How it works

Two sets of rules, not one

The mistake almost everyone makes is treating this as a GDPR question. GDPR governs the personal data: a named person's work address is personal data, so you need a lawful basis to hold and use it, and article 6(1)(f) legitimate interest is usually that basis. But whether you may send an unsolicited commercial email at all is governed separately, by each country's implementation of the ePrivacy Directive. That second layer is where the real variation lives, and it is national law, not EU-wide regulation.

The directive requires prior consent for unsolicited email to natural persons and leaves member states to decide about legal persons. Roughly half took the permissive route and left B2B email to companies on an opt-out footing — the UK, Ireland, France, the Netherlands, Belgium, Sweden, Finland. The rest extended opt-in to everyone. Germany is the strict end and the one that matters commercially, because German competitors bring UWG claims against each other and a cease-and-desist over cold email is a normal event there, not a theoretical risk.

Where legitimate interest actually holds

In an opt-out country, emailing a named person at a business about something connected to their job is a textbook legitimate interest. It holds only while the conditions do. Relevance is the load-bearing one: a message to a CFO about accounting software is defensible, the same list mailed about a fitness product is not, and the difference is not the data, it is whether the recipient would reasonably expect it. The other conditions are procedural — identify yourself, say where you got the address, give a working opt-out, honour it immediately — and they are the ones people skip.

The balancing test has to exist as a record. A legitimate interests assessment is four questions and half a page, and having written it before the campaign is most of what an authority wants to see when a complaint arrives. Writing it afterwards, in response to a complaint, is a different conversation.

Article 14, the clause nobody includes

When you collect someone's data from somewhere other than them — a website, LinkedIn, a directory, a data provider — article 14 says you must tell them, at the latest on first contact, that you hold it, what you are using it for, where you got it, and what rights they have. In practice this is one clause in the first email and a link in the footer: I found your details on your company website, plus a privacy notice link. It costs a line, it is the most commonly missing element in every cold email I audit, and it happens to make the message read as more honest, which is not a coincidence.

Sending from outside Europe

Being in the US, India or Bangladesh does not put you outside the rules. GDPR article 3(2) reaches anyone targeting people in the EU, and the UK GDPR does the same for the UK. Article 27 then requires most non-EU senders to appoint a representative inside the EU and name them where recipients can find them. The exemptions are narrow — occasional processing, low risk — and a systematic outbound campaign into Europe is not occasional by any reading. The practical options are appointing a representative service, or not targeting EU recipients from that entity.

Tracking pixels

An open-tracking pixel writes and reads information on the recipient's device, which several regulators treat as needing its own consent under the same ePrivacy rules that cover cookies. Nobody obtains that consent before a cold email, because obtaining it is impossible. The pragmatic answer for European campaigns is to turn open tracking off, which most experienced senders have done anyway for deliverability reasons — the pixel is a spam signal, and open rates have been unreliable since Apple Mail Privacy Protection started prefetching them.

What this tool is not

It is a structured checklist built from published regulator guidance and national statutes, and it will be out of date before the law is. It does not know your industry, your contract history with the recipient, or whether a national implementation changed last month. Treat a red verdict as a reason to stop and a green one as a reason to keep records, and ask a lawyer in the relevant country before running volume into a consent jurisdiction. For the US, Canadian and Australian side of the same message, the CAN-SPAM checker covers CAN-SPAM, CASL and the Spam Act.

Frequently asked questions

Last reviewed September 19, 2026