GDPR Cold Email: Is It Legal? Legitimate Interest, Article 14 and Country Rules

Is cold email legal in the EU? Two laws decide

Cold email to businesses can be legal in the EU, but only if you meet both the GDPR and the email rules of the recipient's country, and in Germany and Austria the national text requires prior consent for email advertising.

Most advice about GDPR cold email answers one question and skips the other:

1. May you process this person's data? That is the GDPR. For B2B outreach the usual basis is legitimate interest (Article 6(1)(f)), plus a notice to the person under Article 14.
2. May you send this email at all? That is the ePrivacy Directive (2002/58/EC), which each country turned into its own law. Legitimate interest cannot override a national rule that demands consent.

Both answers have to be yes for each recipient. This guide uses primary texts, regulator pages and a court judgment, all read on 2026-10-17, and flags where they disagree with some vendor guides. It is general information, not legal advice.

Cold email rules by country: what ePrivacy says about B2B

Article 13(1) of the ePrivacy Directive allows email for direct marketing only with the recipient's prior consent. Article 13(2) exempts your own customers (similar products, easy opt-out when you collect the address and in every message), which does not cover cold outreach.

The B2B gap sits in Article 13(5). Paragraphs 1 and 3 apply to subscribers who are natural persons. For everyone else, member states only have to make sure legitimate interests are sufficiently protected, so each country decided for itself. The EDPB (the board of EU data protection regulators) warns that national rules may demand consent beyond the Directive, and gives marketing to professionals as its example.

The proposed ePrivacy Regulation, which would have repealed the Directive, was withdrawn: the notice appeared in the Official Journal on 6 October 2025. The national patchwork stays.

These four are examples, not a map of Europe. For any other country, read the national text or ask local counsel before you send. Our guide to cold email in Germany goes deeper on section 7.

Does legitimate interest cover cold email in Germany?

Some vendor guides say legitimate interest covers B2B cold email across the EU. One current example is lemlist's guide (last updated 7 October 2026). Its EU and EEA row says legitimate interest generally works for B2B outreach, and its FAQ says explicit consent is not needed in most cases. It tells you to check the country you send into, but it does not name Germany or Austria.

German sources say something else:

• The statute. For a call to a business, section 7(2) no. 1 accepts at least presumed consent. For email, no. 2 requires the addressee's prior express consent and draws no line between consumers and businesses.
• The Munich Chamber of Commerce. It states that B2B email advertising needs prior consent and that the GDPR did not change the UWG.
• The German data protection authorities. Their joint guidance on direct advertising (DSK, February 2022) says that if the UWG does not allow a contact channel, there is already no legitimate interest. Without the section 7(3) conditions, it says using email addresses for advertising generally needs consent.

The two views answer different questions. Legitimate interest is a GDPR basis for processing data. It does not lift a national consent rule, and the EDPB says so in a footnote: if national law does not permit the message, "there would be no legitimate interest that the controller could invoke" to collect the data for it.

None of the German sources listed here allows B2B cold email without consent. The gap is between those sources and guides that treat legitimate interest as the whole answer. A cautious reading: in Germany and Austria, treat email outreach as consent-first, and do not assume an assessment fixes it. Whether a specific message crosses the line is for a court.

Legitimate interest cold email: how to document your GDPR basis

Recital 47 says processing for direct marketing may be regarded as carried out for a legitimate interest. May, not does. The EDPB guidelines (version 1.0, adopted 8 October 2024) add that this does not make every kind of direct marketing legitimate. Three conditions must be met each time:

• a legitimate interest,
• necessity,
• and a balance that does not tip toward the person.

The Court of Justice applied the test in Case C-621/22 (4 October 2024), which concerned a sports federation passing member data to sponsors. A commercial interest can qualify and need not be written into law, but it must be lawful and the processing must be strictly necessary. In our reading, winning customers can be a legitimate interest, and an interest that depends on breaking the law is not.

Reasonable expectations carry most of the balance. The ICO's business-to-business guidance notes that a person whose business contact details are public on their employer's website may well expect contact from other businesses, but you still need a lawful basis, privacy information and a way to honor objections. The EDPB adds a caution: giving the Article 12, 13 or 14 information does not by itself create a reasonable expectation. The CNIL makes relevance an explicit condition: the offer must relate to the person's profession (its example is software pitched to an IT director).

Write the assessment before you send. The ICO publishes a template and recommends recording it, even though UK GDPR has no specific requirement to. The EDPB says to document it before processing starts.

A worked example (fictional)

Harbor Data, a ten-person analytics agency, wants to email 300 heads of finance at UK limited companies about a reporting audit.

• Purpose: win clients for a service relevant to the role.
• Necessity: name, job title and work email only.
• Balance: business capacity, low sensitivity, role-relevant offer, notice in the first email, easy opt-out.

On these facts the balance looks reasonable, and limited companies are corporate subscribers, so the PECR email rule does not apply. The same list full of sole traders would fail earlier, at the PECR step.

Guessed email addresses

On 16 October 2026 the CNIL published a page on reconstructing professional addresses from a name and a company's address pattern. It can rest on legitimate interest, but not automatically. People with no identifiable online presence, or who hide their details, cannot in principle expect it.

The CNIL suggests keeping a reconstructed address only if a first effective contact is established within a reasonable time, and dropping anyone who objects, without asking why. Without those safeguards, it says to skip it unless you have consent.

GDPR Article 14 cold outreach: what to tell people and when

Article 14 applies because you did not collect the data from the person. The notice covers:

• who you are, and the contact for a data protection officer if you have one
• the purposes and the legal basis
• the categories of data
• the recipients
• any transfer outside the EU
• how long you keep the data
• the legitimate interests you pursue
• the person's rights, including the right to object
• the right to complain to a regulator
• where the data came from

Timing: two clocks

Article 14(3) gives you a reasonable period after obtaining the data, one month at most. If you use the data to contact the person, the deadline is the first communication when that comes sooner. The Article 29 Working Party's transparency guidelines (WP260 rev.01) spell out the consequence: if the first email goes out more than a month after you got the data, the one-month limit still applies.

For example, a rep builds a list of 200 contacts on 2 March and emails the first 50 on 9 March. Those 50 need the notice in, or linked from, the 9 March email. The other 150 still need it by 2 April. The clock runs from when you get the data, not from your first send.

How much goes in the email

WP260 recommends a layered approach: the first layer carries the essentials (who you are, why, the person's rights) and links to the full notice. Article 21(4) separately requires the right to object to be brought to the person's attention by the first communication, clearly and apart from other information. In our reading, a short paragraph in the first email plus a link to the full notice follows both. Whether your wording is enough is a question for your counsel.

Say where you got the data

Article 14(2)(f) requires the source. WP260 says to name the specific source unless that is impossible, and otherwise to describe the type of source and sector. Writing only that the data came from public sources is not enough if you can tell which website or provider it came from.

Compiling a database from several sources does not lift the duty if you can trace each person's source, even with effort. Record the source per contact when you add it.

The exceptions rarely help

Article 14(5)(a) excuses you if the person already has the information. Article 14(5)(b) covers impossible or disproportionate effort. The Working Party says to read these exceptions narrowly, not to rely on (b) routinely outside archiving, research and statistics, and to tie the effort to the fact that you did not collect the data from the person. In our reading, if you can email someone you can usually tell them.

Objection, suppression and retention for cold outreach

Objection. Under Article 21(2) and (3) a person can object to direct marketing at any time, and you must then stop. The EDPB says this right is unconditional: no reason, no balancing, whatever legal basis you chose. Breaches of data subject rights (Articles 12 to 22, which include the Article 14 notice) fall in the higher fine tier of Article 83(5): up to 20 million euros or, for a company, up to 4% of worldwide annual turnover, whichever is higher.

Suppression. Erasing everything about someone who objected would let you re-import them next month. The CNIL's answer is a suppression list used only to honor objections and holding as little as possible. It suggests storing hashed fingerprints rather than addresses, keeping them at least three years, and checking new lists against them. Hashed data is still personal data, so secure it.

Rights requests. Article 12(3) gives you one month to act on access, erasure and similar requests, extendable by two further months where necessary. You must tell the person about the extension within the first month.

Retention. The GDPR sets no number; Article 5(1)(e) says no longer than necessary. The CNIL's reference for commercial management says prospect data can be kept for three years from collection or from the last contact initiated by the prospect. A click on a link to the product counts, a bare open does not. After that, ask whether they want to keep hearing from you, or delete or archive the data. The CNIL presents this as guidance, so you can choose a shorter period and write down why.

A GDPR cold email checklist you can copy

1. Check each recipient's country and subscriber type against that country's email rule first.
2. Record a lawful basis per contact and write the assessment before the first send.
3. Collect the minimum (name, role, work email) and record the source of each contact.
4. Put the Article 14 first layer and a link to the full notice in the first email. Notify unemailed contacts within one month.
5. State the right to object clearly in that email, make opting out easy (a one-click unsubscribe link works), name yourself and give a valid reply address.
6. Check the suppression list at enrollment and again at send.
7. Set a retention period, delete prospects you never reached, and document why.
8. List your vendors and processors, including AI tools, as recipients or categories of recipients in the notice, and have the contracts Article 28 requires.
9. Handle access and erasure requests within one month, and write down each decision above so you can show it.

How FoxKnock helps with GDPR cold email

FoxKnock includes built-in GDPR tools, so several checks above are settings and blocks rather than reminders. Compliance stays with you as the sender.

• Country rule packs. Each country is set to allow, require a confirmed lawful basis, or block, and you can edit them. Defaults require a confirmed basis for Germany, Austria, Italy, Poland, Denmark, Hungary, Canada and Australia, and allow France, the UK and the US. While any country requires a basis, a contact with an unknown country is blocked until you set a country or a basis.
• The limit of a pack. A rule only checks that a basis is recorded. Any of the three bases passes, so recording legitimate interest for a German contact satisfies the rule even though the sources above point to consent. If you have no consent records, you may prefer to block Germany and Austria.
• Basis per contact. Legitimate interest, consent or contract. Your written legitimate-interest assessment is one text field per workspace in the compliance settings.
• Article 14 link. First-touch emails link to your privacy notice (you supply the URL; FoxKnock does not write it). While that setting is on, a missing link blocks first emails to the EU/EEA, UK, Switzerland and recipients with an unknown country.
• Source records. Each enriched field stores its provider, source URL (where there is one) and retrieval time, the raw material for your notice's source line.
• Suppression. One workspace-wide list by email and domain, checked at enrollment, when a step is prepared and again at send, plus a one-click unsubscribe link in every email.
• Retention. A default 365-day window that removes only prospects never contacted and never engaged. Suppression entries stay.
• Access and erasure. Admins can export everything held about one person as JSON, or erase them. Copies already pushed to a connected CRM are outside FoxKnock's reach.

Two caveats. The email finder's last step guesses an address from a company's pattern and checks it against MX records (a guess is never reported as valid). It runs only when no data provider returned an address, so read the CNIL page above if you email French recipients. And AI features send content to Claude, by Anthropic, so list AI providers among your recipients. See the GDPR features page and the email finder guide.

If you want to see these checks on your own contacts, the Free plan includes 500 one-time credits (granted once you verify your email) and needs no card. You can try FoxKnock with the free credits and set your country rules and notice link before you send anything.

What is still unsettled

• The ICO's electronic mail and business-to-business pages both say they are under review because of the Data (Use and Access) Act. PECR regulation 22 changed on 5 February 2026, but the change adds a charity soft opt-in (regulation 22(3A)). Regulation 22(1) still applies the email rule to individual subscribers, so the corporate subscriber split above is unchanged for now.
• On 2026-10-17 we found only version 1.0 of the EDPB legitimate interest guidelines (October 2024, issued for public consultation). A final version may follow, so check before you cite them.
• AI disclosure in outreach is a separate question, covered in the EU AI Act and cold email.

This guide is general information, not legal advice. Laws, regulator guidance and court decisions change, and national courts decide individual cases. For a campaign you depend on, have a lawyer in the destination country check your approach.