# Is Cold Email Legal in Europe? B2B Rules by Country (2026)

> Europe has no single rule for B2B cold email. The UK and France work on an opt-out basis, Germany, Spain and Italy require consent, and some countries decide by the type of address. Here is the country table and how to plan around it.

Source: https://knkoutbound.com/blog/cold-email-law-europe/  
Author: Kenneth Kather, Founder & CEO, KNK Outbound  
Published: 2026-11-08

## Key takeaways

- There is no single European rule. The ePrivacy Directive is implemented nationally, so the same B2B email can be allowed in France and require consent in Germany.
- Plan by the recipient's country. A US or UK sender writing to a German company has to look at the German rules, not at the rules back home.
- An opt-out country does not remove GDPR. Where the personal data came from, the legal basis and the duty to inform the contact apply in every EU country.
- A European campaign therefore needs three tracks: email-led where opt-out applies, address-checked where the type of address decides, and LinkedIn-led with other channels where consent is required.

## The short answer

Cold email to businesses is allowed in some European countries and restricted in others. In the UK, France, Ireland and Sweden, B2B email can generally be sent on an opt-out basis if it relates to the recipient's professional role and offers an easy way out. In Germany, Austria, Switzerland, the Netherlands, Spain, Italy, Denmark and Poland, the table below lists prior consent as the requirement, even between businesses. GDPR applies on top in every EU country. This is not legal advice.

## Why Europe has no single rule

Two layers apply at the same time, and most articles only mention one of them.

**The first layer decides whether you may send at all.** It comes from the ePrivacy Directive 2002/58/EC, which each country wrote into its own law. The directive requires consent for marketing email to private individuals, but leaves countries room on how to protect businesses. That is why the answer changes at every border.

**The second layer decides how you may handle the data.** GDPR covers names and business email addresses, because a person's work address is still personal data. You need a legal basis, usually legitimate interest under Article 6(1)(f), and you have to tell contacts where you got their data under Article 14.

A campaign has to pass both. "GDPR allows legitimate interest" does not answer the first question, and that confusion causes many of the wrong statements online.

## B2B email rules by country

The table follows the European overview published by the law firm [Fieldfisher](https://res.cloudinary.com/fieldfisher/image/upload/v1706627634/PDFs/EU_e-marketing_requirements_-_January_2024_lqpl6s.pdf), dated January 2024, for email sent by the company that collected the data itself. Laws change, so check the current position before launch.

| Country | B2B rule for your own email | Law named |
|---|---|---|
| United Kingdom | Opt-out | PECR 2003 |
| France | Opt-out | Art. L34-5 Postal and Electronic Communications Code |
| Ireland | Opt-out if it relates to the professional role, otherwise opt-in | ePrivacy Regulations 2011 |
| Sweden | Opt-out if it relates to the professional role, otherwise opt-in | Marketing Practices Act 2008:486 |
| Croatia | Opt-out | Electronic Communications Act |
| Estonia | Opt-out | Electronic Communications Act |
| Hungary | Opt-out | Advertising Act, E-commerce Act |
| Latvia | Opt-out | Law on Information Society Services |
| Luxembourg | Opt-out | E-commerce Law 2000, Electronic Communications Law 2005 |
| Slovenia | Opt-out | Electronic Communications Act |
| Slovakia | Opt-out if the business contact details are publicly available | Act on e-Commerce |
| Finland | Opt-in for individual addresses, opt-out for generic ones or if the role clearly relates to the offer | Information Society Code |
| Norway | Opt-in for individual addresses, opt-out for generic ones | Marketing Control Act |
| Portugal | Opt-in for individual addresses, opt-out for generic ones unless on the national opt-out list | Law 41/2004 |
| Belgium | Opt-in for individual addresses | Code of Economic Law |
| Germany | Consent, double opt-in advised | UWG |
| Austria | Consent, double opt-in advised | Telecommunications Act |
| Switzerland | Consent | UWG Art. 3(1)(o) |
| Netherlands | Consent | Telecommunications Act |
| Spain | Consent | LSSI, Law 34/2002 |
| Italy | Consent | Personal Data Protection Code |
| Denmark | Consent | Marketing Practices Act |
| Poland | Consent | Act on e-Services, Telecommunications Law |
| Czech Republic | Consent | Act 480/2004 |
| Greece | Consent | Law 3471/2006 |
| Romania | Consent | Law 506/2004 |
| Bulgaria | Consent | Electronic Communications Act |
| Lithuania | Consent | Electronic Communications Law |
| Cyprus | Consent | Law 112(I)/2004 |
| Malta | Consent | Subsidiary Legislation 586.01 |

The overview also lists a "soft opt-in" for most consent countries: you may write to existing customers about similar products. That helps with your customer base, but not with people you have never dealt with, so it does not make cold outreach possible.

## Details that change the answer

**United Kingdom.** The opt-out rule covers corporate subscribers. According to the [ICO's guidance on business-to-business marketing](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/), sole traders and some partnerships count as individuals and get the stricter rule. UK GDPR still applies to the personal data.

**France.** The opt-out route depends on the message relating to the recipient's professional activity. A generic offer sent to a named person outside that activity falls outside the logic of the rule.

**Germany and Austria.** German law treats advertising email without prior consent as an unreasonable nuisance, also between businesses. Austria is at least as strict and has a national opt-out list. Our guide on [whether cold outreach is allowed in Germany, Austria and Switzerland](https://knkoutbound.com/blog/ist-kaltakquise-erlaubt/) goes through each channel.

**Switzerland.** The rule targets electronic mass advertising, and Switzerland has its own data protection act rather than GDPR. Whether a message counts as mass advertising depends on the individual case.

**Other countries for comparison.** In the US, CAN-SPAM works on an opt-out basis: accurate sender details, a postal address, a working unsubscribe, and no consent needed in advance. Canada's CASL is close to the European consent model, with some exceptions for implied consent. Copying a US playbook across to Europe therefore goes wrong in the first step.

## What this means for a European campaign

Treat Europe as three groups of markets rather than one list.

| Group | Examples | Channel plan |
|---|---|---|
| Opt-out markets | UK, France, Ireland, Sweden | Email carries the volume, LinkedIn supports it, every message relates to the recipient's role |
| Address-dependent markets | Finland, Norway, Portugal, Belgium | Check address types first, then decide per segment |
| Consent markets | Germany, Austria, Switzerland, Netherlands, Spain, Italy, Denmark, Poland | LinkedIn and permitted phone contact lead, email only with a solid basis, plus inbound and events |

Then apply these rules in every market:

- **Keep the recipient's country in your data.** A UK company with a German subsidiary can be two different cases.
- **Write down your legitimate interest assessment.** One page per campaign is enough, and you have it ready if someone asks.
- **Inform contacts.** Say who you are, where the data comes from and how they can object, in the first message or within a month under Article 14.
- **Run one suppression list across all countries.** Anyone who objects stays out of every future campaign.
- **Check language and form.** A legally clean message in English can still fail in a market that expects its own language. How much that matters in Germany is covered in [lead generation in Germany](https://knkoutbound.com/blog/b2b-lead-generation-germany/).

## Common wrong statements

- **"B2B is exempt from GDPR."** It is not. Work addresses with a person's name are personal data.
- **"Legitimate interest makes cold email legal everywhere."** It answers the GDPR question only. National email rules are a separate test.
- **"An unsubscribe link solves it."** In consent countries it does not replace the missing consent.
- **"We are a US company, so European law does not apply."** The rules protect recipients in their country, and GDPR reaches companies that target people in the EU.

## How we handle it

We check the legal basis per country before any campaign starts and plan the channel mix around it, which is why our campaigns into DACH lean more on LinkedIn and calls to interested prospects than on email volume. If you want a campaign across several European markets, our page on [lead generation in Europe](https://knkoutbound.com/lead-generation-agency-europe/) explains how we set that up.

## FAQ

### Is cold email legal in Europe?

It depends on the country. The UK, France, Ireland and Sweden generally allow B2B email on an opt-out basis if it relates to the recipient's role. Germany, Austria, Switzerland, the Netherlands, Spain, Italy, Denmark and Poland are listed as requiring consent, even between businesses. GDPR applies on top in every EU country. This is not legal advice.

### Is cold email legal in the UK?

Yes for corporate subscribers: PECR allows B2B email to companies on an opt-out basis. Sole traders and some partnerships count as individuals and get the stricter rule. UK GDPR still applies to the personal data, and you should keep a do-not-email list.

### Does GDPR ban cold email?

No. GDPR does not ban it, but it sets conditions: a legal basis, usually legitimate interest, and informing the contact about the data source. Whether you may send at all is decided by national ePrivacy law, which is a separate test.

### Which rules apply if I send from the US to Europe?

Plan by the recipient's country. A US company writing to a German business has to look at German rules for the email and at GDPR for the data, not at CAN-SPAM alone.

### Is there a way to reach prospects in consent countries?

Yes. LinkedIn, phone contact within the local rules, events, content and paid channels all work in consent markets. Existing customers can often be contacted under the soft opt-in. Most teams combine several of these rather than relying on email.

## About KNK Outbound

KNK Outbound builds and runs outbound systems for B2B companies in Europe and the US: cold email, LinkedIn, content and ads, fully done for the client, including reply handling. From EUR 3,300 a month, all-inclusive (tools, data, domains, mailboxes), three-month build phase, then monthly. Pricing: https://knkoutbound.com/pricing/ · Book a call: https://knkoutbound.com/book-a-call/ · Agent access (MCP): https://knkoutbound.com/mcp