"Is cold email legal in Europe?" has no single answer, because Europe does not have one rule. The EU sets a framework, and each country decides how far it applies to emails sent to businesses. The result is a patchwork in which the same email can be lawful in Stockholm and a violation in Copenhagen.
This article walks through the framework and then the rules in the countries B2B teams ask us about most, with a link to the statute or regulator for each one. It is general information, not legal advice: laws change and the details depend on your situation, so confirm with a lawyer in the country you target before you send.
Two layers of law apply at the same time
Every cold email to a European business has to pass two separate tests.
Layer 1: the marketing-communications rule. The ePrivacy Directive (2002/58/EC), Article 13, requires prior consent for unsolicited email marketing to natural persons (individuals). For "subscribers who are not natural persons" (companies), Article 13(5) leaves it to each member state to make sure their legitimate interests are "sufficiently protected". That is why the national rules differ: some countries extended the consent rule to companies, others did not. Article 13 also bans, for everyone, disguising the sender's identity and sending without a valid address for opting out.
Layer 2: data protection. If the email address identifies a person (anna.svensson@company.com does; info@company.com usually does not), the GDPR applies as well. You need a lawful basis, which for B2B outreach is normally legitimate interests (Article 6(1)(f)), backed by a written balancing test. You must tell the person where you got their data (Article 14) and stop immediately when they object to direct marketing (Article 21(3)).
Passing layer 2 does not cure a failure on layer 1, and vice versa. A German email to a named purchasing manager can have a perfectly good GDPR basis and still be unlawful under the German competition act.
The short version
| Country | Cold email to a company without prior consent | Main rule |
|---|---|---|
| Germany | Not allowed (narrow existing-customer exception) | UWG § 7(2) no. 2 |
| Austria | Not allowed (narrow existing-customer exception) | TKG 2021 § 174 |
| Denmark | Not allowed, also to generic inboxes | Markedsføringsloven § 10 |
| Sweden | Allowed to legal persons with a valid opt-out address | Marknadsföringslagen 19-20 §§ |
| France | Allowed to professionals if relevant to their job, with opt-out | CPCE L.34-5 and CNIL guidance |
| United Kingdom | Allowed to corporate subscribers; not to sole traders or some partnerships | PECR regulation 22 |
"Allowed" never means "anything goes". Everywhere on this list you must identify yourself, include a working opt-out and honour it, and meet the GDPR test above.
Germany: prior express consent, also for B2B
Section 7(2) no. 2 of the German Act against Unfair Competition (UWG § 7) treats advertising "using electronic mail" as an unreasonable nuisance in every case unless the addressee has given prior express consent. The provision does not distinguish between consumers and businesses, and the Chambers of Commerce state plainly that it applies to B2B as well as B2C (IHK Bodensee-Oberschwaben).
The only exception, § 7(3), is for existing customers: you obtained the address in connection with a sale, you advertise your own similar goods or services, the customer has not objected, and you told them clearly at collection and in every email that they can object at any time. A first-contact cold email never fits this exception. German courts have generally treated an email asking for consent as advertising in itself, so "may we send you information?" is not a safe workaround.
Phone is different in Germany: B2B calls need only "presumed" consent (§ 7(2) no. 1). That is one reason German outbound teams lean on phone and LinkedIn rather than email.
Austria: consent required regardless of recipient
Austria's Telecommunications Act (TKG 2021 § 174) requires prior consent for direct-marketing email. The Austrian Economic Chamber's guidance states that the rule applies whether the recipient is a consumer or a business (WKO). The existing-customer exception mirrors Germany's, with one addition: you may not email anyone who has registered on the RTR's "ECG list" of people who refuse commercial email.
Denmark: the strictest of the lot
Denmark's Marketing Practices Act, § 10, forbids contacting anyone by electronic mail for direct marketing without their prior consent. The Consumer Ombudsman's guidance is explicit that the ban covers all recipients, including businesses, and that it makes no difference whether you write to a general mailbox such as info@ or to a named director or employee.
It also closes the obvious loophole: an email asking a company for consent is itself marketing, so you cannot send one without consent. The existing-customer exception in § 10(2) is narrow (same legal entity, similar products, opt-out offered at collection and in every message). The Consumer Ombudsman does enforce this; fines for single campaigns are reported regularly (Dansk Erhverv).
Danish register data is still useful for research, phone and letter outreach (see finding B2B leads in EU company registers). It is not a cold email list.
Sweden: consent for people, opt-out for companies
Sweden's Marketing Practices Act (marknadsföringslagen 2008:486) requires prior consent for email marketing to a natural person (19 §). There is no consent requirement for legal persons. What applies to every recipient, companies included, is 20 §: each marketing email must contain a valid address to which the recipient can send a request to stop. The government bill that introduced the rule said so directly: "this also applies to marketing to a legal person" (prop. 2003/04:43).
Two practical consequences. Sole traders (enskild firma) are natural persons, so the consent rule applies to them. And a named employee's address is personal data, so the GDPR test still applies even though the marketing rule does not require consent.
France: allowed if it concerns the recipient's job
France's rule sits in article L.34-5 of the Post and Electronic Communications Code. The data protection authority, the CNIL, explains that for professionals the regime is opt-out: you may email a professional without prior consent if the message relates to their profession, they were informed that their address may be used for prospecting, and they can object simply and free of charge (CNIL). Its example is offering software to a company's IT director. Offering the same IT director a holiday package would not qualify.
Every message must identify the sender, and requests to exercise data rights must be answered within one month.
United Kingdom: depends on the type of company
The UK's Privacy and Electronic Communications Regulations (PECR) distinguish "corporate subscribers" from "individual subscribers". The ICO's B2B guidance says the email marketing rule does not apply to corporate subscribers (limited companies, LLPs, public bodies), so you can email them without consent. You must not conceal your identity and you must give a valid address for opting out, and the ICO recommends honouring corporate opt-outs even where PECR does not strictly require it.
Sole traders and some partnerships are individual subscribers: you need their consent or the "soft opt-in" (existing customers, similar products). If you cannot tell which type a recipient is, the ICO says to treat them as an individual.
Countries we have not covered
Rules in the Netherlands, Belgium, Italy, Spain, Poland and elsewhere vary and change. Some apply the consent rule to legal persons, some allow addresses that a company publishes for business contact. Check the national telecom or consumer regulator before you include a country, and keep a record of what you checked and when.
A checklist that works everywhere
- Know the country of the recipient's company, not just its email domain. A .com address can belong to a Danish company.
- Exclude consent countries from cold email entirely unless you have documented prior consent.
- Exclude sole traders in every country; they are individuals for both layers of law.
- Verify every address so you are not writing to people who have left; see how to verify B2B email addresses.
- Write to a role, about their job. The French relevance test is a good standard everywhere.
- Identify yourself fully in every email: legal name, address and an opt-out. See what a cold email footer must include.
- Honour opt-outs immediately and permanently with a suppression list that survives list re-imports.
- Tell people where you got their data in the first email, for example "we found your company in the Swedish companies register".
- Write down your legitimate interests assessment before the first campaign.
How Outvori handles this
Outvori never prospects in Germany, Austria or Canada, where B2B cold email needs prior consent. Danish companies can be searched and viewed, but a company from the Danish register can never be added to an email campaign. Every campaign email carries your legal name, postal address and an unsubscribe link, and sending waits until your sender identity is saved. See cold email in Outvori for how campaigns are reviewed before anything is sent.
