European telemarketing law: is B2B cold calling legal, country by country?

Sales teams usually ask this question after a lawyer has scared them, and the honest answer is that Europe has no single rule. Calling a company in Vilnius, Vienna and London puts you under three different regimes, and only one of them treats a business like a consumer.

Country table: the rule for a live call to a business number

The table covers the live person-to-person call. Automated calls, fax and email need prior consent across the EU under Article 13(1) of the ePrivacy Directive, so they are left out. Penalty figures come from the statute or the regulator named in the last column.

Sources: Bundesnetzagentur on advertising calls, Section 188 TKG 2021 in the Austrian legal database, UKE decision on telemarketing without consent. For the email side, read the country guides for Germany, Austria, Switzerland and the UK, and the Poland market guide.

What counts as a cold call in European law?

A cold call is an unsolicited telephone call made for direct marketing purposes to someone you have no prior relationship with. Two separate layers of law apply to it, and confusing them is where most compliance arguments go wrong.

The first layer is the ePrivacy Directive, implemented separately in every member state. Article 13(1) requires prior consent across the EU for automated calling machines, fax and electronic mail. Article 13(3) treats live person-to-person calls differently and lets each country choose between an opt-in and an opt-out regime, and Article 13(5) leaves the level of protection for business subscribers to national law. That single design decision is why the answer changes at every border.

The second layer is the GDPR, which governs the personal data sitting behind the call: the name, the role and the direct number. It applies regardless of which regime the phone call itself falls under.

Why are calling rules different from email rules?

Because the ePrivacy Directive harmonised email and automated dialers at consent and left live voice to national choice. The practical consequence surprises people: in several markets it is easier to justify a phone call to a company switchboard than a cold email to the same company. Germany is the clearest example, where email advertising needs express consent while a business call can rest on presumed consent. If you are planning the email side too, the GDPR position on cold email in Europe works differently and needs its own assessment.

Germany: presumed consent, not free rein

Section 7(2)(1) of the German Unfair Competition Act, the UWG, requires express prior consent for marketing calls to consumers and at least presumed consent for calls to other market participants, meaning businesses.

Presumed consent is a real test, not a formality. It requires concrete circumstances suggesting that the specific company has an actual interest in that specific offer, connected to its business. A general belief that any manufacturer might want cheaper logistics does not meet it, and German courts read the standard narrowly. Unlawful calls carry regulatory fines, and in day to day commercial reality the bigger risk is a cease and desist letter from a competitor or an industry association, which arrives faster than any regulator. German telecoms law separately bars suppressing or faking the caller ID on advertising calls.

Most operators working DACH markets treat Germany as a channel where the phone follows a warm signal rather than opening cold.

Austria: the strictest German-speaking market

Austrian telecommunications law prohibits calls for direct marketing without the subscriber's prior consent, and unlike Germany it does not soften that rule for business subscribers. In other words, an unsolicited B2B call in Austria sits on weak legal ground unless you can point to consent, an existing relationship or a request for contact. Breaches are handled as administrative offences.

The practical answer for Austria is to earn the call. A referral, an inbound enquiry, a completed form or a documented conversation changes the position entirely, which is why campaigns into Austria usually open in writing or through LinkedIn and move to the phone once there is something to point to.

The Netherlands: opt-in for consumers, opt-out for companies

Since July 2021 the Netherlands has required consent or an existing customer relationship for consumer telemarketing, and the old consumer do-not-call register was retired in favour of that rule. Business subscribers stayed on the opt-out side of the line, so calling a Dutch company is permitted.

What is not optional is the handling. You must identify yourself and your client, you must offer a clear way to object, and you must keep the objection permanently in your own suppression list. Dutch buyers are famously direct, so an unwanted call produces an objection immediately, which is useful data if you actually record it.

France: consumer rules tightening, business calls outside them

France protects consumers hard. Bloctel is the national opposition list that any seller must screen consumer numbers against, calling windows for consumer prospecting are restricted to weekday hours, the number of attempts per prospect is capped, and French law is moving consumer telephone prospecting onto a consent basis during 2026. Confirm the current position before you build a French consumer programme, because this area has changed repeatedly.

These rules are written for consumers, so a call to a company's published business line falls outside them. The grey area is the personal mobile of a manager collected from a social profile, which looks a lot more like an individual subscriber than a corporate one. Given the direction of French policy, aggressive dialing of personal numbers in France is a poor bet even where a lawyer would call it arguable.

The Nordics: registers protect people, not companies

The Nordic pattern is consistent. Sweden's NIX register covers private numbers, and consumer telemarketing agreements need written confirmation to be binding, while business numbers may be called subject to any objection. Denmark runs one of Europe's tightest consumer regimes with a short list of exempted sectors, and its ban on unsolicited electronic approaches reaches businesses too, though live calls to a company are treated differently from email. Norway, inside the EEA and therefore inside the GDPR, operates a reservation register covering individuals. Finland applies consent to electronic messaging aimed at individuals and an opt-out logic to companies.

The common thread across all four is that the registers exist to protect people, companies remain reachable, and a stated objection is binding everywhere with no further argument.

The Baltics: small markets where reputation enforces itself

Lithuania, Latvia and Estonia all implement the ePrivacy structure: consent for automated dialers, SMS and email marketing, and an opt-out position for live calls to business numbers. All three data protection authorities are active on the lawful basis question, so the documentation matters as much as the call itself.

There is also a commercial reality that no statute captures. These markets are small enough that a few hundred companies can be the entire addressable list, and word travels between them. Burning your reputation with a badly targeted dialing campaign costs more than any fine. We work out of Vilnius, and this is the argument we make to clients far more often than the legal one.

The UK: TPS, CTPS and mandatory screening

The UK is the market where business numbers genuinely are on a register. Under PECR, live marketing calls must not be made to any number registered with the Telephone Preference Service or the Corporate Telephone Preference Service unless that subscriber has told you they consent. Screening is your obligation before every campaign, not a courtesy.

Companies, limited liability partnerships and public bodies register on the corporate list. Sole traders and ordinary partnerships count as individual subscribers, so they appear on the consumer list, which means you screen against both. Automated and recorded calls need prior consent. UK GDPR governs the underlying data, the ICO has a long record of enforcement in this area, and the Data (Use and Access) Act 2025 raised the ceiling on PECR penalties substantially above the old half-million pound cap.

What GDPR requires whatever the phone rules say

A direct line tied to a named person is personal data, so four obligations run in parallel with the telemarketing rules.

• A lawful basis. For B2B outreach this is normally legitimate interest under Article 6(1)(f), backed by a written balancing test you can produce on request.
• Transparency. Article 14 applies when the number came from a third party or a public register, and the notice is due at the first communication at the latest.
• The right to object. Article 21(2) gives an unconditional right to object to direct marketing. There is no balancing exercise and no expiry date on it.
• Provenance and retention. Record where every number came from and how long you keep it. Recording the call itself raises a separate consent question in most countries.

A practical checklist before you dial a new country

• Screen against the national register where one exists, and against both UK lists for Britain.
• Call published business numbers rather than personal mobiles scraped off social profiles.
• Display a real caller ID that reaches a working line.
• Say who you are, which company you represent and why you are calling within the first fifteen seconds.
• Keep the source of every number, so you can answer an Article 14 question a year later.
• Respect local calling hours, and call in the buyer's language.
• Have local counsel check each market before you scale into it, country by country rather than once for Europe.

Where calling still earns its place

None of this makes the phone a bad channel. It makes it a channel that rewards precision, and the countries with the strictest rules are usually the ones where a well-researched call lands hardest because so few competitors bother. A call after an email touch performs differently from a cold dial, which is why a call script that sounds like a person matters more than call volume.

We run campaigns in Lithuanian, Latvian, Estonian, Polish, Czech, Slovak, German, English and Russian, on publicly available business data, with legitimate interest documented and opt-outs honoured across every channel. Pricing is flat and published on the pricing section, and we never promise a fixed number of meetings. If you want the compliance work handled alongside the outreach, that is the service.

If you want the calling done by a provider, we compared appointment setting agencies in Europe on the markets they call, what they count as a meeting and what one costs.

One last time, because it matters: this article is general information about how the rules are structured, not legal advice, and it cannot account for your offer, your data sources or the way a specific regulator reads its own statute. Take advice on the markets you plan to call.

We go deeper on this in Best cold calling agencies in Europe.

For agencies that work the Nordic markets, see lead generation in the Nordics.

Poland requires prior consent for email as well as calls; is cold email legal in Poland? Article 398 PKE, explained sets out the text, the fines and the sources.