Is cold email legal in Portugal? B2B rules for 2026

Partly: Portugal lets you send marketing email to companies (legal persons) without consent until they refuse, and you must check the national opt-out list of companies kept by the Directorate-General for Consumers (DGC). Natural persons, sole traders included, need prior consent. Whether a named employee's work address counts as the company's is unresolved; the law text points to consent. We found no guidance on LinkedIn messages.

Checked on 15 October 2026 against the law text and the regulator's guidance. This is not legal advice.

Portugal is looser than Germany for company addresses. Other countries: cold email laws by country.

At a glance

What does the law say?

Articles 13-A and 13-B of Law 41/2004 on privacy in electronic communications were added in 2012. Article 13-A(1) makes consent the rule for natural persons:

"Está sujeito a consentimento prévio e expresso do assinante que seja pessoa singular, ou do utilizador, o envio de comunicações não solicitadas para fins de marketing direto [...]"

"The sending of unsolicited communications for direct marketing purposes [...] is subject to the prior and express consent of the subscriber who is a natural person, or of the user." (our translation; the omitted part lists the channels, email included)

Article 13-A(2) exempts legal persons: unsolicited marketing to them is allowed "até que os assinantes recusem futuras comunicações e se inscrevam na lista" (until the subscribers refuse future communications and register on the list, our translation). Senders "são obrigadas a consultar a lista" (are obliged to consult the list), which the DGC updates monthly and provides on request (art. 13-B(5)). Source: Law 41/2004, consolidated text published by the Lisbon District Prosecutor's Office (PGDL). Sources citing article 22 of Decree-Law 7/2004 are out of date; it is repealed.

The text says "refuse ... and register". Our reading: treat a refusal sent to you as final, since every marketing email must give a valid contact for stop requests (art. 13-A(4)), and check the list as well.

What does the CNPD say?

The data protection authority's Guideline 2022/1 on direct marketing, approved on 25 January 2022, covers natural persons only; a footnote leaves the regime for legal persons aside. For natural persons it is clear (point 83):

"Se não existe uma relação jurídica prévia entre o responsável e o destinatário, apenas com o consentimento prévio e expresso do titular dos dados."

"If there is no prior legal relationship between the controller and the recipient, only with the prior and express consent of the data subject." (our translation)

Company address or named person?

Unclear, and this is where the sources are thinnest.

• Named employees. The law requires consent from every "utilizador", defined as "qualquer pessoa singular que utilize um serviço de comunicações eletrónicas acessível ao público para fins privados ou comerciais" (any natural person using a public electronic communications service for private or business purposes, our translation). An employee with a named address fits that definition. The CNPD has not addressed it and we found no court ruling; a Portuguese compliance publisher, Legiscope (September 2026), warns against treating every company-domain address as a generic company contact.
• Sole traders (empresário em nome individual) are subscribers who are natural persons, so consent is required.

Our reading: use the company route only for generic company addresses, and get consent for named people.

Can you send LinkedIn messages?

No guidance found: we found nothing from the CNPD or any court on LinkedIn or other social media messages. Our own analysis, not guidance: article 13-A(1) also covers "outros tipos de aplicações similares" (other similar types of applications), and the law defines electronic mail broadly (art. 2(1)(b)). If that covers LinkedIn, a message to a person's account would need consent.

GDPR: does legitimate interest help?

Only within the e-privacy rules. The CNPD's guideline says legitimate interest stands out as the GDPR basis for direct marketing, but the e-privacy law "só admite dois fundamentos" (allows only two grounds) for sending it: legitimate interest, which covers existing customers, and consent, for everyone else. We found no Portuguese rule presuming legitimate interest for B2B contact data, though we did not check Law 58/2019 article by article. The balancing test is in our guide to legitimate interest for B2B email.

Fines and real cases

We found no published fine for B2B email. The one individual decision we found is B2C: in Deliberação 297/2019 (6 May 2019) the CNPD fined a company, name redacted, €107,000 for marketing emails to one person without consent (40 offences at €2,500, plus €7,000 under the old law). Later fines are not published one by one: the CNPD's 2023 annual report counts 42 spam fines among 90, and the 2025 report 2 fines totalling €47,000, one for spam by a private entity.

Checklist for B2B email to Portugal

1. Request the DGC's list of companies that refuse marketing, and check it before each send.
2. Without consent, email only generic company addresses; get consent for named people and sole traders.
3. Show who you are and give a valid contact for stop requests in every email (art. 13-A(4)).
4. Keep an up-to-date list of who consented and which customers have not objected (art. 13-B(1)), and one objection list across channels.
5. For existing customers, market only your own analogous products.
6. Document your GDPR basis for any named contact, and say where you got the data (GDPR art. 14).

How Leo handles Portugal

Revexa, which publishes this guide, builds Leo, a buying-signal agent. Leo automatically blocks cold messages only to leads in Germany. For leads in Portugal, as in every other country (Denmark and Norway included), you read and approve each draft in review mode and decide yourself whether it is sent. Leo writes in the lead's own language when your website exists in that language, otherwise in English, and in Swedish to Swedish buyers.

Common questions

Is B2B cold email legal in Portugal?

Partly. You may email a company (a legal person) without consent until it refuses, after checking the DGC's opt-out list. Natural persons, sole traders included, need prior consent, and named employees are unresolved, so consent is the cautious route.

Do I need consent to email a named employee in Portugal?

Probably, in our reading, but nobody has ruled. The law requires consent from any "utilizador", any natural person using the service, also for business. The CNPD has not addressed named work addresses and we found no court ruling.

What is the DGC opt-out list?

A national list of companies that refuse direct marketing, kept by the Directorate-General for Consumers. Senders must consult it; the DGC updates it monthly and provides it on request (Law 41/2004, art. 13-B).

What are the fines for cold email in Portugal?

€5,000 to €5,000,000 per offence for companies and €1,500 to €25,000 for individuals, halved for negligence. The only individual decision we found, €107,000 in 2019, concerned emails to one consumer.