# Cold e-mail rules for B2B, country by country

> A country-by-country table of when B2B cold e-mail needs prior consent and when legitimate interest with an opt-out is allowed, plus the GDPR steps that apply across Europe.

Whether you may e-mail a stranger at another company depends on where they are, what kind of address you have and, in Europe, on two separate sets of rules. This guide sets out the defaults Demander applies in 24 countries, the reasons behind them, and what you need in place where e-mail without consent is allowed.

> **Not legal advice.** This page summarises the research behind Demander’s defaults. It is general information, it can go out of date, and it does not replace advice from a lawyer who knows your market and your case. The defaults lean strict on purpose, and a workspace owner confirms them before any opt-out prospecting starts.

## Two layers of rules in Europe

In the EU two rule sets apply to the same e-mail. National e-marketing law, based on the ePrivacy Directive, decides whether you may send unsolicited commercial e-mail at all. The GDPR decides how you may process the address, because jan.novak@example.cz identifies a person even when he uses it for work.

The recipient’s country is the one that counts for e-marketing law. A Czech company e-mailing a French prospect follows French rules; a French company e-mailing a Czech prospect follows Czech rules. Where the GDPR applies, its requirements come on top of either.

Most national laws treat legal persons (companies) differently from natural persons. Sole traders usually count as natural persons, and so do free-mail addresses such as Gmail or Seznam, which nearly always belong to an individual.

## Where B2B cold e-mail needs consent

In these countries Demander sends no marketing e-mail to a named business contact without recorded consent. Role addresses count too.

| Country | Law | What it requires |
| --- | --- | --- |
| Czechia | Act 480/2004 Coll., §7 | Prior consent for commercial e-mail, legal persons included; fines up to CZK 10 million |
| Germany | UWG §7(2) and §7(3) | Express prior consent, B2B included; courts expect documented consent, usually double opt-in |
| Austria | TKG 2021, §174 | Consent for e-mail direct marketing, B2B included |
| Poland | Electronic Communications Law (PKE), Art. 398, since November 2024 | Prior consent for natural and legal persons; fines up to 3 percent of revenue |
| Switzerland | UWG Art. 3(1)(o) | Consent for mass advertising e-mail |
| Belgium | Royal Decree of 2003 | Consent; the decree exempts impersonal addresses such as info@, which Demander still treats as needing consent |
| Spain | LSSI Art. 21 | Prior consent for commercial e-mail |
| Italy | Privacy Code Art. 130 | Consent |
| Portugal | Decree-Law 7/2004 | Consent, as a conservative default |
| Denmark | Marketing Practices Act §10 | Consent, B2B included |
| Norway | Marketing Control Act §15 | Consent, as a conservative default |
| Hungary | Act CVIII of 2001 | Consent |
| Romania | Law 506/2004 | Consent |
| Canada | CASL | Express or implied consent; Demander does not infer implied consent from a published address |
| Australia | Spam Act 2003 | Express or inferred consent |

Existing customers can usually be e-mailed about similar products if they were offered an opt-out when their details were collected and in every message since (the soft opt-in). The exemption is narrow in Germany, depends on the ECG list in Austria and is limited in Poland.

## Where e-mail without consent is allowed, with conditions

In these countries Demander can e-mail business contacts on the basis of legitimate interest, with an opt-out, once the steps in the next section are done.

| Country | Law | When it is allowed | Who still needs consent |
| --- | --- | --- | --- |
| Slovakia | Act 452/2021, §116 | To business contact details published for that purpose, with the sender identified and a free opt-out | Private individuals |
| France | CPCE L.34-5 and CNIL guidance | When the message concerns the recipient’s profession, they were told when the address was collected, and opting out is easy | Consumers |
| Netherlands | Telecommunicatiewet art. 11.7 | To legal persons (BV, NV) at contact details they published for that purpose, with an opt-out in every message | Natural persons, sole traders (eenmanszaak) included |
| Ireland | S.I. 336/2011, Reg. 13 | To corporate subscribers who have not objected | Individuals |
| Sweden | Marketing Act §19 | To legal persons, with an opt-out | Natural persons |
| Finland | Information Society Code | When relevant to the recipient’s role, with an opt-out | Private individuals |
| United Kingdom | PECR reg. 22 and 23, UK GDPR | To corporate subscribers (Ltd, PLC, LLP, public bodies), with the sender identified and objections honoured; fines up to £17.5 million or 4 percent of turnover since February 2026 | Sole traders and partnerships other than LLPs |
| United States | CAN-SPAM | Opt-out model: accurate headers, an honest subject line, a postal address, opt-outs honoured within 10 business days | Nobody under CAN-SPAM; state privacy laws cover tracking |
| India | DPDP Act 2023 | Opt-out in Demander’s table today, handled conservatively while consent rules phase in | Anyone you are unsure about |

A country missing from both tables, or a contact whose country is unknown, is treated as consent required.

## What you need before the first e-mail

Where the GDPR applies, e-marketing law allowing the e-mail is only half of it. These steps cover the other half, and Demander will not send opt-out prospecting until they are in place.

1. **A legitimate interest assessment.** Document why you have a legitimate interest in contacting this kind of person, why e-mail is necessary for it, and why it does not override their interests. Demander requires the workspace to record a completed assessment and to switch on opt-out prospecting explicitly.
2. **A lawful basis on every contact.** Record legitimate interest as the basis for each contact the assessment covers. A contact with no basis recorded is not e-mailed.
3. **An Art. 14 notice in the first message.** If you did not get the address from the person, the first message has to say where it came from, why you are writing, the legitimate interest you rely on and their right to object. Demander’s footer states the source and links to your privacy notice, and prospecting waits until that link is set.
4. **A message about their job.** The content has to concern the recipient’s professional role. Accounting software pitched to a finance director qualifies; the same pitch to a developer at the same company is much harder to defend.
5. **Suppression that lasts.** Anyone who objects, unsubscribes or bounces goes on a suppression list and is never e-mailed again, from any mailbox or sequence.

## What every message needs, everywhere

These apply in every country, consent or not, and Demander adds them to every outbound message.

- **Who is writing.** The sender’s name and company, and a valid postal address in the footer.
- **One-click unsubscribe.** List-Unsubscribe and List-Unsubscribe-Post headers (RFC 8058) plus a visible opt-out link. Gmail requires one-click unsubscribe from bulk senders; Demander applies it to cold mail at any volume.
- **Honest headers and subject lines.** No misleading sender names or subjects. CAN-SPAM spells this out, and recipients everywhere expect it.
- **Opt-outs honoured at once.** Demander suppresses an address as soon as the unsubscribe or objection arrives. The US allows 10 business days; there is no reason to use them.

## How Demander applies the tables

Every recipient is checked twice: when they are enrolled in a sequence and again just before each send. The check reads the recipient’s country and the kind of address, and returns allowed or blocked with the reason, which you see on the contact.

The defaults lean strict. Free-mail addresses count as private individuals in Europe. In consent countries, role addresses such as sales@ are blocked as well. Disposable mailboxes, invalid addresses and anyone on the suppression list are never e-mailed. For the United Kingdom the check adds a reminder that sole traders and partnerships count as individuals, since an address alone rarely shows the legal form.

Accounts in consent countries are still reachable. Demander keeps them out of cold sequences and reaches them with ads on company lists, LinkedIn messages that a person reviews and sends, and content. Someone who opts in through a form gets a double opt-in e-mail, and consent is recorded only when they confirm.

For Denmark and Sweden, prospected companies and people are also checked against the national marketing opt-out registers (reklamebeskyttelse and reklamspärr); anyone opted out, or who cannot be checked, is left out.

## Questions

**Can I send one e-mail asking for consent in a consent country?**

Treat it as risky. A request for permission to send marketing can count as marketing in itself, and our research found the Czech regulator takes that view. Earn the first contact through another channel, such as an ad, a LinkedIn message a person sends, or content people sign up for.

**Does the sender’s country matter?**

For e-marketing law the recipient’s country decides. Where you are based decides which data protection authority supervises you, and Demander applies the GDPR steps whenever either the sender or the recipient is in the EU, EEA, UK or Switzerland.

**Is an e-mail to info@ outside these rules?**

Often it is not. Several countries apply their consent rule to legal persons as well, so a generic address does not help there. Demander blocks role addresses in consent countries and allows them in opt-out countries under the same conditions as any other contact.

**Do I need double opt-in?**

German courts expect consent you can prove, and double opt-in is the usual way to prove it. Demander uses it for every e-mail consent collected through a form: the person confirms by clicking a link, and the time and source are stored.

## Related

- [E-mail outreach](https://demander.to/features/email-outreach/)
- [EU and CEE markets](https://demander.to/use-cases/eu-and-cee-markets/)
- [Company identification and GDPR](https://demander.to/resources/company-identification-gdpr/)
- [Buying committee mapping](https://demander.to/resources/buying-committee-mapping/)
- [Mailboxes](https://demander.to/platforms/mailboxes/)

---
Source: https://demander.to/resources/cold-email-rules-by-country/ · Demander · reviewed 2026-10-02