Is Cold Email Legal in Germany? UWG, GDPR and the B2B Outreach Rules Explained

Cold email to businesses in Germany without the recipient's prior express consent is unlawful. The rule comes from Section 7 of the Act against Unfair Competition, the Gesetz gegen den unlauteren Wettbewerb or UWG, which treats advertising by electronic mail without prior express consent as an unreasonable nuisance. Unlike the rules in the US (CAN-SPAM) or the UK's business-to-business carve-out, the German rule makes no distinction between consumers and companies. A single unsolicited email to a company address can be enough: the Federal Court of Justice confirmed in 2009 that one advertising email to a business is already an unreasonable nuisance.

Cold calling is restricted differently. Calls to consumers require prior express consent. Calls to businesses require at least the recipient's 'presumed consent', which courts read narrowly: you need concrete grounds to assume that this particular company has a real interest in this particular call about this particular offer, not just that it belongs to an industry that buys what you sell. Fax and automated calling machines require express consent for everyone. Postal mail is the one traditional channel that is broadly allowed, unless the recipient has made clear they do not want it.

Almost everything a sales team sends. German courts read advertising broadly as any communication intended to promote the sale of goods or services, directly or indirectly. That includes the 'quick question' email, the 'I noticed you visited our site' email, the request for a fifteen-minute call, the newsletter, and the invitation to a webinar. It also includes, and this one catches many teams, the email asking for permission to send information. The Federal Court of Justice held in 2011 that an email requesting consent to advertise is itself advertising and therefore needs the consent it is asking for. You cannot bootstrap consent by email.

Several courts have applied the same logic to messages sent through social networks and messengers, treating a LinkedIn or XING message that promotes a product as electronic mail for these purposes. A connection request with no sales content is generally treated as less problematic, but a personalised pitch through InMail at scale is not obviously safer than email, and the platforms' own rules add another layer.

Section 7(3) UWG allows advertising email without express consent when four conditions are all met: you obtained the email address from the customer in connection with the sale of a product or service; you use it to advertise your own similar products or services; the customer has not objected; and you clearly told them at collection and in every message that they can object at any time without cost beyond basic transmission charges. This covers cross-selling to people who have already bought from you. It does not cover prospects, leads from a purchased list, or contacts who downloaded a white paper.

Many outbound teams believe that because the GDPR permits processing personal data for direct marketing under legitimate interest, cold email to business contacts is fine. That confuses two separate laws. The GDPR governs whether you may process a person's data at all, and Recital 47 does recognise direct marketing as a potential legitimate interest. The UWG governs whether you may send the unsolicited message. Satisfying the first does not license the second. A business contact's name, role and work email are personal data, so the GDPR applies on top of the UWG, not instead of it.

The GDPR then adds its own duties. If you obtain contact data from a source other than the person, a purchased list, a scrape, an enrichment tool, Article 14 requires you to inform them within a month about who you are, what you hold and why, and how to object, and they can object to marketing at any time under Article 21, after which you must stop. Consent, where you rely on it, must be freely given, specific, informed and unambiguous: pre-ticked boxes and consent bundled into terms and conditions are invalid, as the European Court of Justice confirmed in the Planet49 case. The practical standard in Germany is double opt-in with a logged confirmation, because you carry the burden of proving consent if challenged.

Germany does not rely on a regulator to police cold email. It relies on the Abmahnung, the formal cease-and-desist letter, which competitors, industry and consumer watchdog associations such as the Wettbewerbszentrale, and the recipients themselves can send. The letter demands that you sign a declaration to stop, with a contractual penalty, commonly several thousand euros, payable for each future violation, and that you reimburse the sender's legal costs, typically several hundred to a couple of thousand euros for a first email. Ignore it and the next step is a court injunction, with more costs. Recipients can also sue directly for injunctive relief on the basis that unsolicited advertising interferes with their business operations, and courts routinely grant it.

Cold calls have a regulator as well: the Bundesnetzagentur, the Federal Network Agency, can fine unlawful telephone advertising with up to 300,000 euros per case. Data protection authorities can fine GDPR breaches with up to 20 million euros or 4% of global turnover, though in practice B2B cold outreach draws Abmahnungen far more often than regulator fines. And the reputational cost is real: German buyers know the rules, and a vendor that breaks them in its first contact has demonstrated exactly the kind of carelessness that German procurement screens for.

The honest risk assessment for a foreign company is this: a small cold campaign to German businesses will probably not draw a regulator. It may well draw an Abmahnung, particularly if you email anyone at a competitor or a law firm, and it will certainly signal to the people who do reply that you did not do your homework.

Email: closed without prior express consent, with the existing-customer exception above. Phone: open to businesses only where you can point to a specific, case-based presumed interest, which does not cover list-based cold calling at scale. Fax and automated calls: closed. Post: open, and German companies still read a well-written letter. LinkedIn and XING: connection requests are tolerated in practice, promotional messages carry the same risk as email. Inbound: open, and consent captured on a form with a clear, unbundled marketing checkbox and double opt-in is the cleanest base for follow-up you can have.

Events and trade fairs: open, and one of the most productive channels in the country. A conversation at a booth, with a badge scan and an explicit note that you may follow up, gives you both a relationship and a defensible basis for contact. Partners and resellers: open, because a Systemhaus or consultancy contacting its own customers about your product is working inside existing relationships. Referrals and warm introductions: open, and the channel every German sales veteran actually uses, because the buyer says yes to the conversation before you send anything.

Look at what the law forbids and what it permits, and a pattern appears. Germany forbids contact that the buyer did not ask for and permits contact inside a relationship the buyer already has. That is a legal description of how German B2B has always worked culturally. Business runs on Empfehlung, the recommendation, through trade associations, supplier networks, the IHK, former colleagues and long-standing advisors. We explain the cultural side in B2B Sales in Germany: How German Companies Buy; the legal side simply reinforces it.

A warm introduction inverts the sequence that the UWG regulates. Instead of the vendor contacting the buyer and hoping for consent, someone the buyer already knows asks whether they would like to talk to the vendor, and the vendor's first message goes to a person who has already said yes to that conversation. That is not a loophole; it is the ordinary way a German Geschäftsführer expects to meet a new supplier. The problem for a company entering the market has never been the legality of introductions. It has been that you do not have anyone to make them.

Bountii is a marketplace for exactly those introductions. You post the German accounts you want as named bounties, specify the title that counts and what a qualified meeting looks like, and set a bounty per meeting. Vetted hunters based in Germany, experienced sellers, consultants and industry operators with existing relationships in your vertical, claim the accounts where they genuinely know someone, and ask that person whether they will take the meeting. Both sides opt in: you approve the hunter, and the buyer agrees to the conversation before you are ever in contact.

The meeting runs on a Bountii link, so attendance and duration are verified rather than reported, and you pay only after reviewing it against the criteria you locked at posting. Bountii takes 0% of the bounty; hunters keep all of it. Plans run from 199 dollars a month for ten target accounts, and a qualified meeting with a Mittelstand decision-maker typically clears at 400 to 700 dollars, paid on success. Compare that with the cost of a German sales hire, a sequencing stack you cannot lawfully point at German inboxes, and the first Abmahnung.

For compliance teams, the model is also easy to document. Your first outreach to any German buyer is a reply to a meeting they accepted, with a timestamped record of the introduction and the acceptance. That is a stronger consent trail than most inbound forms produce.

One: take the German contacts out of your cold email tool, and if you bought or scraped them, deal with the GDPR information duty or delete them. Two: rebuild inbound consent capture with an unbundled marketing checkbox, double opt-in and a log. Three: pick the two or three trade fairs where your buyers actually stand and treat every badge scan as a relationship, not a list entry. Four: for the accounts that matter, the named companies you want in the pipeline this quarter, use introductions, through partners, advisors and a bounty board, rather than sequences. Five: write down what a qualified meeting is before you start, so that every channel is measured on the same outcome.

Companies can book a demo now and post their first German bounties from 19 October 2026. If you sell, consult or operate in Germany and know the buyers in your industry, sign up as a hunter: founding hunters keep 100% of every bounty permanently, and companies that can no longer cold email your contacts are willing to pay for the introduction you can make in one message.