Nerdy Joeby Koldify

Cold Email Europe: Is B2B Cold Email Legal in the EU, Country by Country

Some links on this page are affiliate links. If you sign up through them, we may earn a commission at no extra cost to you. How we make money

Cold email into Europe is not one market with one rule. The GDPR sets a shared baseline for personal data, but each country's ePrivacy law decides whether you can email a business contact without prior consent, and the answers range from "yes, with an opt-out" in France and Sweden to "generally no" in Germany and Austria. Koldify runs done-for-you cold email campaigns for companies that sell into Europe, and this page is the country-level map we use when planning them.

Two layers of law apply to every cold email you send into the EU, and you need to pass both. This is not legal advice, and national rules change, so confirm with counsel in the specific country before a large campaign.

  1. The GDPR governs the personal data itself: a named work address like anna.berg@firma.se is personal data. You need a legal basis to process it, and you owe the recipient transparency.
  2. National ePrivacy law, based on the ePrivacy Directive (2002/58/EC), governs the act of sending marketing by email. This is where countries differ.

GDPR legitimate interest and the balancing test

GDPR Article 6(1)(f) allows processing that is necessary for a legitimate interest, unless the person's rights override it, and Recital 47 says direct marketing may be regarded as carried out for a legitimate interest. The European Data Protection Board adopted Guidelines 1/2024 on legitimate interest on October 9, 2024, and they make clear that direct marketing does not automatically qualify (Morgan Lewis).

The test has three steps:

Step Question What it looks like for cold email
1. Interest Is there a real, lawful interest? Offering a relevant B2B product to companies that plausibly need it
2. Necessity Is this processing needed for it? Only name, role, company and work email, no personal phone or home data
3. Balancing Do the person's rights override it? Role relevance, low frequency, easy objection, no sensitive targeting

Write this assessment down before you launch. Two other GDPR rules matter just as much:

  • Article 14 transparency. When the data did not come from the person, you must give them specific information (who you are, purposes, legal basis, the source of the data and their rights) at the latest at the first communication if you use the data to contact them.
  • Article 21 right to object. A person can object to direct marketing at any time, and once they do, you must stop processing their data for that purpose. There is no balancing on this one.

National ePrivacy rules: why countries differ

Article 13 of the ePrivacy Directive requires prior consent for marketing email to natural persons, but it leaves member states to protect "subscribers other than natural persons", meaning companies, as they see fit. Some countries extended consent to businesses; others allow B2B email on an opt-out basis. That is why "is cold email legal in the EU" has no single answer.

Country table: B2B cold email, opt-in vs opt-out

We only list countries where we could check a primary source or a regulator. Treat "opt-out" as "allowed without prior consent if conditions are met", not as "anything goes".

Country B2B email without prior consent? Conditions or notes Source
France Generally allowed (opt-out) Message must relate to the recipient's profession; identify the sender; free, simple objection in every email. Generic addresses (info@, contact@) fall outside these rules CNIL
Sweden Allowed to legal persons (opt-out) Prior consent required for natural persons; every email to businesses must include a valid address to stop marketing Marketing Act (2008:486), s19 and s20
Germany Generally no (opt-in) UWG s7(2) no. 2: email advertising without prior express consent is an unreasonable nuisance; narrow existing-customer exception in s7(3) UWG
Austria Generally no (opt-in) TKG 2021 s174(3) requires the recipient's prior consent for direct marketing email; WKO notes published contact details do not count as consent TKG 2021; WKO
Denmark No (opt-in) The Consumer Ombudsman says the spam ban applies to all recipients, including companies and individual employees Marketing Practices Act s10; Forbrugerombudsmanden
Spain Generally no (opt-in) LSSI art. 21 bans unsolicited commercial email to natural and legal persons, with a prior-contract exception for similar products LSSI; Fieldfisher
Poland Generally no (opt-in) Electronic Communications Law art. 398 protects all subscribers, including legal entities Prawo.pl

Countries we have not put in the table (for example the Netherlands, Belgium, Italy and Ireland) still have rules; we just did not find a primary source clear enough to summarize in one line. Check them individually.

What "opt-in" countries mean in practice

In Germany, Austria, Denmark, Spain and Poland, a classic cold email sequence to a named prospect is high risk even if your GDPR assessment is solid, because the ePrivacy layer requires consent regardless. German competitors and associations can also bring claims under the UWG. For these markets, we usually recommend other routes: LinkedIn, events, partner introductions, or content that earns an opt-in, rather than forcing cold email.

Enforcement and fines

GDPR Article 83 allows fines of up to 20 million euros or 4% of worldwide annual turnover for the most serious infringements, including breaches of data subject rights. National ePrivacy laws add their own fines. Practical advice: the most common trigger is an annoyed recipient complaining to their national regulator, so honoring objections fast is your best protection.

Want a second opinion? If you are planning outbound into Europe and want help deciding which countries to email and which to approach another way, book a 30-minute call with David at Koldify.

What's different about selling into Europe

Languages

The EU has 24 official languages. English works well with many tech and international buyers, especially in the Nordics and the Netherlands, but practical advice is to write in the buyer's language whenever your offer is aimed at local mid-market firms and your team can reply in that language. A French buyer who replies in French expects French back.

Regional differences

  • DACH (Germany, Austria, Switzerland). Germany and Austria are opt-in for B2B email, so plan for other channels. Switzerland is outside the EU and has its own law; treat it separately. Practical advice: formal German ("Sie"), precise claims, and a complete legal footer (company name, address, register details) read as credible.
  • Nordics. Sweden permits B2B email to legal persons with an opt-out, but Denmark does not without consent, so a single "Nordics" campaign is a mistake. Practical advice: short, direct copy and first names work well.
  • Benelux. Dutch, French and German are all in play in this region. We did not find a single clear primary source summary for Dutch or Belgian B2B email rules, so get local advice before campaigns there.
  • France. B2B email is allowed on an opt-out basis if the message relates to the person's job, per the CNIL. Write in French for French mid-market buyers, and remember the generic address rule: info@ and contact@ inboxes are treated differently from named employees.

Time zones and holidays

Most of the EU runs on Central European Time (UTC+1), Portugal and Ireland on Western European Time (UTC+0), and Finland, the Baltic states, Greece, Romania and Bulgaria on Eastern European Time (UTC+2). EU summer time starts on the last Sunday of March and ends on the last Sunday of October (Directive 2000/84/EC). Practical advice: schedule by recipient country, and check national holiday calendars, which differ widely (for example, regional holidays in Germany vary by state).

Data coverage

Apollo advertises 240M+ contacts globally but does not publish an EU country breakdown. Under GDPR you also need to know where a vendor's data came from, because Article 14 requires you to tell recipients the source. We test a sample for your segment, check verified email rates and source documentation, and adjust before launch.

How we run cold email into Europe

Koldify's core process is on our cold email services page. For Europe we add a country filter before anything else.

  1. Country selection first. We map your target list against the table above and agree with you which countries get email and which do not.
  2. Our infrastructure, separate domains. We own and operate our sending infrastructure and never use your main domain. See cold email infrastructure for the setup.
  3. About three weeks of warmup. Campaigns typically launch around week four.
  4. Lists, offer and copy approved by you. Lists are built with you and approved, and we document a legitimate interest assessment for the processing.
  5. Article 14 footer and local language. Every email identifies the sender, says where the contact came from, links a privacy notice and offers a one-click objection. Copy is in the buyer's language when your team can reply in it.
  6. Replies routed to you. Your team handles conversations, booking and closing. Objections are suppressed across every campaign immediately.
  7. Month-to-month. No long-term contract.

No promised results: outcomes depend on your offer, your countries and your data.

Sample cold email for France (opt-out market)

Subject: Contrôle qualité chez [Entreprise]

Bonjour [Prénom],

Je vous contacte car vous dirigez la qualité chez [Entreprise] à [Ville].

Nous aidons les industriels de [secteur] à réduire les non-conformités de [X] % en automatisant l'inspection visuelle. [Client similaire] a obtenu [résultat] en [délai].

Seriez-vous ouvert à un échange de 15 minutes dans les prochaines semaines ?

Bien cordialement,
[Votre nom]
[Fonction], [Votre entreprise]

--
[Raison sociale], [Adresse, Ville, Pays]
Pourquoi ce message : vos coordonnées professionnelles proviennent de [source]. Nous les utilisons sur la base de notre intérêt légitime pour vous présenter une offre liée à votre fonction. Politique de confidentialité : [lien]
Pour ne plus recevoir nos messages : [lien de désinscription] ou répondez "STOP".

The footer covers the CNIL's requirements (sender identity and a simple, free objection) and the GDPR Article 14 duty to state the data source at first contact.

Proof

These Koldify figures are from koldify.io and are not specific to Europe: 10M+ cold emails sent, 50K+ leads generated, $10M+ in pipeline and $2M+ in revenue generated for clients. Client results include Vidsec (160+ ready-to-buy leads in 2 months and $12,000+ closed), Black Stone Funding Group (120+ leads in 60 days) and Skrapper (140+ interested leads). Koldify's own outbound produced about 500 leads from about 250,000 sends in 3 weeks.

David Tile is a partner at Koldify. Nerdy Joe is a certified Apollo.io Managed Services Partner and a PlusVibe Certified Silver Partner.

DIY instead?

You can run European outbound yourself if you are disciplined about country rules. Some tool links here are affiliate links (disclosure).

  • Data: Apollo for contacts, filtered by country. Keep source records for Article 14.
  • Sending: PlusVibe, Instantly or Smartlead for warmup, rotation and recipient time zones, with one sequence per country and language.
  • Copy checks: Run each translated version through our spam word checker.

Build a global suppression list on day one so an objection in one campaign blocks the address everywhere.

Ready to reach European buyers?

If you sell into Europe and want campaigns that start with the right countries, run on separate infrastructure and carry a GDPR-ready footer, book a call with David at Koldify.

Selling into the UK too? Read our guide to cold email in the UK, or for more context on agencies, see what a cold email agency does. Or simply talk through your plan with David.

Other markets we cover

How to set up a cold email campaign: the tools you'll need

Some tool links here are affiliate links (disclosure). Prices are as of October 2026.

  1. Get your data (who you'll email). Build your list in Apollo by title, industry, company size and location, then export contacts with verified emails. Nerdy Joe is a certified Apollo Managed Services Partner.
  2. Buy 2 to 3 sending domains. Never send cold email from your main domain. Use lookalikes (for example, getyourbrand.com). The simplest route is buying them inside your sending tool: Instantly sells done-for-you domains (about $15 a year), Smartlead sells them through SmartSenders, and PlusVibe offers a done-for-you setup. Before you buy, check whether domains bought in a tool can be moved out later; some Instantly users report they can't.
  3. Create 2 to 3 inboxes per domain. Google Workspace or Microsoft 365 inboxes, not one big inbox. Instantly sells done-for-you Google inboxes (about $5 a month, or $10 pre-warmed), Smartlead sells pre-warmed Google and Outlook inboxes (about $9 a month), and PlusVibe can set them up for you. Done-for-you setups configure SPF, DKIM and DMARC for you.
  4. Warm up for about 3 weeks. Warmup is built into Instantly, Smartlead and PlusVibe. Keep it running after launch.
  5. Write and check your sequence. Three to five short emails. Run each one through our free Spam Word Checker.
  6. Launch slowly. Start at about 20 to 30 emails per inbox per day in Instantly, Smartlead or PlusVibe, and watch bounces and replies. Use our Cold Email Cost Calculator to size domains, inboxes and spend.

Rather not run it yourself? Koldify, the done-for-you cold email agency where David Tile is a partner, builds and runs all of this on infrastructure it owns. Book a 30-minute call with David.

Sources

  • Regulation (EU) 2016/679 (GDPR), Articles 6, 14, 21, 83 and Recital 47: https://eur-lex.europa.eu/eli/reg/2016/679/oj
  • Directive 2002/58/EC (ePrivacy Directive), Article 13: https://eur-lex.europa.eu/eli/dir/2002/58/oj
  • Morgan Lewis, EDPB Guidelines 1/2024 on legitimate interest (October 2024): https://www.morganlewis.com/blogs/sourcingatmorganlewis/2024/10/gdpr-when-can-data-controllers-rely-on-legitimate-interests-for-data-processing-new-guidelines-from-the-edpb
  • CNIL, La prospection commerciale par courrier électronique: https://www.cnil.fr/fr/la-prospection-commerciale-par-courrier-electronique-sms-mms-et-automate-dappel
  • Sweden, Marknadsföringslag (2008:486), Riksdagen: https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/marknadsforingslag-2008486_sfs-2008-486/
  • Germany, Gesetz gegen den unlauteren Wettbewerb (UWG), s7: https://www.gesetze-im-internet.de/uwg_2004/__7.html
  • Austria, TKG 2021 s174 (RIS): https://www.ris.bka.gv.at/eli/bgbl/i/2021/190/P174/NOR40238632
  • WKO, Werbung per Telefon, Fax, E-Mail, SMS: was ist erlaubt: https://www.wko.at/information-consulting/werbung-marktkommunikation/werbung-per-telefon-fax-e-mail-sms-was-ist-erlaubt
  • Forbrugerombudsmanden, Vejledning om spamforbuddet (2021): https://forbrugerombudsmanden.dk/media/bjajzdv1/vejledning-om-spamforbuddet-2021-a.pdf
  • Fieldfisher, Bases de datos empresariales bajo la lupa (November 10, 2025): https://www.fieldfisher.com/es-es/locations/spain/insights/bases-datos-empresariales
  • Prawo.pl, Zgody marketingowe i kontakty handlowe: co mówi Prawo komunikacji elektronicznej (January 21, 2025): https://www.prawo.pl/biznes/zgody-marketingowe-i-kontakty-handlowe-co-mowi-prawo-komunikacji-elektronicznej,530981.html
  • Directive 2000/84/EC on summer-time arrangements: https://eur-lex.europa.eu/eli/dir/2000/84/oj
  • Apollo.io homepage (database size): https://www.apollo.io/
  • Koldify (proof figures): https://koldify.io

Frequently asked questions

Is cold email legal in the EU?

It depends on the country. The GDPR allows legitimate interest as a legal basis for direct marketing, but national ePrivacy laws decide whether B2B emails need prior consent. France and Sweden allow B2B email on an opt-out basis with conditions, while Germany, Austria, Denmark, Spain and Poland generally require prior consent. This is not legal advice.

Can I use legitimate interest for B2B cold email under GDPR?

Legitimate interest can cover the processing of contact data, but only after a three-step test: a legitimate interest, necessity and a balancing of the recipient's rights. It does not override a national rule that requires consent for marketing email, and the recipient can always object to direct marketing.

Is cold email legal in Germany?

Generally no without consent. Section 7 of the German Act Against Unfair Competition (UWG) treats advertising by email without the recipient's prior express consent as an unreasonable nuisance, and it applies to business recipients too. The narrow exception covers existing customers who bought from you.

Do I need to tell prospects where I got their data under GDPR?

Yes. When you did not collect data directly from the person, GDPR Article 14 requires you to give them specific information, including the source, at the latest when you first contact them if you use the data to communicate with them.

What are the fines for breaking GDPR with cold email?

GDPR Article 83 allows fines of up to 20 million euros or 4% of worldwide annual turnover, whichever is higher, for the most serious infringements. National ePrivacy and unfair competition laws carry their own penalties and, in Germany, competitor claims.

Is the UK part of these EU rules?

No. Since Brexit the UK has its own UK GDPR and PECR, enforced by the ICO. PECR allows B2B email to corporate subscribers without prior consent, but sole traders and some partnerships are treated like individuals.