Cold Email Allowed? GDPR Rules for B2B in 2026

GDPR and Cold Email: The Legal Reality in Germany in 2026

Is this allowed? Short answer: yes, under conditions — not unconditionally. B2B cold email in Germany is legally complex, but not a black box. There are two legal layers that both have to be satisfied at the same time, plus a practical reality that many practitioners aren’t clear on.

This article is the sober version: what actually applies, what courts have ruled, and which setups work in practice. For phone-based cold calling, see Cold Calling Legal Rules DACH; for cold email specifically, see B2B Cold Email Legal Situation; and for the broader GDPR picture, see B2B GDPR Guide.

The Two Legal Layers

Cold email touches two laws at once. Both have to check out, or the email is unlawful.

Layer	Law	What it governs
Data processing	GDPR (Art. 6)	Are you allowed to store and process the email address?
Advertising contact	UWG (Section 7)	Are you allowed to send the recipient a promotional email?

Common mistake: “I have legitimate interest under GDPR, so I’m allowed to send.” Wrong — legitimate interest only justifies the data processing. The email itself has to be checked against the UWG, and that’s the stricter standard.

What Section 7 UWG Says

Advertising by electronic mail is, in principle, only permissible with the recipient’s prior explicit consent. Exceptions:

• An existing business relationship
• Products/services similar to those previously purchased
• A clear opt-out option

How to build consent through ads and your own content instead of sending without it: Build consent instead of risking cold email.

For pure B2B cold outreach there is no UWG exception. Legitimate interest under Art. 6(1)(f) GDPR carries the data processing, not the sending — Section 7(2) No. 2 UWG knows no legitimate-interest ground. A clear connection to the recipient’s professional role reduces the practical likelihood of someone acting on it; it does not make the sending permissible.

What Courts Have Ruled

German case law on B2B cold email is inconsistent. Tendencies 2024-2026:

Case pattern	Tendency
Highly relevant to the role (e.g., a CFO gets an email about a treasury tool)	still impermissible, but the lowest practical risk
Generically broad (e.g., “marketing solution” sent to HR)	impermissible
With tracking pixel, no consent	impermissible
Multiple follow-ups without a reply	critical
No clear sender identity	impermissible
Personalized with a clear business connection	tends to be permissible

Important point: even an email that “tends to be permissible” can still draw a cease-and-desist letter — the question then is whether the court follows that interpretation or not. Anyone seriously running cold email lives with residual risk.

A Practical Setup That Works

Mandatory elements in every cold email

1. Clear sender — name, company, role. No pseudonyms, no “Sales Team” as sender.
2. Working reply address — no noreply@, no generic address with nobody behind it.
3. Connection to the recipient’s role — the email must be recognizably relevant to their professional role.
4. Opt-out — a simple line in the footer: “If you don’t want any further emails, just reply with STOP — I’ll respect that.”
5. Privacy notice — a short sentence with a link to the privacy policy.
6. Imprint — mandatory in every business email.
7. No tracking pixel — disable open tracking and click tracking without consent.

Tool configuration for compliance

If you use Instantly, Lemlist, Smartlead, or similar tools:

Setting	What to do
Open tracking	Disable for DACH recipients
Click tracking	Disable, or use only on clear CTAs after opt-in
Unsubscribe link	Enable, worded in German
Reply detection	Keep enabled — further emails to recipients who replied are impermissible
Sender domain	Your own domain, no free provider

ICP definition as a compliance tool

The more precise your targeting, the stronger the legitimate-interest argument. An email to “all CMOs in DACH” is weaker than an email to “CMOs at SaaS companies with Series A through C funding rolling out marketing automation.”

What Happens When Something Goes Wrong

Three escalation levels:

1. Recipient marks it as spam — the email provider blacklists the domain, sender score drops. The most common and most expensive case in practice.
2. Recipient files a complaint — this may end up with the data protection authority or a competition association.
3. Cease-and-desist by a competitor or consumer protection body — costs €500-2,500, a cease-and-desist declaration, and contractual penalties on repeat offenses.

Fines from supervisory authorities are rarer on first offenses than the first two cases, but theoretically possible.

Short Checklist

• Highly relevant targeting, clear connection to the recipient’s role
• Clear sender with name and role
• Reply address works and is monitored
• Tracking pixel disabled
• Opt-out in the footer, worded in German
• Privacy notice with a link
• Imprint linked
• Reply detection enabled (no further emails after a reply)
• Maximum 3-4 follow-ups, then stop
• Your own sender domain, no free provider

Conclusion

GDPR and cold email are not mutually exclusive. But anyone systematically running cold email in Germany in 2026 has to satisfy the UWG and GDPR at the same time, disable tracking, target precisely, and live with residual risk. That’s doable — but not as trivial as many US tools suggest.