Cold email in the EU: GDPR and ePrivacy

Layer 1: the GDPR

A named work address such as marta.silva@acme.example is personal data, so the GDPR applies when you collect, store and email it.

A lawful basis, usually legitimate interests

For B2B cold email the usual basis is legitimate interests, Article 6(1)(f): processing that is necessary for your legitimate interests, unless the person’s interests and rights override them. Recital 47 says direct marketing may be regarded as a legitimate interest (GDPR). It is not automatic: you need to show the interest is real, the processing is necessary for it, and it doesn’t override the person’s interests, considering what they would reasonably expect. The EDPB’s Guidelines 1/2024, published for consultation in October 2024, explain this test (EDPB). Write your assessment down.

Tell people, at the latest in the first email

When you didn’t get the data from the person, Article 14 requires you to give them information about the processing, and when you use the data to contact them, at the latest at the time of the first communication. In practice: say who you are, why you’re writing and where you got their details, and link to a privacy notice that covers the rest.

The right to object is absolute for direct marketing

Under Article 21(2) and (3), a person can object to processing for direct marketing at any time, and once they do, you must stop using their data for that purpose. An unsubscribe is an objection.

Erasure and other rights

People can ask what you hold about them, ask you to correct it or erase it (Article 17), and complain to their data protection authority.

Layer 2: ePrivacy rules, country by country

Article 13 of the ePrivacy Directive requires prior consent for email marketing to subscribers who are natural persons, with an exception for a business’s existing customers and similar products (the “soft opt-in”), and it always prohibits disguising the sender or omitting a valid address for opt-out requests. For subscribers who are not natural persons, such as companies, Article 13(5) leaves it to member states to protect their legitimate interests (Directive 2002/58/EC, Art. 13). That is why B2B rules differ by country.

Germany: prior express consent, B2B included

Germany’s Act against Unfair Competition (UWG) treats advertising by email without the addressee’s prior express consent as an unreasonable nuisance in every case (§ 7(2) no. 2). Unlike the rule for phone calls, it does not distinguish consumers from business recipients. The only exception is for a business’s own customers, for similar products, with an opt-out offered at collection and in every email (§ 7(3)) (UWG § 7). In practice, cold email to people in Germany needs consent first.

France: B2B allowed, with conditions

The CNIL says consent isn’t needed to email professionals if they were told, when their address was collected, that they could object free of charge, and the message relates to their professional role. It also says addresses collected from public spaces on the internet must not be used for prospecting, and every message must identify the advertiser and offer a way to unsubscribe (CNIL).

Elsewhere

Other member states take positions between these two. Check the national rule for each country you email, based on where the recipient is, before you launch.

What every email needs

• Who you are, clearly, with a valid address for opt-out requests
• Why you are contacting them and where you got their details (Article 14), with a link to your privacy notice
• An easy way to object or unsubscribe, honoured straight away
• Content relevant to the recipient’s professional role

What Inboxed does automatically

• Adds your company name and postal address to the footer of every campaign email, and blocks a campaign from launching until they’re set (Settings → Compliance, or per campaign).
• Adds a visible unsubscribe line and one-click unsubscribe headers (RFC 8058) to every campaign email. A click takes effect straight away, for everything your workspace sends, with no login or extra details asked.
• Treats replies such as “unsubscribe”, “remove me” or “stop emailing” as an unsubscribe.
• Keeps a suppression list that every campaign checks before each send. Unsubscribes and spam complaints can’t be removed by your team; you can also block whole companies by domain.
• Erase a person (Settings → Compliance) deletes what the workspace holds about an email address and keeps only a one-way hash, so the address is never emailed again.
• Optional data retention deletes old data automatically, with a preview of what would be removed.
• Offers a data processing agreement and a public list of sub-processors.

What you must do

Inboxed can’t decide who you may lawfully email. These parts are your responsibility:

• Check the ePrivacy rule in each recipient’s country, and don’t send where prior consent is required and you don’t have it.
• Choose and document your lawful basis; for legitimate interests, write the balancing assessment.
• Say in the first email who you are, why you’re writing and where you got their details, and link to a privacy notice (add the link to your signature or template).
• Collect only what you need about each lead and keep it accurate.
• Answer access, correction and erasure requests within the GDPR’s time limits, using Erase a person for erasure.
• Sign the data processing agreement, since Inboxed processes lead data on your behalf.

Penalties

Data protection authorities can order you to stop, and can fine under Article 83 of the GDPR. National ePrivacy and unfair competition rules, such as Germany’s UWG, have their own enforcement.

Common questions