--- title: "GDPR: What It Means for Cold Email" description: "Can you send B2B cold email under the GDPR? Legitimate interest, notice and objection rules, ePrivacy country rules, fines up to EUR 20 million and real cases." path: /cold-email-laws/gdpr family: laws updated: 2026-10-17 html: /cold-email-laws/gdpr sources: - "https://eur-lex.europa.eu/eli/reg/2016/679/oj" - "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02002L0058-20091219" - "https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29.pdf/b1787d6b-6bce-07da-a38f-3742e3888c1d?version=15.0" - "https://www.edpb.europa.eu/about-edpb/about-edpb/members_en" - "https://www.cnil.fr/fr/la-prospection-commerciale-par-courrier-electronique" - "https://curia.europa.eu/juris/liste.jsf?num=C-621/22" - "https://www.cnil.fr/fr/sanction-de-900-000-euros-societe-solocal-marketing-services" - "https://www.cnil.fr/fr/aspiration-de-donnees-sanction-de-240-000-euros-lencontre-de-la-societe-kaspr" - "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9435753" - "https://www.ecb.europa.eu/stats/policy_and_exchange_rates/euro_reference_exchange_rates/html/index.en.html" - "/anti-spam" - "/terms" - "/features" facts: law: "General Data Protection Regulation (Regulation (EU) 2016/679)" jurisdiction: "European Union and EEA" in_force: "2018 (applies from May 25, 2018)" regulator: "National data protection authorities, coordinated by the EDPB" b2b_cold_email: "Legitimate interest; consent rule varies by country" max_penalty: "EUR 20 million or 4% of worldwide turnover, whichever is higher" --- # GDPR: What It Means for Cold Email Often yes. The GDPR accepts legitimate interest for B2B email if you give notice and honor objections. Each EU country's ePrivacy law decides if consent comes first: France allows B2B opt-out, Germany and Italy require consent. Fines reach EUR 20 million or 4% of turnover. ## Not Legal Advice > Not legal advice. We checked this page against the law's text and the regulator's guidance on October 17, 2026; it has not been reviewed by a lawyer. ## Can You Send B2B Cold Email Under the GDPR? **In short:** Often yes: the GDPR accepts legitimate interest for direct marketing if you give notice and honor objections, but each country's ePrivacy law decides whether a B2B email needs consent first. The GDPR does not ban cold email and does not require consent for it. Article 6(1)(f) allows processing for legitimate interests, and Recital 47 says processing for direct marketing may be regarded as carried out for a legitimate interest. You still owe the person a notice (Article 14) and you must stop when they object (Article 21). Whether the email itself needs consent comes from the ePrivacy Directive, which each country writes into its own law. Article 13(1) requires prior consent for marketing email to natural persons, and Article 13(5) leaves the protection of companies to each member state. So the B2B rule depends on the recipient's country. The French regulator CNIL allows B2B prospecting by email on legitimate interest when the message relates to the person's job. Italy's privacy code (article 130) and Germany's UWG require consent. Being outside the EU does not take you out of scope. The GDPR applies to a company outside the EU when it processes personal data of people in the EU to offer them goods or services (Article 3(2)). ## What Do You Need to Do Under the GDPR? **In short:** 7 rules apply to a cold email program under the GDPR. **GDPR requirements for cold email, checked October 17, 2026** | Requirement | What it means | How to do it | Section | | --- | --- | --- | --- | | Lawful basis | You need a legal basis to process the contact's data. For cold email it is usually legitimate interest, which needs a real interest, processing that is necessary for it, and a balance with the person's rights. | Write a short legitimate interest assessment per campaign: why this role, why this offer, what the person would reasonably expect. | GDPR Art. 6(1)(f), Recital 47 | | Country consent rule | Marketing email to natural persons needs prior consent, and each country sets its own rule for companies. | Check the recipient's country before you send: B2B opt-out where it is allowed (France, when the email relates to the job), consent where it is required (Germany, Italy). | ePrivacy Directive Art. 13(1) and 13(5) | | Notice with the data source | When you did not get the data from the person, tell them who you are, why you process it, your legitimate interest, their rights and where the data came from, at the latest in your first email and within one month. | Add a short notice to the first email with the source (for example, your company website) and a link to your privacy notice, in the recipient's language. | GDPR Art. 14(1) to 14(3) | | Right to object | Once a person objects to direct marketing, you must stop processing their data for it. | Honor every opt-out at once, across all campaigns and mailboxes, and keep a suppression list. | GDPR Art. 21(2) and 21(3) | | Flag the right to object | Tell people about the right to object at the latest in your first message, clearly and separately from other information. | Give it its own line in the first email, for example: Not interested? Reply stop and we will not email you again. | GDPR Art. 21(4) | | Honest sender and a stop address | Marketing email may not hide the sender and must give a valid address where the recipient can ask you to stop. | Use a real sender name, company and domain, with a monitored reply or unsubscribe address. | ePrivacy Directive Art. 13(4) | | Retention and access requests | Keep data no longer than you need it, and answer access requests within one month. | Set a retention period for prospects who never reply, and log where each contact came from. | GDPR Art. 5(1)(e), 12(3) and 15 | ## What Are the Penalties Under the GDPR? **In short:** Maximum penalty: EUR 20 million or 4% of worldwide turnover, whichever is higher. **GDPR maximum penalties, checked October 17, 2026** | Penalty | Maximum | In USD | Section | | --- | --- | --- | --- | | Fine for breaking the lawful basis, notice or objection rules | EUR 20,000,000 or, for a company, 4% of total worldwide annual turnover of the preceding year, whichever is higher | about USD 22.5 million | [GDPR Art. 83(5)](https://eur-lex.europa.eu/eli/reg/2016/679/oj) | | Fine for lower-tier breaches, such as security of processing | EUR 10,000,000 or, for a company, 2% of total worldwide annual turnover, whichever is higher | about USD 11.3 million | [GDPR Art. 83(4)](https://eur-lex.europa.eu/eli/reg/2016/679/oj) | | Penalties for breaking the ePrivacy email rules | Set by each country's law; the Directive sets no EU-wide amount | Not a fixed amount | [ePrivacy Directive Art. 15a(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02002L0058-20091219) | USD amounts are approximate, converted at the European Central Bank reference rates of 2026-10-16. National data protection authorities investigate, order and fine (GDPR Art. 83). People can complain to a regulator (Art. 77), go to court (Art. 79) and claim compensation for material or non-material damage (Art. 82). Under ePrivacy Art. 13(6), anyone harmed by unlawful marketing email, including an email provider, can sue. ## What Enforcement Has There Been Under the GDPR? **In short:** 3 cases from regulator and court records, newest first. **GDPR enforcement examples from regulator and court records** | Date | Company | What happened | Outcome | Source | | --- | --- | --- | --- | --- | | 2025-05-15 | Solocal Marketing Services | Sent SMS and email prospecting for advertisers using data bought from brokers whose sign-up forms did not collect valid consent. | EUR 900,000 fine from the CNIL (France) | [CNIL decision summary](https://www.cnil.fr/fr/sanction-de-900-000-euros-societe-solocal-marketing-services) | | 2024-12-05 | KASPR | Collected the work contact details of LinkedIn users, including details users had limited to their connections, kept them for years and informed people late and only in English. | EUR 240,000 fine from the CNIL (France) | [CNIL decision summary](https://www.cnil.fr/fr/aspiration-de-donnees-sanction-de-240-000-euros-lencontre-de-la-societe-kaspr) | | 2020-07-09 | Wind Tre | Sent promotional SMS, email, fax and calls without consent, and many people could not withdraw consent or object. | EUR 16,729,600 fine from the Garante (Italy) | [Garante injunction order](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9435753) | ## Cold Email Checklist for the GDPR 1. Look up the recipient's country rule before you send: B2B opt-out or consent first. 2. Write a legitimate interest assessment for each campaign and target by job relevance. 3. Record where you got each contact so you can name the source. 4. Put a short privacy notice and the data source in the first email. 5. Give the right to object its own line in the first email. 6. Use a real sender name, company and domain, with a working reply or unsubscribe address. 7. Suppress every objection at once, across every campaign and mailbox. 8. Delete prospects who never reply after a set retention period. ## How Ken Helps **In short:** Ken Campaigns handles opt-outs, suppression and sending limits; it does not make your emails lawful, and the law stays your responsibility. - Campaign emails must include a legally appropriate opt-out or unsubscribe mechanism unless Ken approves another lawful approach in writing, and Ken can run the unsubscribe links, reply-based opt-outs and suppression for you (Ken Terms of Service, section 7.3). - Ken's anti-spam policy puts opt-outs, abuse complaints, spam-trap notices and hard bounces on a suppression list that applies across every domain and mailbox Ken operates, and never expires it. - Ken tracks every bounce, unsubscribe and spam report, and every campaign rotates across several inboxes to stay under daily send limits. - You give Ken your legal entity name and mailing address for the email footer, and Ken will not knowingly use materially false or misleading headers, sender details or subject lines (Terms, section 7.2). - Ken's anti-spam policy bars purchased and scraped lists, and accounts found sending unsolicited bulk email are suspended (section 6). - Ken's terms leave the legality of your offer, audience and data, and any consents and notices the law requires, with you (section 7.1). Under the GDPR, that includes your lawful basis, your privacy notice and each country's consent rule. - [Join the waiting list](/waitlist) - [Read Ken's anti-spam policy](/anti-spam) ## FAQ ### Does the GDPR require consent for B2B cold email? No. The GDPR accepts legitimate interest for direct marketing (Art. 6(1)(f), Recital 47) if you give notice and honor objections. The consent question comes from each country's ePrivacy law: France allows B2B opt-out when the email relates to the person's job, while Italy and Germany require consent. ### When do I have to tell a prospect where I got their data? At the latest in your first email when you use the data to contact them, and in any case within one month of getting it. The notice must name the source and say whether it was publicly accessible (Art. 14(2)(f) and 14(3)). ### What happens when a prospect says stop? You must stop processing their data for marketing (Art. 21(3)). You also have to tell them about this right in your first message, separately from other information (Art. 21(4)). ### Can I collect contact details from LinkedIn? Not freely. In December 2024 the CNIL fined KASPR EUR 240,000 for collecting contact details that LinkedIn users had limited to their connections, and for informing people late. ### Is making money a legitimate interest? It can be. The EU Court of Justice held on October 4, 2024 (C-621/22) that a commercial interest can qualify if it is lawful, the processing is strictly necessary and the person's rights do not override it. ## Related - [Cold email laws by country](/cold-email-laws): All 12 laws compared - [UK GDPR and PECR: What They Mean for Cold Email](/cold-email-laws/uk-gdpr-pecr): Allowed to companies, opt-out; sole traders need consent - [UWG Section 7 (Germany): What It Means for Cold Email](/cold-email-laws/uwg): Not allowed without prior consent - [CASL (Canada): What It Means for Cold Email](/cold-email-laws/casl): Consent first; implied consent for published work addresses - [Ken anti-spam policy](/anti-spam) ## Sources | Source | URL | Checked | | --- | --- | --- | | GDPR, Regulation (EU) 2016/679, Articles 3, 5, 6, 12 to 15, 21, 77 to 79, 82 and 83 | https://eur-lex.europa.eu/eli/reg/2016/679/oj | 2026-10-17 | | ePrivacy Directive 2002/58/EC, consolidated text, Articles 13 and 15a | https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02002L0058-20091219 | 2026-10-17 | | Italy, Codice in materia di protezione dei dati personali, articles 121 and 130 | https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29.pdf/b1787d6b-6bce-07da-a38f-3742e3888c1d?version=15.0 | 2026-10-17 | | EDPB, members (national data protection authorities) | https://www.edpb.europa.eu/about-edpb/about-edpb/members_en | 2026-10-17 | | CNIL, la prospection commerciale par courrier electronique | https://www.cnil.fr/fr/la-prospection-commerciale-par-courrier-electronique | 2026-10-17 | | EU Court of Justice, C-621/22, judgment of October 4, 2024 | https://curia.europa.eu/juris/liste.jsf?num=C-621/22 | 2026-10-17 | | CNIL, Solocal Marketing Services sanction (2025) | https://www.cnil.fr/fr/sanction-de-900-000-euros-societe-solocal-marketing-services | 2026-10-17 | | CNIL, KASPR sanction (2024) | https://www.cnil.fr/fr/aspiration-de-donnees-sanction-de-240-000-euros-lencontre-de-la-societe-kaspr | 2026-10-17 | | Garante, Wind Tre injunction order (July 9, 2020) | https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9435753 | 2026-10-17 | | European Central Bank, euro foreign exchange reference rates (2026-10-16) | https://www.ecb.europa.eu/stats/policy_and_exchange_rates/euro_reference_exchange_rates/html/index.en.html | 2026-10-17 | | Ken anti-spam policy (sections 4 and 6) | /anti-spam | 2026-10-17 | | Ken Terms of Service (sections 7.1 to 7.3) | /terms | 2026-10-17 | | Ken features: deliverability monitoring and multi-inbox rotation | /features | 2026-10-17 | ## Changelog - 2026-10-17: Page published.