Guides
Is cold email legal under GDPR?
Often, yes. GDPR lets you cold email business contacts on legitimate interests, but each country's ePrivacy law decides whether you may send without consent.
GDPR covers how you handle the person's data: why you have it, what you tell them and what happens when they object. Whether the email itself is allowed is decided by the recipient's national ePrivacy law, and that answer differs by country. Germany and the Netherlands need consent even for business addresses, while the UK allows email to companies with an opt-out.
In practice
- Find the recipient's country first. Its ePrivacy law decides whether you need consent before the first email.
- Where no consent is needed, rely on legitimate interests. Before the campaign, write down your interest, why email is necessary for it, and why it doesn't override the person's interests.
- Say in your first email who you are, where you got their details and how to object. GDPR requires this when the details didn't come from the person.
- Stop at once if they object, and keep them on a suppression list. The right to object to direct marketing is absolute.
- Keep the pitch relevant to their job. It's part of what makes legitimate interests hold up, and France's regulator expects it.
What GDPR requires
| Requirement | What it means for cold email | Source |
|---|---|---|
| A lawful basis | Usually legitimate interests. Recital 47 says direct marketing may be a legitimate interest, but it isn't automatic: you need a real interest, email must be necessary for it, and the person's interests mustn't outweigh it | GDPR Art 6(1)(f) and Recital 47, EDPB guidelines 1/2024 |
| Telling them | When the details didn't come from the person, say where you got them, your legitimate interest and their right to object, at the latest in your first email | GDPR Art 14 |
| The right to object | They can object to direct marketing at any time, and you must stop. Mention the right clearly in your first email | GDPR Art 21(2) to (4) |
| Fines | Up to €20 million or 4% of worldwide annual turnover, whichever is higher | GDPR Art 83(5) |
Why GDPR alone doesn't decide it
The ePrivacy Directive sets the rules for marketing email. It requires prior consent for email marketing to individuals, apart from the soft opt-in for existing customers, and leaves each country to decide how far that protection reaches businesses (ePrivacy Directive Art 13).
Where the ePrivacy rule requires consent, legitimate interests can't replace it, because the ePrivacy rule is the specific law for this activity (EDPB opinion 5/2019). The EU's planned ePrivacy Regulation was withdrawn in 2025, so the national laws below still apply (withdrawal notice).
Country by country
| Country | Cold email to business addresses | Law | Guide |
|---|---|---|---|
| UK | Allowed to companies, LLPs and Scottish partnerships with an opt-out. Sole traders and other partnerships need consent | PECR reg 22 | UK guide |
| Ireland | Allowed to an address used mainly for work when the email relates solely to that work. Companies can object | S.I. 336/2011 reg 13 | Ireland guide |
| Germany | Prior express consent, business addresses included | UWG s.7(2) | Germany guide |
| France | Consent for individuals. The CNIL accepts B2B email without consent when it relates to the person's job | CPCE L34-5 | France guide |
| Netherlands | Prior consent, for businesses too, unless the address was published to receive such messages | Telecommunicatiewet art 11.7 | Netherlands guide |
Check one address
Precleared checks a single address against the recipient country's rules and returns the verdict, the rule with its source, what the footer must include and a signed receipt. Try a free check or read the docs.
Common questions
Do I need consent to cold email under GDPR?
Not under GDPR itself: legitimate interests can cover B2B cold email. But the recipient's national ePrivacy law may require consent first, as Germany and the Netherlands do even for business addresses.
Does GDPR apply to business email addresses?
Yes, when the address identifies a person, such as jane.smith@company.com. A generic address such as info@ usually isn't personal data, though the national email marketing rules can still apply.
What must my first cold email include?
Who you are, where you got their details, your legitimate interest and a clear, free way to object. Each country adds its own requirements, which Precleared's footer_text spells out for each address.
What happens if someone objects?
Stop emailing them straight away and keep their address on a suppression list so they aren't contacted again. The right to object to direct marketing is absolute.
Is it different in the UK?
The UK has its own UK GDPR and PECR, which work the same way. Email to companies is allowed with an opt-out, but sole traders and some partnerships need consent. Since February 2026, PECR fines can reach £17.5 million or 4% of global turnover.
What are the fines?
Under GDPR, up to €20 million or 4% of worldwide annual turnover, whichever is higher. National regulators also fine under their own email marketing laws.
Decision support with sources, not legal advice. Checked on 30 October 2026.