Is B2B cold email legal under GDPR? The rules in 2026

Can you email business prospects without consent? The rules in the UK, France and the rest of Europe, plus the 5 obligations every cold email must meet.

By Clément Houde · Updated on 2 October 2026 · 5 min read

Is it legal to send a cold email to a procurement director you have never spoken to? In the UK and France, yes, provided you follow a few rules. But the answer changes as soon as your prospects are based in Germany, Spain or Italy. Here are the rules, with sources, so you can prospect without taking unnecessary risks.

At a glance

What matters is the law of the country where the recipient is based, not where your company is registered.

The rules in the United Kingdom

Since Brexit, the UK applies its own version of the GDPR (the UK GDPR) alongside the Privacy and Electronic Communications Regulations (PECR). According to the ICO, PECR distinguishes between two types of recipient:

• corporate subscribers (limited companies, LLPs, Scottish partnerships and public bodies): you can send them marketing emails without prior consent, as long as you identify yourself and give them a simple way to opt out;
• individual subscribers, which include sole traders and partnerships (other than Scottish partnerships): they are treated like consumers, so you need their consent unless an exception such as the "soft opt-in" for existing customers applies.

PECR only governs the sending of the email. As soon as you email a named person (jane.smith@company.co.uk), you are also processing personal data, so the UK GDPR applies: you need a lawful basis (usually legitimate interests), you must tell people where you got their details, and you must honour objections.

The rules in France

The CNIL distinguishes between two cases. For consumers, prior consent is mandatory. For professionals, email prospecting is allowed without consent, provided that:

• the message relates to the person's job (a provider of accounting software can write to a finance director, but not offer them a skiing holiday);
• the person is informed, when their data is collected or in the first message, of how their address will be used;
• they can easily object, free of charge, to any further emails.

The legal basis for the processing is then legitimate interests (article 6(1)(f) of the GDPR). This is not a formality: document why your approach is legitimate and proportionate (target audience, purpose, safeguards).

The 5 obligations every cold email must meet

1. A business email address: firstname.lastname@company.com. Personal addresses (Gmail, Outlook) fall under the rules for consumers, even if the person runs the company.
2. A link with their role: the subject must relate to the recipient's professional activity. It is also what makes people reply.
3. An identifiable sender: company name, contact details, no hidden address and no misleading subject line.
4. A way to opt out: an unsubscribe link or a simple "stop" reply, applied immediately and permanently.
5. Information on where the data came from: if you did not collect the address directly from the person, article 14 of the GDPR requires you to tell them the source and their rights, at the latest when you first contact them.

What about the rest of Europe?

The ePrivacy Directive lets each EU member state set its own rules for emails to businesses. As a result, the same email can be legal in Lyon and unlawful in Munich.

• Germany: § 7 of the Act against Unfair Competition (UWG) requires prior, explicit consent for email advertising, including between businesses. The exception covers your existing customers, for similar products.
• Spain: article 21 of the LSSI prohibits unsolicited or unauthorised commercial emails, unless there is a prior contractual relationship.
• Italy: article 130 of the Codice privacy requires consent in principle for promotional emails, and the Garante also takes action in B2B cases.
• Luxembourg: the law of 30 May 2005 requires consent in principle for individuals. Prospecting business addresses about the recipient's activity is generally accepted, but is worth checking case by case.
• United Kingdom: see above. Companies can be emailed without consent; sole traders and most partnerships cannot.

In short: Germany, Spain and Italy generally require prior consent, even in B2B. Choose your target countries based on these rules, not the other way round.

How long can you keep the data?

The CNIL recommends keeping the data of a prospect who has not replied for no more than 3 years from the last contact. Suppression lists, on the other hand, should be kept for as long as necessary to make sure you never email people who asked you to stop.

What we do at Lead Matrix

• Target countries are agreed with you, taking the rules above into account.
• Each campaign targets specific roles, with a message relevant to their work.
• Every email clearly identifies the sender and includes a way to unsubscribe; opt-outs are applied immediately.
• Your "do not contact" list (current customers, competitors, sensitive contacts) is applied across all running campaigns.

For the practical side of writing and sending, read our B2B cold email guide.

Frequently asked questions

Do I need consent to send a B2B cold email in the UK?

Not to limited companies, LLPs or public bodies, as long as you identify yourself and offer a simple way to opt out. Sole traders and most partnerships are treated like individuals, so you need their consent.

Do I need consent to send a B2B cold email in France?

No, if the email goes to a business address, its subject relates to the recipient's role and it allows them to easily opt out of further emails.

Can I email a generic address such as info@ or contact@?

A generic address does not identify a person, so the GDPR does not apply to it. Fair dealing rules still apply: an identified sender and a way to opt out.

Can I cold email companies in Germany?

In principle, not without prior consent, even in B2B, because of § 7 UWG. Other channels or a consent-based approach are preferable.

What are the risks if I get it wrong?

The GDPR provides for fines of up to €20 million or 4% of worldwide annual turnover. In practice, enforcement mostly targets missing opt-outs and emails sent to consumers without consent.

This article provides general information and is not legal advice. For a specific situation, consult a lawyer or your data protection officer.