Many sales teams believe GDPR slammed the door shut on cold outreach across Europe. That’s a misconception. The reality? Far more nuanced, and deeply country-dependent.
Cold emailing isn’t banned outright on the continent. Two overlapping legal frameworks govern it: GDPR and the ePrivacy Directive. B2B outreach remains legal in most EU countries under the “legitimate interest” basis found in Article 6(1)(f). B2C cold email, on the other hand, demands prior consent, full stop.
What follows is a practical breakdown of the legal landscape across major European markets, the key compliance requirements you must meet, and actionable steps to keep your outreach defensible in 2026.
Is B2B Cold Emailing Legal in the EU Under GDPR?
Yes. GDPR regulates how you process personal data, but it does not ban cold email. Every processing activity needs a valid legal basis, and for B2B cold outreach, that basis is “legitimate interest” under Article 6(1)(f). Recital 47 explicitly names direct marketing as a recognized legitimate interest. For deeper context on one of Europe’s strictest markets, check out Overloop’s specific insights on Germany.
Legitimate interest isn’t a blanket pass, though. You need a documented Legitimate Interest Assessment (LIA) for each campaign. Skip this step and your legal defense crumbles if a data protection authority comes knocking.
B2C cold email sits in different territory entirely. The ePrivacy Directive (Article 13) requires prior consent before you send any marketing email to consumers. No workarounds, no exceptions.
The myth that “GDPR killed cold email” persists because the regulation raised the bar. Responsible, documented outreach still works. Lazy, spray-and-pray campaigns don’t. That’s the difference.
GDPR vs. ePrivacy Directive: The Two-Layer Legal Framework
Most guides miss a critical distinction. GDPR governs personal data processing broadly. The ePrivacy Directive (2002/58/EC) governs electronic communications specifically, including email marketing.
Where both overlap, ePrivacy takes precedence. GDPR Article 95 and Recital 173 make this explicit. So even if your GDPR compliance is airtight, you still need to satisfy your country’s ePrivacy transposition
Here’s the complication: each EU member state transposed the ePrivacy Directive differently. France interpreted it one way. Germany another. This creates a patchwork of national rules that trips up sales teams treating “Europe” as a single jurisdiction.
The proposed ePrivacy Regulation, meant to replace the Directive and harmonize these rules, has been stuck in legislative limbo for years. As of 2026, it remains unfinalized. A cold email perfectly legal in France may violate German law. You must check each market individually.
Country-by-Country Breakdown: Where Can You Cold Email in Europe?
Risk varies dramatically across EU markets. Here’s a practical tier system based on ePrivacy implementations and enforcement patterns.
Permissive markets: France, Netherlands, Ireland, and the Nordics
France’s CNIL allows B2B cold email without opt-in consent, provided your outreach relates to the recipient’s professional role. You must include an opt-out mechanism in every message.
The Netherlands, Ireland, and Sweden follow a similar approach. They permit B2B cold email to corporate addresses without prior opt-in, as long as you clearly identify yourself and offer a simple way to unsubscribe. These markets represent the safest ground for compliant B2B cold outreach in Europe.
Strict markets: Germany, Austria, Spain, and Italy
Germany’s UWG §7 requires prior consent for most commercial emails, even in B2B contexts. Courts interpret legitimate interest very restrictively. Treat Germany as opt-in-only territory unless you have iron-clad documentation.
Austria mirrors Germany’s strict approach. Spain’s AEPD and Italy’s Garante also require opt-in consent for B2B outreach, and both enforce actively. Spain alone has issued over 1,000 GDPR fines.
| Market tier | Countries | B2B consent needed? | Risk level |
| Permissive | France, Netherlands, Ireland, Sweden | No (with opt-out) | Low |
| Strict | Germany, Austria, Spain, Italy | Yes (opt-in required) | High |
Practical advice: unless you’ve built explicit consent infrastructure, avoid cold emailing in strict markets. Consider LinkedIn-first approaches or inbound strategies instead.
What Is a Legitimate Interest Assessment (LIA) and How Do You Complete One?
A LIA is the mandatory documentation that makes your legitimate interest claim defensible in front of regulators. Without one, you’re flying blind.
The European Data Protection Board requires a three-part test:
- Purpose test — Why are you contacting this person? You need a specific, genuine business reason, not “they might buy our product.”
- Necessity test — Why is email the appropriate and least intrusive channel? Could you achieve the same goal through your website or advertising?
- Balancing test — Do the recipient’s privacy rights override your business interest? Role relevance matters enormously here. A CFO receiving a finance software pitch passes this test more easily than a random employee.
Complete a LIA per campaign, not once for all outreach. Update it whenever you change targeting criteria or data sources. The UK ICO publishes a free LIA template that works as a solid starting point, even for EU-focused teams.
What Are the Mandatory Compliance Requirements for Cold Emails in Europe?
Every cold email you send across Europe must meet these requirements:
- Clear sender identification: your name, company name, and contact details. Anonymous cold email violates GDPR outright.
- Functioning opt-out mechanism in every message. One-click unsubscribe works best. Honor opt-outs immediately through a suppression list (don’t delete records, or you risk re-contacting the same person).
- Transparency at first contact: explain how you obtained the recipient’s data and link to your privacy policy. Article 14 mandates this.
- Data minimization: collect only what you need. Name, email, job title. Stay away from sensitive data categories entirely.
- Professional email addresses only. Never target personal addresses for B2B outreach.
Log the source URL and timestamp for every lead at the moment of collection. Regulators ask for this during audits, and scrambling to reconstruct it after the fact rarely ends well.
What Penalties Do You Face for Non-Compliant Cold Emails in Europe?
GDPR maximum fines reach up to €20 million or 4% of global annual turnover, whichever is higher (Article 83). Those ceiling figures grab headlines, but practical penalties for B2B cold email violations vary widely.
In practice, fines range from €500 for small businesses to €900,000 and beyond. SOLOCAL Marketing Services received a €900,000 fine from France’s CNIL in 2025 for commercial prospecting without a sufficient legal basis. Orange France paid €50 million for embedding advertising in emails without clear consent.
Total GDPR fines exceeded €7.1 billion by early 2026. European DPAs issued over 330 fines in 2025 alone. SMEs aren’t immune either. Fines under €200K against small businesses appear regularly in enforcement records.
Beyond the financial hit, you face domain reputation damage, deliverability collapse, and operational disruption. Even a modest fine can trigger email providers to flag your domain, tanking your entire outreach operation.
What About the UK After Brexit? Is Cold Emailing Legal There?
The UK ranks among the most permissive markets for B2B cold email. PECR (Privacy and Electronic Communications Regulations) carves out corporate subscribers from the consent requirement for marketing emails.
You can cold email UK businesses without prior opt-in. Two conditions: include clear sender identification and a working opt-out mechanism. Straightforward.
One important catch. Sole traders and partnerships count as individuals under PECR. They require consent, just like consumers. Misclassifying a sole trader as a corporate subscriber exposes you to enforcement action from the ICO.
The UK ICO actively publishes guidance and free LIA templates that help teams document their legitimate interest claims properly.
How Does the EU AI Act Affect Cold Emailing in 2026?
A new regulatory layer kicks in from August 2026. Article 50 of the EU AI Act (Regulation 2024/1689) requires transparency whenever AI systems generate text that interacts with natural persons.
If your cold emails are AI-drafted or AI-sent, you must include a disclosure statement in each message. This applies to AI-powered cold email tools and automated sequences regardless of how “human” the output looks.
The method, manual versus automated, doesn’t change the GDPR legal analysis. But the AI Act adds a distinct transparency obligation on top of existing rules. Teams using AI email generation tools should prepare compliance workflows now, before the August deadline arrives.
FAQ
Can I send cold emails to personal Gmail addresses in Europe?
No. B2C cold email requires prior consent under the ePrivacy Directive. Emailing personal addresses without consent violates the law and exposes you to GDPR fines up to €20 million or 4% of global revenue.
Do I need consent to send B2B cold emails in France?
No. CNIL allows B2B cold email under legitimate interest without opt-in consent, as long as your outreach relates to the recipient’s professional role and every email includes a clear opt-out mechanism.
Is cold emailing legal in Germany without prior consent?
Generally no. Germany’s UWG §7 requires prior consent for most commercial emails, even B2B. Very narrow exceptions exist for existing customers or highly relevant professional outreach, but these demand extensive documentation most teams can’t realistically maintain.