Guides

Is cold email legal in Spain?

Not without consent. Article 21.1 of the LSSI prohibits advertising or promotional email that the recipient has not previously requested or expressly authorised.

This protects companies as well as people. The Spanish data protection authority (AEPD) said in resolution E/01853/2015 that it is irrelevant whether the address belongs to a natural or a legal person, because the LSSI does not distinguish, and that an address published on a website is not authorisation. Existing customers can be emailed about your own products or services similar to those they bought, if you got their details lawfully (article 21.2).

In practice

Every message must be clearly identifiable as a commercial communication and name the person or company it is sent for (article 20.1).
Include a valid email address or other electronic address for revoking consent (article 22.1), and to existing customers a simple free way to object in every message (article 21.2).
The AEPD enforces the LSSI. Fines run from up to 30,000 euros for minor breaches to 600,000 euros for very serious ones (article 39).

The rules Precleared applies

Before an agent sends a cold or marketing email to someone in Spain, these are the rules that decide whether it may. Each one is quoted from its legal source and checked on the date shown. Precleared applies them to one address at a time and returns the rule that decided, what the footer must include and a signed receipt.

Allowed

Article 21.2 of the LSSI allows commercial email without fresh consent where there is a prior contractual relationship, the contact details were obtained lawfully, and the email is about the sender's own products or services similar to those originally contracted. Every message must offer a simple, free way to object.

Footer must include: Make the message clearly identifiable as a commercial communication and name the person or company it is sent for (article 20.1). Include a valid email address or other electronic address for revoking consent (article 22.1), and a simple free way to object in every message (article 21.2).

Next step: Confirm the contract exists and that this offer is similar to what they bought. Give an opt-out in every message and honour it.

cuando exista una relación contractual previa, siempre que el prestador hubiera obtenido de forma lícita los datos de contacto del destinatario y los empleara para el envío de comunicaciones comerciales referentes a productos o servicios de su propia empresa que sean similares a los que inicialmente fueron objeto de contratación con el cliente

LSSI, article 21.2

Checked on 2 November 2026

Consent needed first

Article 21.1 of the LSSI prohibits advertising or promotional email that the recipient has not previously requested or expressly authorised. The Spanish data protection authority (AEPD) applies this to company addresses too: in resolution E/01853/2015 it said it is irrelevant whether the address belongs to a natural or a legal person, because the LSSI does not distinguish, and that an address published on a website is not authorisation. Fines run from up to 30,000 euros for minor breaches to 600,000 euros for very serious ones (article 39).

Next step: Do not cold email. Get express prior consent (an opt-in you can evidence), or use the existing-customer route for similar products. The AEPD treats a published or role address no differently.

Queda prohibido el envío de comunicaciones publicitarias o promocionales por correo electrónico u otro medio de comunicación electrónica equivalente que previamente no hubieran sido solicitadas o expresamente autorizadas por los destinatarios de las mismas.

LSSI, article 21.1; AEPD resolution E/01853/2015

Checked on 2 November 2026

Sources

Check one address

curl https://precleared.dev/api/v1/check \
  -H "Authorization: Bearer pc_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "recipient_email": "jane@example.es",
    "sender_country": "GB",
    "pitch": "Bookkeeping software for small firms",
    "address_source": "published",
    "recipient_country": "ES"
  }'

Over MCP, call contact_check with the same fields at https://precleared.dev/mcp.

Common questions

Can I cold email Spanish companies?

Not without express prior consent. The AEPD applies the LSSI to company addresses too, because the law does not distinguish between natural and legal persons.

Is an address published on a Spanish website enough?

No. The AEPD said in resolution E/01853/2015 that an address published on a website is not authorisation.

Can I email existing customers in Spain?

Yes, about your own products or services similar to those they bought, if you got their details lawfully and every message gives a simple, free way to object.

How GDPR fits in: Is cold email legal under GDPR?

Other countries

Decision support with sources, not legal advice.