Is cold email legal in the EU?
For B2B outreach, generally yes, under GDPR's legitimate interest basis, as long as a written assessment backs it up. Marketing to consumers is a stricter case that normally needs explicit consent.
The short answer
- GDPR does not require explicit consent before every B2B cold email. Legitimate interest is a recognized lawful basis for this outreach, as long as the sender has completed a written Legitimate Interest Assessment.
- A Legitimate Interest Assessment checks three things. Is there a real business purpose for the contact? Is the processing needed to achieve it? Does that interest outweigh the person's rights and what they would expect?
- Legitimate interest is generally not available for direct marketing to consumers (B2C). That normally needs explicit consent under GDPR.
- A bought or scraped list is harder to justify under legitimate interest than a list you researched yourself. The person's expectation of contact, and your knowledge of how the data was collected, are both weaker.
Why legitimate interest exists as a basis for B2B outreach
GDPR requires a lawful basis for processing personal data. Consent is the basis most people think of. Consent does not work for cold outreach, though. There is no prior relationship to have obtained it through. Asking permission before the first contact is circular. GDPR allows for this with a separate basis, legitimate interest. It can apply to B2B cold email when the message relates to the person's job and does not unfairly override their rights.
Relying on legitimate interest is not automatic. The sender has to complete and keep a Legitimate Interest Assessment before relying on it, not claim it after the fact if questioned. The assessment covers three tests. A purpose test: is there a real business reason for this contact? A necessity test: is this outreach needed to achieve that purpose? A balancing test: does the person's interest in not being contacted outweigh the sender's interest in reaching them?
A B2B email to a specific role at a specific company, relevant to that role's real job, passes the balancing test more easily than an email sent to a broad, poorly targeted list. The same goes for an email sent to a personal rather than work address. The more the outreach looks like a message to a relevant work contact, rather than a mass, one-size-fits-all list, the easier the legitimate interest basis is to defend.
GDPR lawful basis: B2B cold email versus B2C marketing
| B2B cold email | B2C marketing | |
|---|---|---|
| Common lawful basis | Legitimate interest, with a documented assessment | Explicit consent |
| Prior relationship required | No, if the assessment supports it | Generally yes, or opt-in consent obtained |
| Documentation needed | A completed Legitimate Interest Assessment | Evidence of valid, freely given consent |
| Purchased/scraped lists | Harder to justify under the balancing test | Generally not compliant without separate consent |
What to actually do before sending B2B cold email into the EU
Build the target list from a relevant, work-related source: your own research, a work network, a genuinely public business directory. Not a broad bought or scraped list. This makes the balancing test behind a legitimate interest claim much stronger. Write up the assessment before sending, not as an afterthought. Make sure every message includes a clear, working way to opt out. GDPR expects that whichever lawful basis you rely on.
Disclosure: SalesCrew is our product. Its suppression list enforces opt-outs at audience freeze and again at send time, which supports honoring an opt-out once made. It does not perform or check a Legitimate Interest Assessment for a specific list. That judgment is the sender's own job before outreach begins.
A Legitimate Interest Assessment must exist before sending, not after a complaint
Questions
- What is a Legitimate Interest Assessment, and is it actually required?
- A Legitimate Interest Assessment (LIA) is a written record of why the outreach serves a real business purpose, why it is needed, and how it weighs against the person's own rights. To rely on legitimate interest under GDPR, you must complete and keep this record. Claiming the basis applies is not enough.
- Does legitimate interest work for cold email to consumers (B2C)?
- Generally not. Legitimate interest is the common basis for B2B cold email, because the message relates to the person's job. Direct marketing to consumers under GDPR normally needs explicit consent instead.
- Is a purchased or scraped list riskier under GDPR than a self-built list?
- Yes. A Legitimate Interest Assessment is harder to justify for a bought or scraped list. The person often has no reason to expect contact, and the sender knows less about how the data was first collected.