, and you read and approve every draft in review mode, so whether a Polish lead has consented is yours to check before you approve. Leo writes to each lead in the lead's own language when your website exists in that language, and in English otherwise.

Common questions

Is B2B cold email legal in Poland?

No. Since 10 November 2024, article 398 of the Electronic Communications Law requires prior consent for commercial information to any subscriber or end user; companies, sole traders and individuals are protected on equal terms.

Can I email a Polish company's info@ address without consent?

No. Article 398 protects every subscriber and end user, not only natural persons, and in our reading a published address is not consent. Older sources that say otherwise describe the law before November 2024.

Can I send a first email asking for consent in Poland?

It is risky. The Ministry says asking for consent during a phone call is not allowed, and because commercial information includes anything that promotes a business's image, a consent-request email can count too (our reading).

What are the penalties for cold email in Poland?

The President of UKE can fine up to 3% of the previous year's revenue or PLN 1,000,000, whichever is higher. Sending without consent is also a petty offence prosecuted at the recipient's request, and an act of unfair competition.