Is cold email legal in Slovenia? B2B rules 2026

For company addresses, yes, without prior consent. Article 226 of Slovenia's Electronic Communications Act (ZEKom-2) requires prior consent for marketing email, but its paragraph 4 limits that rule to "naročnike, ki so fizične osebe", subscribers who are natural persons. Every message must still name the sender, be recognisable as marketing and give a valid stop address. A named employee needs consent in the Information Commissioner's non-binding reading, unless the company published the address as its contact, which the act allows. AKOS, the communications agency, enforces the rule; fines reach EUR 20,000 for emailing without consent and EUR 50,000 for an unlabelled message.

Checked on 2 November 2026 against the law text, the Information Commissioner's opinions and the AKOS annual reports. This is not legal advice.

Slovenia sits with Belgium and Norway: consent for natural persons only. All countries: cold email laws by country.

Slovenia at a glance

What the law says

Article 226 of ZEKom-2 (Official Gazette RS 130/2022, in force since 10 November 2022) implements article 13 of the ePrivacy Directive. Paragraph 1:

"Uporaba samodejnih klicnih in komunikacijskih sistemov [...], telefaksov ali elektronske pošte za namene neposrednega trženja je dovoljena samo na podlagi naročnikovega ali uporabnikovega predhodnega soglasja."

Our translation: "The use of automatic calling and communication systems [...], fax or electronic mail for direct marketing is allowed only on the basis of the subscriber's or user's prior consent." Then paragraph 4:

"Prvi in tretji odstavek tega člena se uporabljata za naročnike, ki so fizične osebe."

Our translation: "The first and third paragraphs of this article apply to subscribers who are natural persons." This mirrors article 13(5) of the directive. A subscriber is any natural or legal person with a contract with a communications provider (art. 3, point 44), and electronic mail is any text, voice, sound or image message sent over a public network and stored until collected (art. 3, point 7, our paraphrase). The act never mentions employees; named staff addresses are covered below.

Three more rules matter:

• Soft opt-in (paragraph 2): a business that got a customer's email address from that customer may market "svojih podobnih izdelkov ali storitev" (its own similar products or services) to it, if the customer can refuse "brezplačno in enostavno" (free of charge and easily) at collection and in every message.
• Hidden sender (paragraph 5): marketing email that hides the sender's identity, or has no "veljavnega naslova" (valid address) for stop requests, is banned. Paragraph 4 does not limit this rule, so it covers every recipient.
• Published addresses (paragraph 6): anyone may use natural persons' email addresses if the legal entity "javno objavi kot svoj kontaktni elektronski naslov" (publicly publishes them as its contact email address).

The e-commerce act, ZEPT, requires in article 6(1) that a commercial message be clearly recognisable and name the person on whose behalf it is sent; article 6(2) leaves consent to the communications law. The consolidated ZEKom-2, applicable since 19 June 2025, keeps article 226 unchanged, and we found no later amendment.

What the regulators say

The Information Commissioner (Informacijski pooblaščenec, IP) gives non-binding opinions and says it does not supervise this rule. Its opinion 07121-1/2025/301 of 6 March 2025:

"ZEPT ne vsebuje pogoja, da je potrebno predhodno soglasje pridobiti tudi od prejemnikov, ki so pravne osebe."

Our translation: "ZEPT contains no condition that prior consent must also be obtained from recipients who are legal persons." The same opinion ties ZEKom-2 to messages to natural persons and ZEPT to messages to legal persons, supervised by AKOS and the Market Inspectorate (TIRS) respectively (IP; one passage still cites the old ZEKom-1).

A 2022 opinion under the old law says shared addresses such as info@podjetje.si are in principle not personal data (IP, 2022). That concerns data protection, not sending, and we found no AKOS guidance on generic addresses. Our reading: an info@ address belongs to the company, so no consent is needed, though paragraph 5 and ZEPT article 6(1) apply.

Named employees, sole traders and the first email

Named employees. The IP says messages count as marketing to individuals "načeloma" (in principle) when sent to the addresses of specific or identifiable people, for example ime.priimek@druzba.si. That reading is non-binding, and the IP leaves interpretation to AKOS and TIRS (IP, 2025). In our reading, paragraph 6 points the same way, as it only makes sense if staff addresses otherwise need consent. In 2016, under the old law, the IP and AKOS jointly told marketers to check that published staff addresses are still online, record the source and send only relevant offers (STA report). Our reading: firstname.lastname@ on a company's contact page is usable; found elsewhere (a conference list, a leaked database), it needs consent.

Sole traders. A sole trader is a natural person in law (ZGD-1, art. 3(6)), so on the text of paragraph 4 the consent rule applies. The IP says a sole trader's business details are not protected personal data (IP, 2023), but that concerns data protection, not article 226. Our reading: get consent.

A first email asking for consent. No guidance found. The IP defines direct marketing broadly, as any promotion of products, services, ideas or people aimed at a specific individual (IP, 2025). Our reading: for a natural person, ask by other means, such as a form, an event or a permitted phone call.

LinkedIn and social media messages

No guidance found under ZEKom-2. A 2020 IP opinion under the old law said marketing to an address published on LinkedIn or Facebook could be possible if the terms of use cover it (IP, 2020); it concerns addresses, not direct messages. Our reading: a LinkedIn message to a named person is probably electronic mail under the act's broad definition and needs consent; a connection request is not consent.

GDPR and the Information Commissioner

Emailing a named person means processing personal data, so GDPR applies too. The IP says that since the old data protection act's marketing rules lapsed, electronic marketing to individuals falls under ZEKom-2 and postal marketing under GDPR (IP). An objection to direct marketing ends it (GDPR art. 21(2) and (3)), and people can ask where you got their address. More in GDPR and B2B email under legitimate interest.

Fines and real cases

For breaches of article 226, the stop-address rule included, article 301 of ZEKom-2 sets these fines:

• Legal persons: EUR 200 to 1,000, and EUR 1,000 to 20,000 for medium and large companies.
• Sole traders: EUR 200 to 1,000; responsible persons: EUR 100 to 500; individuals: EUR 300 to 1,000.

Under the Companies Act, a company is medium or large, broadly, once it exceeds two of 50 employees, EUR 10 million turnover and EUR 5 million in assets (ZGD-1 art. 55, as amended in 2024). For breaking ZEPT article 6(1) (no labelling, no named sender), ZEPT article 20 sets EUR 10,000 to 50,000 for medium and large companies and EUR 2,000 to 20,000 for other legal persons and sole traders. GDPR breaches can reach EUR 20 million or 4% of turnover (article 83(5)).

We found no published fine or decision against a sender of B2B email; AKOS reports only totals. In 2024 it opened 163 inspections and 23 misdemeanour procedures under ZEKom-2 on all topics, most on five subjects led by "neposrednem trženju, torej neželene komunikacije" (direct marketing, that is, unsolicited communications) (annual report 2024, p. 95). In 2025 it ran 97 supervisory and 35 misdemeanour procedures and 71 preventive reviews, with unsolicited communications again a main topic, and said prevention worked better than sanctions (annual report 2025, p. 88).

Anyone harmed by a breach, service providers included, may also sue or seek an injunction (art. 226(7)).

Checklist for B2B email to Slovenia

1. Company addresses (info@, sales@): no prior consent needed, in our reading.
2. Named people and sole traders: get consent first, or use only staff addresses the company publishes as its contact.
3. Name the sender, label the message as commercial and give a working stop address or link.
4. Existing customers who are individuals: own similar products only, with a free opt-out every time.
5. Keep a suppression list, stop at once after an objection and record the source of every address.

How Leo handles Slovenia

Leo, the buying-signal agent Revexa builds, applies its own automatic rule only to Germany, where nothing is sent without your approval, not even in autonomous mode. Slovenia has no such rule. In our reading, Slovenian law lets you email a company address without consent but not a named person found elsewhere, and in review mode, the default, you read and approve every draft, so whether an address is a published company contact is yours to check before you approve. Leo writes to each lead in the lead's own language when your website exists in that language, and in English otherwise. Leo is the wrong choice if you need software that checks Slovenian address types for you.

More countries: Luxembourg, Hungary, Slovakia, Bulgaria, Croatia, Lithuania, Latvia, Cyprus, Malta and Iceland.

Common questions

Is B2B cold email legal in Slovenia?

For company addresses, yes, without prior consent: article 226(4) of ZEKom-2 limits the consent rule to subscribers who are natural persons. You must still name the sender and give a valid stop address.

Can I email a Slovenian company's info@ address without consent?

In our reading, yes. The Information Commissioner says ZEPT has no consent condition for legal persons, and we found no AKOS guidance to the contrary. Paragraph 5 and ZEPT article 6(1) still apply.

Can I email a named employee in Slovenia?

Only with consent in the Information Commissioner's non-binding reading, unless the company published the address as its contact, as article 226(6) allows. The IP treats firstname.lastname@company addresses as those of specific people.

Are LinkedIn messages covered in Slovenia?

We found no guidance naming LinkedIn. In our reading, a message to a named person is probably electronic mail under the act's broad definition and needs consent.

What are the fines for cold email in Slovenia?

Without consent: up to EUR 20,000 under ZEKom-2 for medium and large companies, EUR 1,000 for others. Without a label or named sender: up to EUR 50,000 under ZEPT. We found no published fine against a B2B sender.