cold email in Europe is a country-by-country question

Outbound playbooks written for the US assume one rule for the whole market. Europe has one directive and many national answers. A sequence that is ordinary in Lyon can be an unfair-competition claim in Munich and a regulator complaint in Warsaw. For a security vendor, whose buyers are paid to be careful, the second and third cases cost more than a lost reply.

This guide is a map for planning a funnel. It is not legal advice. Before you run outbound in a country, have someone who knows that country’s law read your process.

two layers of law, and they get confused

Two different rules apply to a cold email, and most arguments about “GDPR and cold email” mix them up.

1. The data layer. The GDPR covers how you collect and use a person’s data, including a named work address like jan.kowalski@company.pl. Recital 47 says direct marketing may be a legitimate interest. That is a possible legal basis for holding the data, with a balancing test and transparency duties attached.
2. The channel layer. The ePrivacy Directive, and each country’s law that implements it, covers whether you may send the marketing email at all. Article 13 requires member states to make email marketing to individuals subject to prior consent. For businesses, it leaves the level of protection to each member state.

Passing the first layer does not answer the second. “We have a legitimate interest” says nothing about whether the country allows the email to be sent without consent.

three countries, three answers

France: allowed, with an easy way out. The CNIL, France’s data protection authority, accepts B2B email prospecting without prior consent when the message relates to the recipient’s professional role. The recipient must be told how their data is used and be able to object, simply and free of charge, in every message. An email about endpoint security to a CISO fits. The same email to the company’s HR manager is harder to defend.

Germany: consent first, for businesses too. Section 7 of the Act against Unfair Competition (UWG) treats email advertising without prior express consent as an unreasonable nuisance, and the rule is not limited to consumers. There is a narrow exception for existing customers who bought something similar and were told they could object. Competitors and recipients can bring claims, and German courts have a long history of hearing them.

Poland: consent first, per channel. The Electronic Communications Law (Prawo komunikacji elektronicznej) has applied since 10 November 2024. Its Article 398 requires prior consent to use email or phone for direct marketing, and it covers business recipients as well as consumers. Consent has to be given for the specific channel: agreeing to emails is not agreeing to calls. Sending without consent also counts as unfair competition under Polish law.

	France	Germany	Poland
First B2B marketing email without consent	Allowed, if relevant to the recipient’s role	Not allowed	Not allowed
What you need	Information on data use and an easy objection in every message	Prior express consent; narrow exception for existing customers	Prior consent, given for the specific channel
Where it comes from	CNIL guidance	§ 7 UWG	Art. 398 Prawo komunikacji elektronicznej

Other countries sit somewhere along this line. Check each market you plan to email before the sequence goes live, and recheck when the law changes, as Poland’s did in 2024.

what this does to the funnel

If your plan for Germany or Poland starts with a cold sequence, the plan has a legal problem before it has a reply rate. The first touch has to come from somewhere else. The options are the ones that build a shortlist anyway:

• Partners who already have the relationship. A local integrator or reseller with existing customers can introduce you within their own customer relationship. Agree in writing who contacts whom and on what basis.
• Events and talks. A conversation at a local security event, followed by an email the person agreed to, starts on the right foot in every country.
• Content that earns the opt-in. A useful guide, a checklist, a scorecard. The person asks for it, gives consent for the channel, and the follow-up is welcome. This is slower and it compounds.
• LinkedIn as a first touch. A connection request or message to a professional profile is a different channel with its own rules and norms. Keep it personal and relevant, and do not move the conversation to email without permission.
• Inbound, answered fast. When someone asks you, reply within the hour. See the first hour after a demo request.

In France and similar markets, cold email can stay in the mix, provided every message is relevant to the role and the opt-out works on the first click.

what to put on paper before a European outbound campaign

1. A country column. For every target account, the country of the recipient, and the channel rule that applies there.
2. A consent record. For every contact in an opt-in country, when and how they agreed, and for which channel. If you cannot show it, do not send.
3. One opt-out list for everything. An objection in one tool must stop every tool, including your partners’ campaigns on your behalf.
4. Data sources you can name. Where each contact came from. Bought lists without a traceable source fail both layers at once.

a question for the next planning meeting

Before setting an outbound target per country, ask: “In which of these countries are we allowed to send the first email, and where does the first touch come from in the others?” The answer changes both the numbers and the budget.