Is cold email GDPR-compliant in Europe? (B2B rules for 2026)

"Isn't cold email illegal in Europe?" is the objection that scares teams off outbound. It's a myth, but the nuance matters, and getting it wrong is a real risk. Here's the accurate version.

Note: this is general information, not legal advice. For your specific situation, confirm with a qualified data-protection adviser.

The legal basis: legitimate interest, not consent

GDPR requires a lawful basis to process personal data. For B2B marketing, that basis is legitimate interest under Article 6(1)(f), you don't need prior consent. As the EU guidance on email marketing puts it, where a company has a justified interest, marketing emails may be sent to potential customers without consent.

The hard line is B2B vs. B2C:

What "legitimate interest" actually requires

Legitimate interest isn't a free pass, it's a balancing test. To rely on it for cold email you should be able to show:

• Relevance. The recipient's role makes your offer genuinely useful to their business. Spraying an irrelevant list fails the test.
• Professional context. You contact people at their professional address about their work, not their personal life.
• Reasonable expectation. A decision-maker in your target market would not be surprised to hear from a relevant vendor.
• Minimal impact. One relevant, easy-to-decline message is low-impact; high-frequency spam is not.

The ePrivacy layer (and the UK difference)

GDPR sets the data-processing rules; the ePrivacy Directive governs electronic marketing on top of it. In practice, EU member states apply extra protection to individual subscribers, which is why quality targeting and the relevance test matter so much for compliant outreach.

The UK is a common trip-up: under PECR, unsolicited B2B email to corporate bodies (limited companies, LLPs) is generally permitted, but sole traders and partnerships are treated like individuals and need the stricter consumer approach. If you email the UK, segment accordingly before you build the campaign, as our guide to lead generation in the UK sets out.

What GDPR-compliant cold email looks like in practice

Abstract rules become clearer with a concrete pair of campaigns. Picture a warehouse-automation vendor emailing 300 operations directors at mid-sized logistics firms in the Netherlands. Each message names the sender, explains in one line why a logistics operations lead would care, and closes with a one-click opt-out. That campaign passes the legitimate interest balancing test with room to spare: relevant role, professional address, reasonable expectation, minimal impact.

Now picture the same vendor blasting 40,000 scraped addresses, including info@ inboxes, personal Gmail accounts and roles with no connection to warehousing. No sender identity beyond a bare signature, no opt-out link, follow-ups every two days. Same product, same country, but this version fails every limb of the test. The lesson: GDPR compliance in cold email is mostly a targeting and process question, not a legal-paperwork question.

Where your data comes from matters

Legitimate interest covers the sending; it does not launder a bad list. Under GDPR you should be able to say, for any contact, where the record came from and when. Public business registers, company websites, professional profiles and reputable B2B databases all qualify as legitimate sources, and keeping a source log per contact takes minutes to set up. We cover the main options in where European B2B data comes from.

Two habits keep the data side clean. First, refresh lists regularly: a contact who changed jobs eight months ago is no longer a relevant professional contact, and stale records fail the relevance test. Second, run every new list against your suppression list before the first send, so a past opt-out is never re-contacted under a new campaign name.

Common GDPR cold email mistakes (and the fixes)

• Emailing generic inboxes and personal addresses. info@ and gmail.com addresses undercut the professional-context argument. Fix: only email named contacts at their work domain.
• Hiding the opt-out. A grey line in 8px font, or "reply STOP" buried in a signature, invites complaints. Fix: a plain, visible sentence offering an easy way out.
• Slow opt-out processing. Removing someone "within 30 days" is a marketing-list habit, not a cold-email standard. Fix: suppress the contact the same day, across every mailbox and sequence.
• No record of the balancing test. If a regulator or an annoyed prospect asks why you emailed them, "we bought a list" is a weak answer. Fix: a short written legitimate interest assessment (LIA) for each campaign type, one page is enough.
• Treating one EU rulebook as universal. The rules shift the moment you email the US, Canada or Australia. Fix: read up on the rules beyond GDPR before expanding.

How enforcement varies across Europe

GDPR is a regulation, so the core is identical in every member state, but the ePrivacy layer is a directive, and each country transposed it with its own accent. Germany and Austria sit at the strict end: German unfair-competition law gives competitors and associations standing to act against unwanted advertising, so DACH campaigns reward tighter targeting and conservative volume. France and the Netherlands read the B2B exception more generously. The Baltics and most of Central Europe follow the mainstream B2B legitimate interest line. Telephone outreach splits even further, because consent rules and do-not-call registers mean the legality of B2B cold calling changes country by country.

For sellers targeting the German-speaking market, the practical answer is not to avoid outbound, it is to run it with precise role targeting, restrained cadence and clean records. As a Vilnius-based agency running campaigns across the EU in German, English, Lithuanian and Russian, we build every campaign to the strictest interpretation in the target country, which also happens to produce better reply rates.

Your GDPR cold-email checklist

• ✅ Rely on legitimate interest (Art 6(1)(f)) for B2B; never cold-email consumers without consent.
• ✅ Email professional addresses about a genuinely relevant offer.
• ✅ Identify yourself, who you are and why you're reaching out, in every message.
• ✅ Include a clear opt-out, and honor it immediately and permanently.
• ✅ Source data from publicly available business sources and keep a record of where it came from.
• ✅ Honour data-subject requests (access, erasure) promptly.
• ✅ Maintain a suppression list so opted-out contacts are never re-emailed.

Done right, compliant outreach isn't a constraint, it's a competitive edge. Buyers trust senders who are transparent, and clean practices protect your deliverability at the same time.