Which Outreach Channel Needs Which Consent? The Channel Matrix (Germany)
Postal mail, phone, email, messenger, LinkedIn, display: what the GDPR and German unfair-competition law require per channel — with statutory citations. The lawyer-reviewed overview for cold outreach in Germany.
Not legal advice. This overview describes the legal position in Germany in general terms and is based on a legal assessment commissioned by CegTec (as of July 2025). It is not legal advice, does not replace review of your specific case, and creates no attorney-client relationship. Use at your own risk. CegTec is not a law firm. The provisions cited are German and EU law; other jurisdictions differ.
The question that comes before the channel choice
Almost every discussion about whether outbound is permissible goes wrong because two things get conflated. So first the distinction that sorts out everything else:
Collecting contact data and contacting people are two different questions. Collecting, managing and enriching business contact data is subject to no unfair-competition requirements and is possible under data protection law in pursuit of legitimate interests under Art. 6(1)(f) GDPR, without consent. So anyone researching, enriching and storing a business email address from a public source needs no consent for that.
Whether they may contact the person is decided by the channel — and there the differences are large.
The channel matrix
| Channel | Requirement or limit | Provision |
|---|---|---|
| Postal mail | Permissible, provided it is not exceptionally harassing and the addressee has not previously objected | Art. 6(1)(f) GDPR, Sec. 7(1) sentence 2 UWG |
| Telephone (B2B) | To businesses: at least presumed consent: the nature and content of the advertising must, on the basis of concrete circumstances, bear a factual connection to the addressee’s activity, and the addressee must be able to reasonably expect the contact | Art. 6(1)(f) GDPR, Sec. 7(2) No. 1 UWG |
| Telephone (B2C) | To consumers: prior consent required; high standards for proving it | Art. 6(1)(a) GDPR, Sec. 7(2) No. 1, Sec. 7a UWG |
| Prior consent required, unless all conditions for existing-customer advertising are met. Double opt-in is usually needed as proof | Art. 6(1)(a) GDPR, Sec. 7(2) No. 2, Sec. 7(3) Nos. 1–4 UWG | |
| SMS, messenger | Prior consent required; whether the existing-customer privilege applies is disputed | Art. 6(1)(a) GDPR, Sec. 7(2) No. 2 UWG |
| Display advertising | Prior consent where, due to particular circumstances, it can be experienced as comparably harassing to email spam (example: inbox display advertising) | Art. 6(1)(a) GDPR, Sec. 7(2) No. 2 UWG |
| Professional networks | LinkedIn and comparable platforms: as a rule like messenger advertising. A staged approach on the basis of legitimate interests and within the network’s terms of use is, however, generally possible | Art. 6(1)(f) GDPR, Sec. 7(2) No. 2 UWG, platform terms |
The three rows that matter most
Postal mail is the only consent-free cold-outreach channel. This is the row most underestimated in practice. A letter needs no consent — it only has to stop when an objection arrives, and must not be exceptionally harassing. Anyone with a small, high-value target list where email is legally out has a route here that works without a risk assessment. The drawbacks are practical, not legal: more expensive per contact, slower, harder to measure.
Telephone to businesses works without express consent — but not without a justification. Presumed consent is not a free pass. The test has two parts: a factual connection to the addressee’s activity on the basis of concrete circumstances, and the contact must be reasonably expectable for the addressee. Constellations that typically carry it: calls concerning the core of the business; an offer to a company that needs precisely those goods for ongoing production; a call from a sales representative or manufacturer to a business customer to offer a successor product that replaces or complements the one previously purchased.
Email is the strictest of the three main channels. Prior consent, no B2B relief, and double opt-in as proof in most cases. The only exception is existing-customer advertising under Sec. 7(3) Nos. 1 to 4 UWG — and that requires all four conditions at once: the address was obtained in connection with a sale, the advertising concerns your own similar goods or services, there is no objection, and the right to object is clearly pointed out both at collection and in every message. In cold outreach none of them is met.
What follows for the channel choice
The matrix reads as a ranking by legal effort — it gets easier from the bottom up:
- Postal mail — no consent, just respect objections
- Telephone B2B — no express consent, but a documented factual connection
- Professional networks — a staged approach is possible; no pitch in message one
- Email, SMS, messenger, inbox display — prior consent
Consent is not an obstacle but a component: how to collect it lawfully through ads and your own content is covered in Build consent instead of risking cold email.
That is not a recommendation to sell in this order. Reply rates, cost and scalability run roughly the other way. It is the classification that should precede the channel decision — so that the decision is a conscious one rather than resting on a false assumption about the law.
What happens if email goes out without consent, and what it costs, is covered in Cease-and-Desist for Cold Outreach. The two bodies of law in detail: GDPR and Cold Email. For WhatsApp and SMS specifically: WhatsApp outreach and Section 7 UWG.
Sources
- German Act Against Unfair Competition (UWG), in particular Sec. 7(1) sentence 2 (postal mail), Sec. 7(2) No. 1 (telephone), Sec. 7(2) No. 2 (electronic mail, fax, automated calling machines), Sec. 7(3) Nos. 1–4 (existing-customer advertising) and Sec. 7a (proof of consent for telephone advertising). Numbering per the version in force since the 2021 UWG amendment.
- Regulation (EU) 2016/679 (GDPR), Art. 6(1)(a) (consent) and Art. 6(1)(f) (legitimate interests).
- Legal assessment of the data-protection and unfair-competition requirements for cold outreach in Germany, commissioned by CegTec, as of 22 July 2025. The channel matrix in this article follows that assessment.
The matrix does not apply to Austria and Switzerland: the rules there differ considerably in places — see Cold outreach in Austria and Switzerland.
Common questions
Which outreach channel is permissible without consent?
Postal mail. Advertising by letter is permissible under Art. 6(1)(f) GDPR and Section 7(1) sentence 2 UWG, provided it is not exceptionally harassing and the addressee has not previously objected. It is therefore the only cold-outreach channel that requires no consent. Telephone calls to businesses get by on presumed consent — so they need no express consent either — but are tied to a factual connection.
Why is email regulated more strictly than the phone?
Because German unfair-competition law treats the channels differently. Section 7(2) No. 1 UWG lets presumed consent suffice for telephone calls to business market participants. Section 7(2) No. 2 UWG, by contrast, requires prior consent for advertising by electronic mail, with no such relief — the only exception is existing-customer advertising under Section 7(3) Nos. 1 to 4 UWG.
Do I need consent to research contact data?
No. Collecting, managing and enriching business contact data is subject to no unfair-competition requirements and is possible under data protection law in pursuit of legitimate interests under Art. 6(1)(f) GDPR, without consent. The consent question only arises with the outreach — and then depends on the channel.
Is LinkedIn outreach treated like email?
As a rule like messenger advertising, so the promotional message needs consent. A staged approach on the basis of legitimate interests and within the network's terms of use is, however, generally possible. In practice: connection request and context first, promotional message later — not the pitch in the first message.