Whether a B2B cold email is legal in Europe is mostly not a GDPR question. It’s decided by each country’s own rules on electronic marketing, and those range from “fine to a company address if you identify yourself and offer an opt-out” in the UK to “prior express consent, also for businesses” in Germany and Austria. The Netherlands is stricter than its reputation, and Belgium sits in between. Below is the table, then the actual articles behind each line, then what I do with it.
I sell outbound into the Netherlands, Belgium, Germany, the UK, Austria and Switzerland, and the vendor blogs I read before writing this disagreed with each other on almost every one of them. So every line here links the law itself or the regulator’s own guidance. Where I couldn’t confirm something in a primary source, I say so.
The table
| Country and law | Cold email to a company address without consent? | Sole traders | Who enforces |
|---|---|---|---|
| Netherlands Telecommunicatiewet art. 11.7 | No, unless the company designated and published that address for receiving commercial messages | Same as companies when acting in their business | ACM (email), AP (GDPR) |
| Belgium Code of Economic Law art. XII.13, Royal Decree of 4 April 2003 | Only to impersonal addresses of a legal person (info@, sales@); named addresses need consent (not confirmed in the decree itself) | Consent | FPS Economy, GBA/APD (GDPR) |
| Germany UWG § 7 | No. Prior express consent, also for businesses | Consent | Courts, on claims by competitors, associations and chambers (§ 8 UWG) |
| United Kingdom PECR reg. 22 and 23 | Yes, to corporate subscribers (Ltd, LLP and similar) | Consent or soft opt-in | ICO |
| Austria TKG 2021 § 174 | No. Prior consent for email for direct advertising | Consent | Not confirmed |
| Switzerland UWG art. 3(1)(o) | Mass advertising needs prior consent; the article doesn’t define how many emails make “mass” | Same rule | Not confirmed |
In all six, every commercial email has to say who it’s really from and give a working way to stop further messages.
Every country also has an existing customer exception (often called the soft opt-in): you may email your own customers about your own similar products if you offered an opt-out when you collected the address and in every message. That’s for customers, not for cold prospects, so it’s not in the table. France and Spain aren’t in the table because I haven’t checked their texts myself yet.
GDPR is not the main question
Two different laws apply to a cold email, and they answer different questions.
The ePrivacy rules decide whether you may send it. Article 13 of the ePrivacy Directive (2002/58/EC) says email for direct marketing “may be allowed only in respect of subscribers or users who have given their prior consent” (13(1)), with an exception for your own customers (13(2)), and a ban on hiding your identity or leaving out a valid address to opt out (13(4)). Then the important bit, 13(5): paragraphs 1 and 3 “shall apply to subscribers who are natural persons”. For companies, member states only have to make sure their legitimate interests are “sufficiently protected”. That’s why every country ended up with a different B2B rule: the directive left it to them.
GDPR decides how you may handle the personal data. A named work address like [email protected] is personal data, so GDPR applies whatever the national email rule says. For cold outreach the basis is usually legitimate interest, Article 6(1)(f) GDPR, and Recital 47 ends with: “The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.” In case C-621/22 (KNLTB, 4 October 2024) the EU Court of Justice confirmed that a commercial interest can be a legitimate interest. The law doesn’t have to spell the interest out, but it must be lawful, the processing must be strictly necessary, and the person’s interests must not override it. The Dutch data protection authority had argued the opposite in that case and lost on that point.
Three GDPR rules matter for every cold email, wherever you send it:
- The right to object is absolute. Article 21(2) and (3): when someone objects to direct marketing, “the personal data shall no longer be processed for such purposes”. No balancing, no arguing.
- You have to tell them where you got their data. Article 14 applies when you didn’t collect the data from the person, and 14(3)(b) says you must inform them “at the latest at the time of the first communication”. That includes the source of the data.
- You have to be able to show your reasoning. Article 5(2), accountability: the controller must “be able to demonstrate compliance”. In practice that means a written legitimate interest assessment for your outbound, kept on file.
The trap: legitimate interest only answers the GDPR question. It doesn’t make an email legal in a country whose ePrivacy rule requires consent. “We rely on legitimate interest” is a complete answer in the UK for a limited company, and no answer at all in Germany.
Netherlands
The rule is article 11.7 of the Telecommunicatiewet, and it’s stricter than the “B2B is opt-out in the Netherlands” line you’ll find on a lot of vendor blogs.
The regulator reads this strictly. The ACM’s guidance on preventing spam in your advertising says to send only to people who gave prior consent, to be recognisable as the sender, to include an opt-out in every message, and that you must be able to prove consent up to five years after sending. In a 2012 fine against Companeo, OPTA (now part of the ACM) held that since 1 October 2009 the ban covers legal persons as well as individuals, that addresses like [email protected] fall under it, and that the “published for commercial messages” exception didn’t apply: it checked 50 addresses from the prospect files on the companies’ own websites and none was published with a statement that it was meant for receiving unsolicited commercial messages (decision, PDF in Dutch). That decision quotes the exception as 11.7(2)(a); the article has been renumbered since, and the same wording now sits in 11.7(3)(a).
Sole traders and partnerships (eenmanszaak, vof) are treated like companies when they act in their business, because the exception names “a natural person acting in the exercise of their profession or business”. The data protection side is the AP’s (Autoriteit Persoonsgegevens), and the ACM handles the email rule.
I wrote a separate Dutch page that goes deeper on the Dutch rules: koude acquisitie per e-mail: wat mag wel en niet.
Germany
§ 7 UWG, the unfair competition act, is the rule, not GDPR. § 7(2) no. 2 says an unreasonable nuisance is always assumed for advertising “unter Verwendung … elektronischer Post, ohne dass eine vorherige ausdrückliche Einwilligung des Adressaten vorliegt”: advertising by electronic mail without the addressee’s prior express consent. The text draws no line between consumers and businesses for email. It does for phone calls: § 7(2) no. 1 accepts “presumed consent” from a business for a call, which is why German B2B cold calling has more room than German B2B cold email.
The only exception, § 7(3), is for your own customers: you got their address in connection with a sale, you advertise your own similar products, they haven’t objected, and you tell them clearly at collection and in every message that they can object at any time.
Enforcement mostly doesn’t come from a regulator. § 8 UWG gives competitors, registered trade associations, consumer organisations and chambers a claim to make you stop, which in practice tends to arrive as a formal warning letter from a lawyer (an Abmahnung).
United Kingdom
The UK is the most permissive of the six for company addresses. PECR regulation 22 applies to “individual subscribers” only. The ICO’s business-to-business marketing guidance says: “The PECR rule on direct marketing by electronic mail does not apply to corporate subscribers”, so you don’t need their consent, but you must not disguise or conceal your identity and you must give a valid address to opt out or unsubscribe (that’s regulation 23).
Two catches. Sole traders and some partnerships are individual subscribers, so they need consent or the soft opt-in, and the ICO says that if you can’t tell, treat the address as an individual’s. And a named employee at a company is still a person under UK GDPR: if they object to direct marketing, “this right is absolute”. The ICO notes its guidance is under review after the Data (Use and Access) Act 2025.
Belgium, Austria, Switzerland
Belgium. Article XII.13 §1 of the Code of Economic Law prohibits advertising by email without the recipient’s prior, free, specific and informed consent. The Royal Decree of 4 April 2003 sets the exceptions: existing customers for similar products, and, according to the Belgian data protection authority’s recommendation 01/2025 on direct marketing (consultation version), legal persons reached through impersonal electronic addresses. The same recommendation warns that a functional address such as info@ can still be personal data when one person uses it. I read the decree through that recommendation, not in the official gazette, so treat the details as unconfirmed.
Austria. § 174(3) TKG 2021 makes sending electronic mail for direct advertising without the recipient’s prior consent unlawful, and the text has no business carve-out. § 174(4) is the existing customer exception, and § 174(5) forbids hiding the sender’s identity or leaving out an authentic address to stop the messages. In practice, treat Austria like Germany.
Switzerland. Art. 3(1)(o) UWG makes it unfair to send “Massenwerbung”, mass advertising, by telecommunication without prior consent, a correct sender, and a free and easy way to refuse, with an existing customer exception. The article doesn’t define how many messages make “mass”, so whether a handful of individually written B2B emails fall under it is something I haven’t been able to confirm from an official source.
Not legal advice
Everything on this page is general information about the law as I read it in the linked sources on 20 October 2026. It’s not legal advice and it doesn’t replace a lawyer who knows your business and your target country. Laws change, regulators change their reading, and courts decide individual cases. Where a point says it isn’t confirmed, I couldn’t find it in a primary source.
Selling into DACH or the Netherlands and unsure what you can send? I’ll record a free 10-minute video audit of your outbound setup, with what I’d change first. Get your free video audit.
Founder of Sell Successfully. 14 years in sales, 8 of them in B2B SaaS, €4M+ in revenue generated as operator and advisor. Now I build sales systems for Dutch and European SaaS founders who'd rather be shipping product. More about me · LinkedIn