Is cold email legal in Poland? Article 398 PKE, explained
The short answer
Plan on consent. Article 398 of Poland's Electronic Communications Law (Prawo komunikacji elektronicznej, PKE) bans using telecommunications terminal equipment or automated calling systems to send commercial information, direct marketing included, to a subscriber or end user who has not agreed in advance. The article draws no line between consumers and companies, and the telecoms regulator UKE can fine up to 3% of annual revenue or PLN 1,000,000, whichever is higher. GDPR legitimate interest answers a different question: whether you may use the contact's data.
Teams that sell into Poland usually ask the question after reading that Polish inboxes are quiet and Polish registers are open. Both are true. The sending rule is where Poland differs most from the Netherlands or the UK, and it is worth reading at the source before you plan a sequence.
Note: this is general information for orientation, not legal advice and not a compliance opinion on your situation. Every statement below carries its source and the date we read it. Before you send anything into Poland, get a written view from a qualified Polish lawyer.
On this page
What does Article 398 PKE say?
The PKE is the Act of 12 July 2024 (Dz.U. 2024 item 1221). It was promulgated on 9 August 2024 and has applied since 10 November 2024. The introductory act (Dz.U. 2024 item 1222, Article 68) repeals the Telecommunications Law of 2004 apart from a few provisions, so the consent rule that older guides cite from that law now sits in Article 398 of the new one.
The table paraphrases the Polish text of Article 398.
| Element | What the text says |
|---|---|
| Banned means | Using automated calling systems, or telecommunications terminal equipment, in particular through interpersonal communication services (paragraph 1). |
| Banned purpose | Sending commercial information, direct marketing included, as the 2002 act on electronic services defines it (paragraph 1). |
| Protected person | The subscriber or end user (paragraph 1). |
| Exception | The recipient agreed beforehand (paragraph 1). Sharing an identifying electronic address in order to receive commercial information at that address counts as consent (paragraph 2). |
| Cost | The message must not be sent at the recipient's expense (paragraph 3). |
| Civil side | The act counts as unfair competition under the 1993 act on combating unfair competition (paragraph 4). |
Does Article 398 apply to companies?
The article protects a "subscriber or end user" (abonent lub użytkownik końcowy). The PKE defines an end user as an entity (podmiot) that uses a publicly available electronic communications service, or asks for one, to meet its own needs. Nothing in Article 398 limits that to consumers. Legal commentary reads it the same way: prawo.pl, in an article of 21 January 2025, says the protection covers all subscribers, legal entities included, and that cold e-mailing without the recipient's prior consent is excluded.
Three points stay open, and this page does not settle them. Whether a generic company mailbox such as info@ is treated like a personal address is one. How far "interpersonal communication services" reaches into platform messaging is another. What counts as valid consent from a business contact is the third. Commentary is not uniform on the edge cases, so take written advice before you rely on any reading.
Why GDPR legitimate interest does not settle it
Two separate legal tests apply to every cold email, and a campaign has to pass both. The GDPR decides whether you may use the contact's personal data, and legitimate interest under Article 6(1)(f) is the usual basis for publicly listed business contacts. The national rule that implements the ePrivacy Directive decides whether you may send at all.
At EU level, Article 13 of Directive 2002/58/EC requires prior consent for email marketing to natural persons and leaves the protection of other subscribers, including companies, to each member state. Poland used that room in Article 398, which names no business exemption. Our GDPR cold email guide for Europe compares the national positions side by side.
What enforcement looks like
Administrative fines. Under Article 446(5) PKE, where the consent required by Article 398 is missing, the President of UKE imposes a fine by decision of up to 3% of the offender's revenue in the previous calendar year or up to PLN 1,000,000, whichever is higher.
Civil route. Article 398(4) classes the act as unfair competition, so the remedies of the 1993 act are available on top of the regulator's powers.
A precedent on proof. On 28 June 2019 UKE fined Koksztys S.A. PLN 80,000 for 30,636 marketing calls made without the legally required consents. The decision applied Article 172(1) of the Telecommunications Act, which the 2024 law replaced, and it put the burden on the caller to prove that subscribers had consented. It was a telemarketing case. We cite it for the regulator's approach to proof and do not claim that a fine for B2B email has been issued.
Routes that fit the rule
Consent first. Paragraph 2 makes a shared address count as consent when it is given to receive commercial information at that address. A form that states the commercial purpose, with the date and wording stored, gives you a record. The 2019 decision shows why records matter.
Contact the recipient started. An enquiry, a reply to your content or an introduction the recipient asked for changes the picture, because the first message was theirs.
Channels outside the wording. Article 398 is written around automated calling systems and telecommunications terminal equipment. On its wording, postal mail and a meeting in person are outside it. Check any channel you add against the text.
Relying on legitimate interest for B2B email. Some operators do. Treat it as a legal risk decision taken with Polish counsel and written down, because Article 398 names no business exemption and Article 446(5) sets the fine.
What about the phone?
The same article covers automated calling systems and telecommunications terminal equipment, so a marketing call also needs prior consent. Our guide to European telemarketing law sets Poland next to Germany, Austria, the Nordics and the UK, where a live call to a business number follows different rules.
How we approach Poland
Ripe Leads is an outbound agency, not a law firm, and we give no legal advice. Our market guide for Poland covers language, registers and sectors. The legal position for each campaign belongs with Polish counsel before the first send, whoever runs the campaign, and that includes us.
Sources and dates
- Prawo komunikacji elektronicznej, Dz.U. 2024 item 1221, Articles 398 and 446(5): official text on the Sejm ELI interface, read 26 October 2026, status in force.
- Przepisy wprowadzające ustawę Prawo komunikacji elektronicznej, Dz.U. 2024 item 1222, Articles 1 and 68(1): official text, read 26 October 2026.
- UKE, penalty on Koksztys S.A., announced 28 June 2019: UKE press release.
- prawo.pl, marketing consents under the PKE, 21 January 2025: article.
- Directive 2002/58/EC (ePrivacy), Article 13: EUR-Lex.
- Regulation (EU) 2016/679 (GDPR), Article 6(1)(f): EUR-Lex.
Frequently asked
Is cold email legal in Poland?
Does the Polish rule apply to B2B email?
What is the fine for sending marketing email without consent in Poland?
Can I rely on GDPR legitimate interest to email a Polish company?
Is cold calling legal in Poland?
Does Article 398 cover LinkedIn messages?
Selling into Poland?
Book a short strategy call. We will check who you need to reach, in which language and by which channel, and tell you plainly where Polish counsel has to sign off first.
Book a strategy call Or get a free target list first