B2B cold email and GDPR: what the law allows

B2B cold email and GDPR are two separate questions, and most confusion comes from mixing them up. GDPR decides how you may handle a person’s data, such as a named work email address. A second law, the national rule built on the EU ePrivacy Directive, decides whether you may send an unsolicited marketing email at all. That second law differs from country to country, and in some countries it requires prior consent even when you write to a company.

Below are both layers, followed by the rules in Czechia, Slovakia, Germany, the United Kingdom and the United States, with links to the law texts and the regulators’ own guidance.

As of 2 October 2026. This article explains the law in general terms and is not legal advice. Laws and regulators’ views change; check the sources and, for a real campaign, ask a lawyer in the recipient’s country.

Quotes from Czech, Slovak and German texts are our own translations; the links lead to the originals.

In short:

• GDPR does not ban B2B cold email. Legitimate interest can be a legal basis for direct marketing, but you must tell people where you got their data and let them object.
• Whether you may send the email at all is national law. Czechia and Germany require prior consent even for companies. Slovakia allows emails to published business contacts. The UK allows emails to companies but not to sole traders without consent or an existing customer relationship. The US uses an opt out model.
• Every message needs at least: who you are, a working way to opt out, and the GDPR information about the source of the data and the right to object.

Two sets of rules apply to every cold email

Think of it as two gates. You need to pass both.

Passing one gate does not open the other. A message can be fine under GDPR and still be unlawful under national ePrivacy law, and the reverse.

What the EU ePrivacy Directive says

Article 13 of Directive 2002/58/EC sets the European baseline for marketing email.

• Article 13(1): email for direct marketing “may be allowed only in respect of subscribers or users who have given their prior consent.”
• Article 13(2): the existing customer exception. If you got a customer’s email address in the context of a sale, you may email them about your own similar products or services, provided they can object easily and at no cost, when the address is collected and in every message.
• Article 13(4): marketing emails that disguise or conceal the sender, or have no valid address where the recipient can ask you to stop, are prohibited in every case.
• Article 13(5): paragraphs 1 and 3 apply to subscribers who are natural persons. For “subscribers other than natural persons”, meaning companies, member states must make sure their legitimate interests are “sufficiently protected”.

That last paragraph is why the rules for writing to companies differ so much. The directive left the B2B question to each country, and each country answered it differently.

GDPR and B2B cold email: the personal data side

A company’s general address like info@ may not identify anyone. A named work address like jana.novak@company.com does. Under Article 4(1) of the GDPR, any information relating to an identified or identifiable person is personal data, so the moment you collect and use a named contact, GDPR applies.

Legal basis

Most B2B senders rely on legitimate interest, Article 6(1)(f). Recital 47 says that processing “for direct marketing purposes may be regarded as carried out for a legitimate interest”. The word “may” matters. You still need a balancing test: is your interest overridden by the person’s rights and reasonable expectations? A relevant offer to someone in the right role at a company that fits is easier to defend than a mass mailing to a bought list.

Legitimate interest under GDPR does not replace consent where the national ePrivacy law requires consent. That is gate 1.

Tell people where you got their data

When you did not get the data from the person directly, Article 14 applies. Among other things you must tell them who you are, why you process their data and on what legal basis, and “from which source the personal data originate, and if applicable, whether it came from publicly accessible sources” (Article 14(2)(f)). If you use the data to contact the person, you must give this information “at the latest at the time of the first communication” (Article 14(3)(b)). In practice: the first email, or a link in it to a short privacy notice.

The right to object

Under Article 21(2) and (3), a person can object at any time to direct marketing, and then their data “shall no longer be processed for such purposes”. Article 21(4) adds that this right must be “explicitly brought to the attention of the data subject” at the latest in the first communication, “clearly and separately from any other information”. A footer that hides the objection inside a long paragraph does not meet that.

The rules country by country

Czechia

Section 7 of Act No. 480/2004 Coll. says contact details may be used to send commercial communications by electronic means “only to users who have given prior consent”. The exception in section 7(3) covers your own customers and your own similar products or services, with an easy way to refuse when the address is collected and in every message. Section 2(f) defines a commercial communication broadly, as all forms of communication intended to promote goods, services or a company’s image.

The Czech data protection authority (ÚOOÚ) supervises these rules. Its answers to common questions are blunt:

• Whether the recipient is a person or a company makes no difference: the law “does not distinguish between types of addressee” (question 25).
• Contact details freely available on the internet may not be used to send an offer: the answer is “No” (question 10).
• Consent given “generally” to an undefined circle of companies is not informed consent, which rules out most bought databases (question 11).
• Both the sender and the company the message promotes are responsible. Ordering the mailing from someone else does not transfer the responsibility (question 21).
• Asking for consent by email is not allowed either: such a request promotes you, so it is itself a commercial communication, and the authority’s answer is “No” (question 13).
• The message must be marked as a commercial communication so the recipient sees it at first glance, for example in the subject line or before the sender’s address; the authority mentions labels such as “OS” (the Czech abbreviation for a commercial communication), “newsletter”, “novinky” (news), “akce” (promotion) or “sleva” (discount) (question 16, and section 7(4)(a) of the act). It must also identify the business whose products or services it promotes, in the message itself (question 17).

For Czech recipients, plan on consent: a form, a webinar sign-up, a downloaded guide with a clear consent box, or an existing customer you write to about your own similar products or services. Channels that are not commercial email also stay open: meeting people in person, events, referrals and content that brings people to you. The article on how to get B2B clients without referrals covers them.

Slovakia

Section 116(15) of Act No. 452/2021 Coll. says prior consent is not required for direct marketing “addressed to the published contact details” of a subscriber or user who is a business owner or a legal person. The same paragraph requires an easy way to refuse, at no cost, at any time, when the contact is collected and in every message, and it prohibits email that hides the sender’s identity and address.

Two details matter. The exception covers published contacts, so an address you guessed from a name pattern is a different case. And section 116(4) prohibits using email to obtain the prior consent in the first place. If you do rely on consent in Slovakia, section 116(5) requires you to keep the record of it on a durable medium for at least four years after the person withdraws it.

Germany

Section 7(2) no. 2 of the UWG treats advertising by electronic mail as an unacceptable nuisance “without the prior express consent of the addressee”. The text does not exempt business addressees. Section 7(3) contains the existing customer exception, on the same lines as the directive.

United Kingdom

The ICO’s guidance on electronic mail marketing says you “can email or text any corporate body (a company, Scottish partnership, limited liability partnership or government body)”. Sole traders and some partnerships “are treated as individuals”, so you need their consent or an existing customer relationship. The ICO also calls it good practice to keep a “do not email” list of businesses that opt out. Data protection law still applies to the named person’s data.

United States

The FTC’s CAN-SPAM compliance guide states that “the law makes no exception for business-to-business email.” CAN-SPAM does not require prior consent. It requires honest header information and subject lines, identifying the message as an ad, a valid physical postal address, a clear way to opt out, and honouring opt outs within 10 business days. The FTC also notes that you can’t contract away your legal responsibility to a mailing service.

Which country’s rules apply?

The directive leaves the B2B question to each member state and says little about which state’s rule wins when sender and recipient are in different countries. The cautious way to plan is by the recipient’s country, and where you’re unsure, by the stricter rule. A Slovak company writing to Czech companies should not rely on the Slovak exception.

What every cold email should contain

Wherever you send, these elements cover the common requirements above:

1. Who is sending and on whose behalf, with company name and contact details in the message.
2. A working way to opt out, at no cost, that stops further messages at once.
3. The source of the person’s data, the purpose and legal basis, or a link to a short privacy notice that gives them (GDPR Article 14).
4. The right to object, stated clearly and separately from the rest (GDPR Article 21(4)).
5. An honest subject line.
6. Where the country requires it, a clear mark that this is a commercial communication (Czechia).

And outside the message:

• A suppression list. Once someone opts out or objects, they never receive marketing from you again. Under GDPR Article 21(3) their data may no longer be used for that purpose, so keep only what you need to honour the opt out.
• A record of where each contact came from and, where you rely on consent, when and how it was given.

Five myths about B2B cold email

1. “B2B is exempt everywhere.” It’s not. Czechia and Germany require consent even for companies.
2. “If the address is public, I may use it.” In Slovakia that is close to the rule. In Czechia the regulator’s answer is no.
3. “Legitimate interest under GDPR is enough.” It covers the data side. It does not override a national consent rule.
4. “The tool or agency carries the risk.” The Czech regulator holds the company that benefits responsible too, and the FTC says responsibility can’t be contracted away.
5. “Asking for consent by email is fine.” It’s not. The Czech regulator says such a request can’t be used, because it is itself a commercial communication (question 13). Slovakia’s law forbids using email to obtain consent outright.

Where HypeLead fits

HypeLead is a tool. It doesn’t make anyone’s outreach lawful, and the rules above stay your responsibility: you are the controller of your prospects’ data and the sender of your campaigns.

What the app does: before a campaign targets a country whose law needs prior consent for business email, it warns you and asks once per campaign. Every email carries a one-click unsubscribe, and your prospects get a privacy notice page. Mail goes out from your own mailbox, and replies, by default, go out when you click. See how it works and our security page, or read how to get B2B clients without referrals for the channels that work where email needs consent, and what an AI SDR can’t do if you are considering automating outreach. For the business types we built it for, see the use cases.

---

Want outreach that warns you before a campaign targets a consent country? Your next step is at the end of this page.