Is B2B cold email legal? GDPR and country rules explained
Short answer
In most of Europe and the US, cold email to business addresses is permitted when it is relevant to the recipient's professional role, identifies the sender, and offers an easy way to opt out; under GDPR this usually rests on legitimate interest. Some countries are stricter and require prior consent even for B2B email, so rules have to be applied per recipient country. This is a practical overview, not legal advice.
Legitimate interest under GDPR
GDPR allows processing personal data, such as a business email address, when you have a legitimate interest that is not overridden by the person's rights. For B2B outreach that generally means the message is relevant to the recipient's job, the data is limited to what you need, and the person can easily object.
On top of GDPR, each country has its own electronic marketing rules, and those differ in how they treat business recipients.
Countries that require prior consent
Several countries treat unsolicited marketing email strictly, even between businesses. Pipestork blocks sending to recipients in Germany, Austria, Italy, Switzerland and Canada for that reason. Requirements change, so check current local rules before targeting a new country.
What every cold email must contain
Whatever the country, a compliant B2B cold email should have:
- +A clear identity: who is sending and on behalf of which company.
- +A postal address for the sender.
- +A simple, working way to opt out, honoured permanently.
- +Content relevant to the recipient's professional role.
- +No misleading subject lines or sender names.
Opt-outs have to stick
An unsubscribe that only applies to one campaign is a common way to get into trouble. Once someone opts out, they should never receive outreach from you again, in any campaign. Pipestork puts a one-click unsubscribe and the sender's postal address in every message and applies opt-outs across all campaigns permanently.
Keep data minimal
Collect only what you need to make the outreach relevant: name, role, company and a verified work address. Avoid personal addresses and sensitive data entirely, and be ready to tell someone where you got their details if they ask.
Have the agents do this for you
Pipestork researches your market from your website, finds verified decision-makers, writes a sequence per prospect and sends it with conservative limits, so you can apply everything on this page without doing it by hand.
Try it with $30 in credits →