Article 13(5) of the ePrivacy Directive lets each country decide how to protect companies from unsolicited email. Twenty years on, the result is a patchwork. Roughly 13 of 31 countries require prior consent even for B2B cold email, including Germany, Italy, Spain and Poland. About 11 allow email to legal persons with an opt-out, though several of those protect named employees as individuals. For about 5 countries we could not pin down the treatment of legal persons from primary or tier-one secondary sources.
The GDPR applies on top everywhere: a legal basis (in practice legitimate interest), an Art. 14 notice, and an unconditional right to object. See GDPR and ePrivacy. The recipient's country decides. See Germany for a Belgian sender sued in Düsseldorf.
How to read the matrix
- B2B to companies: can you cold email a business contact without prior consent?
- Opt-out: yes, with identification and an opt-out.
- Opt-in: no, consent is needed (the soft opt-in for existing customers aside).
- Generic only: yes, but only to the company's impersonal addresses (
info@). Named people need consent.
- Named employee / sole trader: how a personal work address or a one-person business is treated.
- Conf.: our confidence in the row. H = statute or tier-one source states the B2B position explicitly. M = inferred from the statute's wording ("subscriber", "anyone") or the sources conflict. L = no reliable source found.
Primary secondary sources: DLA Piper Data Protection Laws of the World, electronic marketing chapters (fetched 5 Oct 2026, URL pattern dlapiperdataprotection.com/index.html?t=electronic-marketing&c=XX), and ICLG Data Protection 2025–26 chapters, question 10.2.
The matrix
| Country | B2B to companies | Named employee / sole trader | Legal basis | Notes | Source | Conf. |
|---|---|---|---|---|---|---|
| Austria | Opt-in | Consent | TKG 2021 §174 | Soft opt-in also requires checking the RTR/WKO Robinson lists | DLA AT | H |
| Belgium | Generic only | Consent | Code of Economic Law, Book XII | Exception for "legal persons (e.g. to a general email address)"; DPA recommendation 1-2025 in consultation | DLA BE | M |
| Bulgaria | Unclear | Consent (natural persons) | Electronic Communications Act | Opt-in mandatory for natural persons; legal persons not addressed | DLA BG | L |
| Croatia | Unclear | Unclear | Electronic Communications Act | DLA chapter lists no rules beyond GDPR | DLA HR | L |
| Cyprus | Opt-out | Consent | Law 112(I)/2004 s.106 | Consent rule applies to natural-person subscribers; legal persons covered by a 2005 Order | DLA CY | M |
| Czechia | Opt-in | Consent | Act 480/2004 (CSIS) | No B2B carve-out stated; message must be tagged as commercial | DLA CZ | M |
| Denmark | Opt-in | Consent | Marketing Practices Act | Trader "must not approach anyone" by email without prior consent | DLA DK | M |
| Estonia | Opt-out | Consent (natural persons) | Electronic Communications Act | "If the addressee is a legal person, the opt-out system is applicable" | DLA EE | H |
| Finland | Opt-out | Consent unless offer "substantially related" to job duties | Act on Electronic Communication Services | Generic addresses fine; personal work address only if role-relevant | DLA FI | H |
| France | Opt-out | Allowed if related to profession | CPCE L.34-5 + CNIL | Generic addresses outside the rules; CNIL fines actively. See France | CNIL | H |
| Germany | Opt-in | Consent | UWG §7(2) Nr. 2 | One email is actionable; enforced via Abmahnung. See Germany | DLA DE | H |
| Greece | Opt-in | Consent | Law 3471/2006 art. 11 | "Prior express consent"; position on legal persons not spelled out | DLA GR | M |
| Hungary | Generic only | Consent (any natural person, B2B or not) | Act XLVIII/2008 | Opt-in "triggered by the recipient being a natural person"; legal persons as such outside | ICLG HU | M |
| Ireland | Opt-out | Allowed if address used mainly for business and message relates solely to it | S.I. 336/2011 | Customer soft opt-in limited to 12 months from sale | DLA IE | H |
| Italy | Opt-in | Consent | Privacy Code s.130 | Consent must be recorded with date and person | DLA IT | H |
| Latvia | Unclear | Unclear | Law on Information Society Services | DLA chapter lists no derogations | DLA LV | L |
| Lithuania | Opt-in | Consent | Electronic Communications Law art. 81 | Restrictions "apply to ... both B2C and B2B" | ICLG LT | H |
| Luxembourg | Unclear | Unclear | Law of 30 May 2005 | DLA: "no specific provisions" | DLA LU | L |
| Malta | Opt-in | Consent | S.L. 586.01 | Applies "irrespective of whether ... natural person or a legal person"; consent "in writing" | DLA MT | H |
| Netherlands | Narrow opt-out | Consent | Telecommunicatiewet art. 11.7 | B2B exemption only for "designated" business contact details, "applied very strictly" | ICLG NL | M |
| Poland | Opt-in | Consent | Electronic Communications Law art. 398 | Covers subscribers and end-users, explicitly B2B | ICLG PL | H |
| Portugal | Opt-out | Consent (natural persons) | Law 41/2004 (amended) | Legal persons can register on a non-subscribers list | DLA PT | H |
| Romania | Opt-in | Consent | Law 506/2004 | "Expressly consented in advance" by subscriber or user | DLA RO | M |
| Slovakia | Opt-in | Consent | Act 452/2021 | Keep consent proof 4 years after withdrawal; confirm withdrawal within 30 days | DLA SK | H |
| Slovenia | Opt-in (likely) | Consent | ZEKom-2, ZEPT | "Consent of an individual is required"; legal persons not spelled out | DLA SI | L |
| Spain | Opt-in | Consent | LSSI 34/2002 | Consent required "also where the recipient is a legal entity"; "PUBLI" in subject; fines usually €30k–150k | DLA ES | H |
| Sweden | Opt-out | Consent (natural persons, incl. sole traders) | Marketing Act s.19 | ICLG: consent rule "only applicable in business-to-consumer"; GDPR still covers employees | ICLG SE | M |
| Iceland (EEA) | Opt-in (likely) | Consent | Electronic Communications Act 70/2022 | "Subscriber" prior informed consent; legal persons not separated | DLA IS | M |
| Liechtenstein (EEA) | Unclear | Unclear | Kommunikationsgesetz (unverified) | No source retrieved | n/a | L |
| Norway (EEA) | Generic only | Consent, incl. "individual email address at work" | Marketing Control Act s.15 | Natural-person rule reaches named work addresses | ICLG NO | H |
| Switzerland | Opt-in | Consent | Unfair Competition Act (UCA) | Applies to "mass advertising", B2C and B2B alike | DLA CH | H |
| UK (reference) | Opt-out | Sole traders: consent | PECR reg 22 | See UK: PECR and DUAA 2025 | ICO | H |
Rows marked L, plus the legal-person position in Bulgaria, Greece, Romania, Czechia, Slovenia and Iceland, are inferred from statute wording, not from an explicit source statement. In Liechtenstein, the DLA Piper URL returned another country's chapter. Have local counsel confirm before hard-coding these rows into product logic.
The UCA targets "mass advertising". Whether a single, individually written prospecting email falls outside it is debated. We did not verify a source on that point.
The pattern
| Tier | Countries | What a sequencer should do |
|---|---|---|
| Opt-out to companies | France, Ireland, Sweden, Estonia, Finland, Portugal, Cyprus (+ UK) | Allow; insert Art. 14 notice + opt-out; check role relevance (FR, FI, IE) |
| Generic / narrow only | Belgium, Norway, Hungary, Netherlands | Allow for info@-type addresses; flag named addresses as consent-required |
| Consent required | Germany, Austria, Italy, Spain, Poland, Denmark, Malta, Slovakia, Lithuania, Czechia, Romania, Greece, Switzerland (+ likely Iceland, Slovenia) | Block or hard-warn unless a consent record exists |
| Unclear | Croatia, Latvia, Luxembourg, Liechtenstein, Bulgaria (legal persons) | Treat as consent-required by default |
By GDP the consent-required tier includes Germany, Italy, Spain, Poland, Austria, Denmark and Switzerland. Those are most of the continent's large B2B economies outside France, the UK and the Nordics.
Contradictions and gaps in the record
- Sweden. DLA Piper says the Marketing Act rules apply "to natural persons as well as to legal entities". ICLG says the consent requirement is B2C only (DLA SE vs ICLG SE). We read the DLA line as referring to the identification and valid-address duty, and treat Sweden as opt-out for legal persons.
- Netherlands. It is usually described as "opt-out for legal persons". ICLG describes a much narrower B2B exemption for "designated" contact details. We use the stricter reading.
- Denmark. DLA's paraphrase mixes "anyone" with "natural person". We treat Denmark as opt-in for all, consistent with the statute's "anyone".
No single authoritative, current table of the Art. 13(5) choices exists. The Commission has not published one since the ePrivacy Regulation was abandoned. This matrix is assembled from two law-firm guides. Vendor blog tables (sequencers, data vendors) disagree with each other and with these guides, and we did not use them.
What this means for an entrant
- Turn this table into code. A recipient-country × address-type rule engine that allows, warns or blocks per contact is the most concrete "EU-native" feature an entrant can ship. US sequencers leave it to the customer. See Platform liability: what the sequencer itself risks and the openings.
- Detect generic versus personal addresses. Four countries (BE, NO, HU, NL) turn on it, and it costs one classifier. Pair it with country detection from TLD, company HQ and enrichment data.
- Default the unclear rows to strict. It costs a few lost sends in small markets and protects the product's credibility with EU legal buyers.
- Sell the opt-out markets first. France, Ireland, the Nordics, Portugal and the UK give a legal B2B cold-email market of meaningful size with English or French as the working language. See Non-English markets and Go-to-market plan.
- Keep the table maintained. Laws change: Belgium's DPA guidance is in consultation, the Netherlands has announced telemarketing changes, and the UK's DUAA guidance is "under review". A versioned, sourced ruleset is an asset that competitors would have to rebuild.