B2B cold email: what France allows, 15 European countries ban

In brief

• In France, a prospecting email to a business needs no prior consent if it relates to the recipient’s line of work and the recipient can easily object. That is not a European rule. It is a French choice.
• The European directive requires prior consent only for natural persons and leaves each country to decide for businesses. Countries have decided in opposite directions.
• Of 28 European countries whose laws we checked on 13 October 2026, 15 require prior consent even when the recipient is a business, including Germany, Spain, Italy, the Netherlands, Poland and Switzerland. Three allow it under conditions (Belgium, Norway, Portugal). Only nine, like France, work on an opt-out basis.
• What counts is the law of the recipient’s country, not the sender’s.
• Our map covers 28 European countries, with its sources. It is freely available in our resources.

B2B cold email without prior consent is not a European rule: it is a French rule, shared by Ireland and the United Kingdom. As of 13 October 2026, out of 28 European countries whose laws we read, 15 require the recipient’s prior consent even when the recipient is a business, and 3 allow it only under conditions. A campaign designed in France and sent unchanged across Europe therefore breaks the law of several countries with its very first message.

Is B2B cold email allowed everywhere in Europe?

We found this out while preparing a European prospecting campaign, and we are probably not the only ones who reasoned the wrong way. The usual reasoning has three steps: in France, the data protection authority (CNIL) accepts prospecting of professionals on the basis of legitimate interest; the GDPR governs this; the GDPR is European, so the rule applies everywhere. The third step is wrong.

The GDPR governs the use of personal data. Sending a commercial email is governed by another text, the 2002 directive on privacy and electronic communications, which each country has transposed in its own way. Its article 13 requires prior consent for subscribers who are natural persons. For everyone else, meaning businesses, it only asks Member States to ensure that their legitimate interests are sufficiently protected. Each country has therefore chosen its own level of protection, and the choices range from a simple opt-out to an outright ban.

On the French side, the CNIL says it plainly: prospecting professionals can rest on legitimate interest when the message relates to the profession of the person contacted, provided that person has been informed and can object. Generic addresses such as contact@ or info@, which belong to a legal entity, are not even subject to these principles. It is flexible, and that is exactly what gives false confidence once you cross the border.

For a French business prospecting in France, the short answer is therefore yes: a B2B cold email without prior consent is allowed if it relates to the recipient’s line of work, the person has been told how their address will be used, the sender is identified and every message offers a simple way to refuse further ones. Two words sum up the gap with part of Europe. Opt-in requires agreement before the first message; opt-out lets you write until the person objects. France is opt-out for professionals; part of Europe is opt-in.

Which law applies when you email abroad?

The recipient’s. The European e-commerce directive sets the principle that an online service follows the law of its country of establishment, but its annex expressly excludes unsolicited commercial communications by email from that principle. Being established in France does not shield you from German or Dutch law when you write to a German or Dutch business.

The Netherlands proved the point. The Dutch consumer and markets authority fined a Belgian company that emailed Dutch small businesses without their consent, and the appeal court upheld the fine on 17 March 2016, reducing it from 81,000 to 75,000 euros. Its recipients were businesses, and that made no difference: Dutch law requires the prior consent of every “end user”, legal entities included, with one narrow exception.

A recipient’s country is read from the legal notice on its website, not from its domain extension or the language of the message. A .com shop can be German, and a .fr address can belong to a Belgian subsidiary.

B2B cold email: what does the law say in the ten main markets?

We ranked the countries on a single question: can you write to a business that never asked to hear from you? The detail by type of address, for these ten countries and eighteen others, with the text and source behind each line, is in the map published in our resources.

Which traps does the table not show?

A sole trader is often a private individual. In the United Kingdom, the data protection authority classes sole traders and some partnerships as “individual subscribers”: you can only email them with their consent, as you would a private individual. In Portugal and in Belgium, the exception only covers legal entities. Yet many small online shops are run by one person trading in their own name. In a permissive country, that is often where the breach lies.

An employee’s named address is not the company’s. In Belgium, the Royal Decree only accepts “impersonal” electronic contact details, and its explanatory report states that an address such as name.firstname@company.be belongs to a natural person, whether it is used for work or not. In the United Kingdom, emailing a company is allowed, but an address that names an employee is still personal data subject to the UK GDPR. Everywhere, as soon as an address identifies someone, the GDPR comes on top of the sending rule: you must say where the address came from and offer an opt-out from the first message.

A public address is not an address open to prospecting. The Italian data protection authority, the Garante, writes in its 2013 guidelines that without prior consent you cannot send promotional messages even if the data comes from public registers, lists or websites. In February 2026 it issued a reprimand to a small company whose emails stated that they processed data “from public online lists, websites or social media” relating “exclusively to legal persons”. The statement changed nothing. In the Netherlands the exception exists, but it only covers an address a business has itself published to receive commercial offers: an ordinary contact address is not one.

What does a country mistake cost?

The amounts are not symbolic, and a single message is sometimes enough to create liability.

• Germany: the risk is mainly civil, an injunction claim brought by the receiving business or by a competitor. The Federal Court of Justice held on 20 May 2009 that a single unsolicited advertising email can be an unlawful interference with the business that receives it.
• Netherlands: up to 900,000 euros, or 1% of turnover if that is higher.
• Spain: up to 30,000 euros for an isolated mailing, from 30,001 to 150,000 euros for a mass or repeated one.
• Portugal: from 5,000 to 5,000,000 euros for a legal entity.
• Poland and Slovakia: up to 3% and 5% of turnover.
• Switzerland: a criminal offence when intentional, prosecuted on complaint, punishable by up to three years’ imprisonment or a monetary penalty.
• Ireland: even in a permissive country, ignoring an unsubscribe request is an offence. A company was prosecuted in 2018 over one email sent to a business address after three removal requests its system had failed to record.
• France: an administrative fine of up to 375,000 euros for a legal entity that breaches the rules on electronic prospecting.

These ceilings do not tell you what a small business will actually pay: the Italian Garante settled for a reprimand against a small company that had sent one message per recipient. They do tell you that none of these countries treats the matter as a formality.

How do you prepare a European prospecting campaign?

1. Assign each contact to a country, based on its company’s legal notice. A contact with no established country does not go out.
2. Classify each address into three types: generic company address, named employee address, sole trader. The same country can say yes to the first and no to the other two.
3. Cross country and type against the map. Anything that lands in a “prior consent” cell leaves the campaign, however good the contact.
4. For closed countries, change channel: content that brings the prospect to you, trade fairs, a local partner, postal mail. The telephone follows separate rules, to be checked separately: in Germany, for instance, calling a professional allows presumed consent, which email does not.
5. In open countries, do everything the tolerance assumes: a clear sender identity, the source of the address, one-click unsubscribe in every message, and an opt-out list checked before every send. In Portugal, add the national list kept by the Directorate-General for the Consumer.

This week’s test, with no tool: export your foreign B2B contacts, add a “country of establishment” column and an “address type” column, then count how many land in a closed cell. If you find that half of your German list should never have received your last campaign, you know where to start.

What should your sending tool be able to do?

Most emailing tools think in lists, not countries. For European prospecting, three capabilities make the difference: linking each contact to a country and an address type, and blocking the send on those two fields rather than relying on everyone’s vigilance; keeping a single opt-out list, checked before every send, whatever the campaign; and storing the source of each address, since the GDPR requires you to tell the person. Method comes before the tool: well-configured software does not excuse a badly sorted list.

What this says about the bigger picture

The European single market is real for goods, much less so for first contact. A small business that sells easily in ten countries finds it cannot prospect in them the same way, and that the countries closest culturally are not the closest legally: Belgium and Switzerland are stricter than Ireland.

The practical consequence is a change of order. You no longer choose the message first and the countries second; you first choose the countries where you are allowed to write, then the channel for the others. That is exactly the work of a market-by-market acquisition strategy, which we carry out in our digital marketing strategy expertise. For France, the line between consumers and professionals is covered in our article on GDPR in day-to-day marketing, and the telephone side in our article on cold calling in France since 11 August.

Sources

All these pages were opened on 13 October 2026.

1. Directive 2002/58/EC on privacy and electronic communications, article 13, consolidated version, EUR-Lex. View
2. Directive 2000/31/EC on electronic commerce, article 3 and annex, EUR-Lex. View
3. CNIL, “La prospection commerciale par courrier électronique, SMS-MMS et automate d’appel”, 10 June 2026 (in French). View
4. French Postal and Electronic Communications Code, article L34-5, Légifrance (in French). View
5. Data Protection Commission (Ireland), prosecution of Viking Direct (Ireland) Limited. View
6. ICO (United Kingdom), “Electronic mail marketing” and “Business-to-business marketing”. View
7. Belgian Royal Decree of 4 April 2003 regulating the sending of advertising by email, and explanatory report, Justel (in French). View
8. Portuguese Law 41/2004, articles 13-A, 13-B and 14, as amended by Law 46/2012, Diário da República (in Portuguese). View
9. German Act against Unfair Competition (UWG), section 7 (in German). View
10. German Federal Court of Justice, 20 May 2009, I ZR 218/07, “E-Mail-Werbung II” (in German). View
11. Dutch Telecommunications Act, articles 11.7 and 15.4, version in force on 15 August 2026, wetten.overheid.nl (in Dutch). View
12. ACM, “Uitspraak CBb in zaak tegen Companeo S.A. over spam”, 23 March 2016 (in Dutch). View
13. Spanish Law 34/2002 (LSSI), articles 21, 38, 39 and annex, consolidated text, BOE (in Spanish). View
14. Garante per la protezione dei dati personali, guidelines on promotional activity and spam, 4 July 2013 (in Italian). View
15. Garante per la protezione dei dati personali, decision of 12 February 2026, doc. web 10224476 (in Italian). View
16. Swiss Federal Act against Unfair Competition, art. 3(1)(o) and art. 23, status as of 1 January 2025, Fedlex (in French). View
17. OFCOM (Switzerland), “Quand les envois en masse sont-ils autorisés ?”, 2 July 2021 (in French). View

FAQ

Can you send B2B cold emails without prior consent everywhere in Europe?

No. The European directive only requires prior consent for natural persons and leaves each country to decide for businesses. Of the 28 European countries we checked on 13 October 2026, 15 require prior consent even for a business, including Germany, Spain, Italy, the Netherlands, Poland and Switzerland. Belgium, Norway and Portugal allow it under conditions. Nine countries, including France, Ireland and the United Kingdom for companies, work on an opt-out basis.

What is the difference between opt-in and opt-out in B2B prospecting?

Opt-in requires the recipient’s agreement before the first message. Opt-out lets you write without prior agreement until the recipient objects, provided every message offers a simple way to refuse. In B2B, France applies opt-out when the message relates to the recipient’s line of work; Germany, Spain and Italy apply opt-in, even to a business.

My company is based in France: isn’t French law enough?

No. The e-commerce directive expressly excludes unsolicited commercial email from the country-of-origin principle. The law of the recipient’s country applies. The Netherlands fined a Belgian company in 2012 for emailing Dutch small businesses, a fine upheld on appeal in 2016.

Is a contact@ address found on a company website fair game?

It depends on the country. In France and Belgium, a company’s generic address can receive prospecting, with an option to object. In Italy, the Garante writes that an address found on a website or in a directory does not remove the need for consent. In Spain, the law protects every recipient, legal entities included. In the Netherlands, only an address the business published to receive commercial offers escapes prior consent.

What should you do in countries where cold email is closed?

Change channel rather than force it: content that attracts the prospect and invites them to sign up, trade fairs, local partners, postal mail. The telephone follows other rules, to be checked country by country: in Germany, calling a professional allows presumed consent, unlike email.

Can Dotsland help?

Yes. We build a market-by-market acquisition strategy with you: the countries to write to, the ones to reach through another channel, and the list sorting that goes with it. Start with this week’s test described above, then get in touch with the result.