Is B2B Cold Outreach Allowed? The Legal Position Under UWG & GDPR
Is cold outreach allowed in B2B? The legal position in Germany under the UWG and GDPR — what's allowed, what isn't, and how to prospect in a legally sound way.
The short answer
Yes, B2B cold outreach is allowed in Germany — but not without limits. There are clear rules, and ignoring them risks a cease-and-desist warning.
| Channel | Allowed in B2B? | Condition |
|---|---|---|
| Yes | Factual connection + presumed consent | |
| Phone | Yes | Presumed consent |
| Yes | Follow LinkedIn’s ToS, no spam | |
| Post | Yes | Almost no restrictions |
| Fax | No | Only with explicit consent |
Cold email outreach: Section 7 UWG in detail
What the law says
Section 7(2) No. 2 UWG prohibits email advertising without prior explicit consent. That sounds like a blanket ban at first — but there are exceptions.
The B2B exception: presumed consent
In a B2B context, courts accept presumed consent when:
- A factual connection exists: your offer fits the recipient’s line of business
- Business address: you write to a business email, not a private address
- Relevant function: the recipient is professionally responsible for the topic
- Reasonable frequency: no mass mailing to the same contact
- Opt-out available: the recipient can unsubscribe
Practical examples: what’s allowed, what isn’t
Allowed (probably):
- A warehouse management software vendor → the logistics head of an e-commerce company
- A recruiting tool → the HR head of a growing company (currently posting open roles)
- CRM consulting → the sales head of a B2B company without a CRM (identifiable from the tech stack)
Not allowed:
- A catering service → every company in a city (no factual connection)
- Repeated emails after a clear rejection (“Please don’t contact me again”)
- Writing to private Gmail/GMX addresses found in a business context
- Emailing info@ addresses without a specific contact person (disputed, tends to be impermissible)
Cold calling: presumed consent
The same logic, a stricter interpretation
Section 7(2) No. 1 UWG applies to cold calling. Presumed consent is interpreted more strictly for phone calls than for email, because a call is more invasive.
What courts examine:
- Was there a concrete occasion for the call? (job posting, press release, industry event)
- Does the offer fit the line of business?
- Was the right contact person reached?
- Was the time of day appropriate? (business hours)
How to document it correctly
Keep a short note in the CRM for every call/email:
Contact: Max Müller, VP Sales at Company XYZ
Reason: Company posted 3 SDR openings → pipeline building is a current topic
Offer: Outbound automation for B2B sales
Factual connection: Yes (job postings, B2B sales, matching company size)
Date: 2026-04-09
Result: [Interested / Not interested / Not reached]GDPR: the second legal layer
Alongside the UWG, GDPR also applies. The two laws complement each other:
| Aspect | UWG (competition law) | GDPR (data protection) |
|---|---|---|
| Governs | Whether you may advertise | How you handle data |
| Legal basis | Presumed consent | Legitimate interest (Art. 6(1)(f)) |
| Risk on violation | Warning letter (€1,000-5,000) | Fine (€5,000-50,000 for SMEs) |
| Enforced by | Competitors, consumer protection | Data protection authority |
GDPR checklist for B2B cold outreach
- Legal basis: legitimate interest documented (Art. 6(1)(f) GDPR)
- Business data only: no private emails, no private mobile numbers
- Data minimization: only collect the data you need
- Duty to inform: a privacy notice in the email (a link is enough)
- Opt-out: an unsubscribe option in every email
- Deletion: delete data if there’s no interest (or after the retention period)
- Record of processing: list cold outreach in the record of processing activities
Common gray areas
Writing to info@ addresses?
Disputed. Some lawyers argue that info@ addresses are business addresses meant for inquiries. Others see them as general addresses that don’t represent presumed consent from a decision-maker. Recommendation: whenever possible, contact a direct point of contact. Safer, and a higher reply rate.
LinkedIn messages as advertising?
LinkedIn messages don’t fall directly under Section 7 UWG (no email/phone involved). But: LinkedIn has its own Terms of Service, which prohibit spam messages. And with mass outreach, LinkedIn can suspend your account. Recommendation: LinkedIn outreach yes, but personalized and at a reasonable frequency.
Using data from enrichment tools (Clay, Apollo)?
Having the data itself isn’t the problem — using it for advertising is. As long as you follow the GDPR checklist above (legitimate interest, business data, opt-out), using enrichment data for B2B cold outreach is defensible.
Practical tips: prospecting in a legally sound way
- Define your ICP sharply: the better your targeting, the stronger the argument for presumed consent
- Personalize: “I see you’re currently hiring SDRs” is much better than “Dear Sir or Madam”
- Respect opt-out immediately: “Not interested” → add the contact to a suppression list, never contact again
- Document: for every contact: why you’re reaching out, when, the result
- Limit frequency: max. 1 email sequence (3-5 emails over 3 weeks), then pause
- Legal notice in the email: sender name, company, address — mandatory
- Privacy notice: link to your privacy policy in the email signature
Common questions
Is cold email outreach allowed in B2B?
Yes, under certain conditions. Under Section 7(2) No. 2 of the German Act Against Unfair Competition (UWG), email advertising generally requires prior consent. In B2B, however, there is an exception: if there is a 'factual connection' between your offer and the recipient's line of business and the recipient would 'presumably consent,' making contact is permitted. You must write to business addresses and offer an opt-out option.
Is cold calling allowed in B2B?
Yes, with restrictions. Section 7(2) No. 1 UWG permits B2B cold calling under 'presumed consent.' That means: there must be a factual reason to assume that the person called might be interested in your offer (e.g. because it fits their line of business). Purely indiscriminate cold calls are not permitted, even in B2B.
What are the consequences of unlawful cold outreach?
Violations can trigger: 1) A cease-and-desist warning from competitors or consumer protection associations — cost: €1,000-5,000 per warning. 2) An injunction with a contractual penalty (often €5,000-10,000 per repeat offense). 3) GDPR fines from data protection authorities if data protection violations occur at the same time — theoretically up to €20 million or 4% of revenue, in practice €5,000-50,000 for SMEs.
How do I document presumed consent?
For every contact, record: 1) Why you assume there is interest (industry, job postings, tech stack fit your offer). 2) Which business address/number you're contacting. 3) Whether and when the contact expressed interest or declined. 4) That an opt-out option was provided. This documentation helps if a warning letter ever arrives.