- Oct 15, 2026
- 4 min read
Is B2B Cold Email Legal? The EU, the UK and the US for a Small EU Business
I had a website audit tool that finds real, measurable problems on small business websites, and a plan: scrape business listings, enrich them with an email address, and send each business one useful finding. Before writing a line of the scraper I checked where that would be legal.
This is my reading of the rules for a sole trader based in Poland, written so I remember the reasoning. It isn’t legal advice; if money depends on it, an hour with a lawyer is worth it.
Two separate rulebooks
Cold email touches two different sets of rules, and mixing them up is the most common mistake I found in “is cold email legal?” articles:
- Electronic marketing rules (the ePrivacy family): may you send a commercial message by email at all? They depend on where the recipient is.
- Data protection (GDPR): may you collect and use this contact data? It applies to you as an EU-based business, wherever the recipients are.
“It’s public business information” helps with the second at most. It doesn’t touch the first.
Country by country
| Recipients in | Business-to-business cold email | Conditions |
|---|---|---|
| Poland (Electronic Communications Law, since Nov 2024) | Prior consent required, B2B included; phone marketing too | A first email asking for consent is generally treated as unsolicited marketing itself |
| Spain, Germany, Italy | Prior consent required | Spain’s regulator fines small senders a few thousand euros per complaint; in Germany, lawyers’ cease-and-desist letters cost €1–2k each |
| France, Ireland, Netherlands (legal entities) | Opt-out regimes for B2B, as far as I can tell | Must be relevant to the recipient’s role; check each country |
| United Kingdom (PECR) | Allowed to companies (Ltd, LLP, PLC) | Don’t hide who’s sending; give a working opt-out. Sole traders and partnerships need consent |
| United States (CAN-SPAM) | Allowed (opt-out) | Truthful sender and subject, an unsubscribe honoured within 10 business days, and a valid postal address in every email |
| Canada, Australia | Consent-based | Skip unless you know the rules well |
The uncomfortable conclusion for me: my home market and my Spanish network were exactly the places I couldn’t email.
What GDPR still asks, whatever the country
As an EU business, my own processing of the contact data falls under GDPR even when the recipients are in London or Texas:
- A lawful basis: legitimate interest, written down once as a short assessment (purpose, necessity, balancing, safeguards).
- Transparency: say where the data came from if asked, and link to a privacy notice that names the data controller.
- Minimisation: business name, website, one business email, the city. Nothing else.
- Retention: delete people who don’t reply after a set time (I use 90 days); delete objectors immediately but keep their address on a do-not-contact list.
What the fines look like
| Rule | Maximum | In practice, for a small sender |
|---|---|---|
| GDPR | €20M or 4% of turnover | Proportionate; but there is a Polish precedent of a large fine for scraping public registers without informing people |
| Polish PKE | Up to 3% of revenue (as I understand it) | Complaint-driven |
| Spain (LSSI) | €30k / €150k | A few thousand euros per case |
| US (CAN-SPAM) | ~$50,000 per non-compliant email | Rare for compliant senders; brutal for sloppy ones |
The fine was not what worried me most. Two other risks were bigger:
- Your email provider. Transactional providers forbid scraped lists. A suspension takes down every confirmation and receipt your business sends.
- Your name on a complaint. Regulators write to a person, not a brand.
Where I landed
- UK companies only, from a separate domain and sender, never from the main business’s email setup (why that separation matters is the next post).
- The US later, once a postal address can go in every email.
- No EU cold email. For EU businesses, the legal routes are in person, by post (printed reports are unusual enough to get read), or content that makes them come to you.
Takeaways
- Two rulebooks: marketing rules depend on the recipient’s country, GDPR on yours.
- “Public business data” isn’t consent.
- Check the market before building the scraper. It decides everything downstream: data sources, filters, wording, even which domain sends.