Cold Outreach in Europe: The Country-by-Country Email and Calling Rules for B2B Sales (2026)

Most sales teams discover European outreach law the same way: a sequence that worked in the US goes out to a list of European contacts, and somewhere between the second step and the fourth a reply arrives that is not from a buyer. In Germany it is a lawyer's letter. In France it is a complaint to the regulator. In the Netherlands it is a prospect pointing out that the unsubscribe link does not work. The team then asks the question it should have asked first: what are the rules here, and do they change at every border?

They do. The European Union set a floor for electronic marketing in 2002 and let each member state decide whether businesses, as opposed to people, get the same protection. Some said yes, some said no, and the non-EU countries that matter for B2B sales, the United Kingdom, Switzerland and Norway, each wrote their own version. The result is a map with two colours and a lot of footnotes. This guide draws the map. It is general information for business readers as of October 2026, not legal advice, and you should have counsel in each country check a campaign before it runs. If Germany is your main concern, the German cold email rules are covered in depth separately; this post treats Germany as one country among many.

The first is the ePrivacy Directive, specifically Article 13. It requires prior consent, opt-in, before sending marketing by email, SMS or automated calling to a natural person. It then allows each member state to decide how to protect legal persons, meaning companies. That single sentence is why the continent splits in two: countries that extended opt-in to businesses, and countries that let you email a business address until it objects.

The second is the GDPR. It does not ban cold email; it governs the personal data behind it. A named contact's work email address is personal data. Processing it for prospecting needs a lawful basis, which for B2B is almost always legitimate interest under Article 6(1)(f), with a documented balancing test. Article 14 requires you to tell people where you got their data within a month of collecting it, if you did not get it from them, which is why scraped lists are a liability and why good European sequences include a one-line source statement. Article 21 gives every contact the right to object to direct marketing, and that objection is absolute: once made, you stop.

The third is each country's unfair-competition or marketing law, which is where the real teeth are. Germany's UWG, Austria's TKG, Switzerland's UWG, Denmark's Marketing Act, Poland's electronic services law. These are the statutes that make a cold email actionable by a competitor or a regulator regardless of what your GDPR paperwork says. When people say "GDPR allows B2B cold email", they are usually right about the GDPR and wrong about the law that actually applies.

Three questions sort any campaign: is the recipient a natural person or a legal person; which country's law applies, which is the recipient's, not yours; and which channel are you using. Answer those and the map below gives you the colour.

Germany. Unsolicited advertising email to a business without prior express consent is unlawful under Section 7 UWG. There is no B2B carve-out, enforcement is by competitors and trade associations through cease-and-desist letters with costs attached, and the one real exception is existing customers for similar products. Austria follows the same logic under its telecommunications law and adds a register of addresses that must never be emailed. Switzerland is not in the EU but its unfair competition act treats mass advertising email without consent the same way, with a criminal provision behind it.

Denmark applies opt-in to everyone under the Marketing Act and its consumer ombudsman has fined companies for B2B emails. Poland requires consent for commercial electronic communication to any recipient. Italy's data protection authority, the Garante, has repeatedly fined companies for B2B prospecting to named contacts without consent, and the safe reading of Italian law is opt-in even where the address belongs to a company. Spain's information society law requires consent for commercial email, with a narrow exception for existing customers; Spanish practice around generic company addresses is more relaxed, but a named person at a company is protected. Norway, outside the EU but inside the European Economic Area, requires consent for marketing email to individuals, including individuals at companies, while allowing it to genuinely impersonal addresses such as a company's general inbox.

In this group the practical answer is that cold email to named people does not work as a channel. Not because it never gets replies, but because every reply carries a risk the deal cannot pay for.

The United Kingdom. Under the Privacy and Electronic Communications Regulations, corporate subscribers, meaning limited companies and similar, can be emailed without prior consent, provided you identify yourself and offer a working opt-out. Sole traders and partnerships count as individuals and need opt-in. Email to a named person at a company is still processing personal data under UK GDPR, so the legitimate-interest and notice duties apply.

Ireland implements the directive with the same corporate carve-out: legal persons can be emailed on an opt-out basis. The Netherlands allows unsolicited email to businesses provided the sender is identified and an opt-out is honoured, and the regulator has focused enforcement on consumer spam and on sole traders, who are protected as individuals. Belgium allows email to legal persons at impersonal addresses without consent, while a named person's address at the same company needs a stronger justification.

France is the most important opt-out country for most teams and the most misunderstood. The regulator, the CNIL, accepts B2B prospecting by email without prior consent when the message goes to a professional address, concerns the recipient's professional role, identifies the sender and includes a simple way to object. Send a sales email about accounting software to a finance director at her work address and you are inside the rule; send it to her personal address, or send an unrelated offer, and you are not. The CNIL has fined prospecting companies, but for failing to inform people and honour objections, not for the act of B2B emailing itself.

Sweden and Finland allow marketing email to people at companies when it relates to their role, on an opt-out basis. Portugal protects legal persons on an opt-out basis. In every country in this group the three conditions are the same: say who you are, make the opt-out real, and keep a suppression list that actually suppresses.

Across most of Europe a live human calling a business number about a relevant product is lawful without prior consent. The directive's opt-in rule for calls covers automated dialling systems and consumer lines, and most countries left business-to-business voice calls on an opt-out footing. France lets you call businesses freely; its do-not-call register, Bloctel, is for consumers. Spain, Italy, Ireland, Belgium and the Nordics are broadly similar for business lines, with registers that apply to individuals.

The exceptions are the countries that treat email strictly. Germany requires at least the recipient's presumed consent for a business call, which courts read narrowly as concrete grounds to believe this company wants this call about this offer. Austria requires consent. Switzerland lets anyone opt out through an asterisk in the phone directory, and calling a starred number is an offence. The United Kingdom allows business calls but requires screening against the Corporate Telephone Preference Service, and the regulator has fined companies for not doing so. The Netherlands moved consumer calling to opt-in in 2021 and extended the protection to sole traders.

One rule holds everywhere: a mobile number belonging to a person is treated like the person, not the company. Calling a founder's mobile from a scraped list is consumer-style calling in most countries, whatever the company's legal form.

LinkedIn messages are the one outbound channel open in every European country, because in most readings a message sent inside a platform the recipient chose to join is not "electronic mail" under the directive. That does not make it lawless. Processing a person's profile data to decide to message them is still GDPR, legitimate interest still has to be documented, and an objection still has to be honoured. LinkedIn's own rules on automation and message volume are enforced more quickly than any regulator, and a restricted account mid-campaign is its own kind of fine.

What changes across borders is tone rather than law. A connection request with a sales pitch in it is ignored in Stockholm, deleted in Munich, and occasionally answered in Dublin. A request with no pitch, followed a week later by a message that references something true about the person's company, works better in all three.

Buy or build lists in Europe and three duties follow. First, a written legitimate-interest assessment for prospecting: what you are doing, why it is necessary, what the impact on the person is, and why your interest outweighs it. It is a page, it takes an afternoon, and it is the first thing a regulator asks for. Second, the Article 14 notice: within a month of adding a person's data, tell them where you got it and how to object. A sentence at the foot of the first email satisfies this in opt-out countries; in opt-in countries you cannot send that email in the first place, which is the trap. Third, suppression: a list of everyone who has objected, checked before every send and every call, and shared with any agency working on your behalf.

If the data is processed outside the European Economic Area, by a US sales tool for instance, Chapter V of the GDPR applies and you need a transfer mechanism, usually standard contractual clauses or a provider that is certified under the EU-US Data Privacy Framework. Most mainstream outbound platforms are; check before you upload a European list rather than after.

The fear is a GDPR fine with a percentage of global turnover attached. The reality for B2B prospecting is smaller and more frequent. In Germany the risk is a competitor or a trade association serving a cease-and-desist with a penalty clause and a bill for their lawyer, repeated for every subsequent email. In France the CNIL publishes decisions against prospecting firms, typically for missing notices and ignored objections, with fines in the tens of thousands to low millions of euros. In Italy the Garante has fined telemarketing and prospecting operations at the same scale. In the UK the Information Commissioner fines under PECR, most often for calls to numbers on the preference services.

The cost that does not appear in any decision is reputational. European B2B markets are small, buyers talk to each other, and an unlawful sequence sent to a national industry association's member list becomes a story at the next conference. For a company entering a market, that is the fine that matters.

Warm introductions. An email from someone the buyer knows, asking whether they would take a call, is not advertising email in any European statute, because it is sent by a person with an existing relationship about something they believe is relevant, with no mass element and no sender trying to sell. It is also, independent of the law, the highest-converting first touch in B2B. Why warm intros convert better has the numbers; the short version is that introduced meetings hold at roughly double the rate of cold-sourced ones.

Partners and resellers. In the strict countries, the local partner is both the compliant channel and the credible one. A German reseller can call a German company; you cannot. Events. Europe runs a dense calendar of industry events where a conversation starts a relationship that makes the follow-up lawful: a business card handed over is the consent that unlocks the sequence in most readings, as long as the follow-up stays on the topic discussed. Inbound in the local language, which costs little and is the one channel the law never restricts.

Then there is sequencing by country. Teams that treat Europe as one territory send the same campaign everywhere and get the worst of each rulebook. Teams that enter one country at a time can tune channel, language and timing to it. The market-entry guides for Germany, France, Spain and Italy each take one country from first meeting to first customer. One timing note that applies everywhere: August is closed in southern Europe and the Nordics, the week between Christmas and Epiphany is closed in most of the continent, and a sequence that starts in those windows is measured on silence.

Bountii is a pay-per-meeting marketplace. A company posts a bounty, a written definition of the meeting it wants and a price per qualified held meeting, and independent hunters who already know people inside the target accounts make the introduction. The company pays for meetings that take place and pass review, and nothing for outreach, which in Europe means nothing for a channel it may not have been allowed to use anyway.

For European expansion this solves the problem the law creates. The hunter who introduces you to a Munich procurement head is a person with a relationship, not a sender of advertising email. The hunter in Lyon speaks to the buyer in French about something she already knows the buyer cares about. The company sets the countries, the titles and the price, reviews each meeting within 48 hours, and scales the countries that produce. There is no list to notice, no suppression file to maintain and no cease-and-desist to budget for. See how companies use it, or read the pay-per-meeting guide for the model in full.

Classify every contact by country and by natural or legal person before anything is sent. Treat Germany, Austria, Switzerland, Denmark, Poland, Italy, Spain and Norway as opt-in for email to named people. Treat the UK, Ireland, the Netherlands, Belgium, France, Sweden, Finland and Portugal as opt-out, with identification, a real opt-out and a role-relevant offer. Keep a legitimate-interest assessment and an Article 14 notice on file. Screen calls against the UK's corporate preference service and Switzerland's directory, and do not cold call Germany or Austria. Keep one suppression list across every channel and every agency. Check your tools' data-transfer status. Put warm introduction, partner and event channels ahead of cold channels in the strict countries, and run one country at a time. Then have local counsel read the sequence before it goes out, because this list is a map, not a licence.