Is cold email legal in Spain? B2B rules for 2026

No, not without prior consent. Article 21 of Spain's Information Society Services Act (LSSI) bans advertising emails the recipient has not requested or expressly authorised, and the law defines a recipient as any natural or legal person, so the rule covers info@ addresses, named employees and sole traders (autónomos) alike. Existing customers are the only exception. We found no guidance from the data protection agency (AEPD) on LinkedIn messages.

Checked on 15 October 2026 against the law text and the regulator's guidance. This is not legal advice.

For email, Spain is as strict as Germany. Other countries: cold email laws by country.

At a glance

What does the law say?

Article 21(1) of Ley 34/2002 on information society services and electronic commerce (LSSI) implements article 13 of the EU ePrivacy Directive:

"Queda prohibido el envío de comunicaciones publicitarias o promocionales por correo electrónico u otro medio de comunicación electrónica equivalente que previamente no hubieran sido solicitadas o expresamente autorizadas por los destinatarios de las mismas."

"The sending of advertising or promotional communications by electronic mail or another equivalent means of electronic communication that have not previously been requested or expressly authorised by their recipients is prohibited." (our translation)

The annex is what brings companies in. A recipient ("destinatario") is a "persona física o jurídica que utiliza, sea o no por motivos profesionales, un servicio de la sociedad de la información" (a natural or legal person who uses an information society service, whether or not for professional purposes). Source: LSSI, consolidated text on BOE, updated 23 January 2025.

What does the AEPD say?

The AEPD's decisions are blunt about published addresses:

• Websites. In PS/00458/2022 it found a breach "con independencia de que los datos de este sean públicos y estén a disposición en diferentes páginas web de internet" (regardless of whether the recipient's data are public and available on various websites, our translation).
• Professional directories. In A/00381/2017, about emails to lawyers listed by their bar association, it held it "irrelevante" for article 21 that the addresses "estuvieran accesibles en sitios web de la red internet" (were accessible on websites, our translation).
• info@ addresses. The same decision quotes the National High Court (Audiencia Nacional, 23 July 2013): the "información" in info@ "es la que se produce desde la empresa titular del correo hacia sus propios clientes, no en dirección inversa" (is information flowing from the company to its own customers, not in the opposite direction, our translation). We have not read the judgment itself.

Company address or named person?

For email, Spanish law draws no line between companies and people, or between work and private use. In PS/00248/2021 a salesperson at an authorised Euskaltel dealer found a company's generic adm@ address through Google and sent a one-off offer. Euskaltel argued that the recipient was a legal person and the address generic. The AEPD still proposed a €5,000 fine, and Euskaltel paid a reduced €4,000 on 12 November 2021. Because it paid, the AEPD never answered the argument explicitly.

Named employees and autónomos are covered the same way. In PS/00458/2022 an SEO agency, Copy Coffee S.L., was fined €1,500 in 2023 for two sales emails to a lawyer whose address it found through Google (lowered from €5,000 because of the company's losses).

Can you send LinkedIn messages?

We found no AEPD guidance or decision on LinkedIn messages. Article 21 covers any "medio de comunicación electrónica equivalente" (equivalent means of electronic communication), and the AEPD has applied it to WhatsApp: OCIO MANAGEMENT S.L. was fined €600 for promotional WhatsApp messages without a way to object (PS/00388/2015), although consent existed in that case. Treating LinkedIn messages the same way is an analogy (our reading), not a ruling.

Related but different: the AEPD fined LinkedIn Ireland €10,000 under article 21(1) for LinkedIn's own marketing emails to someone who had unsubscribed (PS/00311/2023). That case was about email, not messages.

GDPR: does legitimate interest help?

For the data, yes; for the email, no. Article 19 of Spain's data protection act (LOPDGDD) presumes that processing the work contact details of employees, sole traders and liberal professionals rests on legitimate interest (GDPR art. 6(1)(f)), if only professional contact data are used, for dealings with the business. But the National High Court, quoted in A/00381/2017, held that this does not cover sending advertising, which is "una actividad singular y diferente, que es requerida de consentimiento autónomo por el art. 21.1" (a distinct and separate activity, which requires its own consent under article 21.1, our translation).

See our guide to legitimate interest for B2B email for the balancing test itself.

Fines and real cases

The AEPD enforces article 21 (LSSI art. 43(1)). An advertising email without consent is a minor breach, fined up to €30,000. Mass sending, or insistent sending to the same recipient, is a serious breach: €30,001 to €150,000 (arts. 38 and 39). In the decisions we read, amounts ranged from €600 to €10,000:

• Euskaltel, 2021: €4,000 paid (€5,000 proposed) for one offer to a company's generic address.
• Copy Coffee, 2023: €1,500 for two emails to a lawyer.
• LinkedIn Ireland (PS/00311/2023): €10,000 for marketing emails after an unsubscribe.
• Adartia (A/00381/2017): a warning for emails to lawyers taken from a bar directory.

Checklist for B2B email to Spain

1. Get consent before the first advertising email; without it, write only to existing customers about your own similar products.
2. Do not rely on addresses being public: websites and directories make no difference.
3. Make each email identifiable as advertising and show who sends it (LSSI art. 20).
4. Include an email address for objections and withdrawing consent (arts. 21(2) and 22(1)).
5. Keep one objection list across email, phone and LinkedIn.
6. Document your legitimate interest for the contact data (LOPDGDD art. 19); it does not replace consent for email.
7. Before calling, check advertising exclusion lists such as Lista Robinson.

How Leo handles Spain

Revexa, which publishes this guide, builds Leo, a buying-signal agent. Leo automatically blocks cold messages only to leads in Germany. For leads in Spain, as in every other country (Denmark and Norway included), you read and approve each draft in review mode and decide yourself whether it is sent. Leo writes in the lead's own language when your website exists in that language, otherwise in English, and in Swedish to Swedish buyers.

Common questions

Is B2B cold email legal in Spain?

Not without prior consent. LSSI article 21 bans advertising emails the recipient has not requested or expressly authorised, and recipients include companies, so generic addresses, named employees and autónomos all need consent. The exception is existing customers.

Can I email a Spanish company's info@ address?

Not with advertising, unless the company consented. Euskaltel paid €4,000 in 2021 for one offer to a company's generic address, and the National High Court has said an info@ address is no invitation to advertise.

Can I cold call Spanish businesses instead?

Phone is looser than email. Calls can rest on legitimate interest, and the AEPD presumes that calling employees, sole traders and professionals about their business is lawful. Check exclusion lists such as Lista Robinson first.

How big are the fines for cold email in Spain?

Up to €30,000 for a minor breach and €30,001 to €150,000 for mass or repeated sending (LSSI arts. 38 and 39). In the decisions we read, amounts ranged from €600 to €10,000.