Is Cold Email Legal in Germany for B2B?

No, not without prior consent. Germany is the strictest market in Europe for B2B cold email. Consent is required before emailing a business, and German law gives business recipients no exemption at all. Cresco routes Germany to LinkedIn and does not send email there.

That answer surprises teams who have run outbound successfully in the UK or the US, because the reasoning they are used to does not transfer. The obstacle in Germany is not the one most people expect.

Why the GDPR is not the problem here

Most senders assume the GDPR is what stops them. It is not. The GDPR governs whether you may hold and process a work email address, and direct marketing can rest on legitimate interests under Article 6(1)(f). Recital 47 says as much.

You can satisfy that test in Germany. You can build the list lawfully, document the balancing exercise, and still be unable to send, because a separate law governs the sending itself. Teams that read only the GDPR conclude they are covered and are not.

The practical consequence

A German prospect who receives your unsolicited email has a complaint available to them that has nothing to do with data protection. It concerns unfair competition, and it is available to competitors as well as recipients. That is a materially different risk profile from a data protection complaint, and it is why we treat the market differently rather than sending carefully.

The distinction matters for who can act against you. A data protection complaint runs through a regulator, on a regulator's timetable. An unfair competition claim can be brought by a commercial rival who would be glad to raise your cost of selling into their market. The second route is faster and more motivated.

Does a business address change anything?

No, and this is the single most common misreading. Senders who know the UK rules assume a B2B carve-out exists everywhere, because in the UK it does.

Compare the two positions directly:

The UK draws a line between a company and a sole trader and permits the first. Germany draws no such line for this purpose. Writing to info@ at a GmbH does not place you outside the rule.

What would count as valid consent?

Consent is a route, not a loophole, and the bar is higher than most outbound teams assume. Three properties have to hold at once.

• Specific. To you as the sender, and to the kind of message you intend to send. Consent given to a platform, an event organiser or a data vendor is not consent given to you.
• Prior. Obtained before the first commercial message, not collected by the message itself. An opening email that asks permission to send emails has already been sent.
• Documented. You should be able to produce what was agreed, when, and in what wording. Consent you cannot evidence is consent you do not have when it is questioned.

This is why buying a German list rarely solves the problem. You inherit a consent record you did not create and usually cannot inspect, for a sender who is not you.

Which other markets work the same way?

Germany is not alone, and a programme built for it usually covers six other markets. Austria, Spain, Italy, Poland, Belgium and Denmark all require consent before you can email a business.

Germany is singled out in our own notes for a reason. The others require consent; Germany requires consent and closes the business-recipient exemption explicitly. Denmark is the newest addition to this group: it sat under legitimate interest on our own published table until October 2026, and we moved it after reading the Danish position on business recipients. In practice the operational answer is the same across all seven, which is why we treat them as one segment rather than seven decisions.

The planning consequence is worth stating plainly. If your addressable market is concentrated in German-speaking Europe or the southern EU, a large share of it is unreachable by cold email regardless of how well the campaign is built. That is a market-sizing fact, not a campaign quality problem, and it is better discovered before a budget is set than after three months of poor numbers.

Our market checker gives the verdict and the named basis for each of the fifteen markets we work in, so you can see where the line falls rather than taking a summary on trust.

What we do in Germany instead

We run LinkedIn outreach and we do not send cold email. That is a published position, not a case-by-case judgement, and it is the same answer every client gets.

LinkedIn works differently in a way that matters here. The message is sent inside a platform the recipient chose to join, in a professional context, and the connection request gives them a decision point before any pitch arrives. It is slower than email and the volume ceiling is lower. In a market where the alternative is not sending at all, that is a straightforward trade.

What changes operationally

Teams moving a German segment from email to LinkedIn should expect three differences, and should plan for them rather than discover them:

• Lower daily volume. Platform limits, not inbox limits, set the ceiling. A market that absorbed thousands of emails a month will absorb a fraction of that in connection requests.
• Profile quality starts mattering. The recipient looks at who is writing before deciding. On email they often do not. A thin sender profile suppresses acceptance in a way it never suppressed open rates.
• Longer cycles. Connection, then conversation, then meeting. Judge the channel on meetings held rather than on first-touch response, or it will look like it is failing while it is working.

What happens to German records already in your list

Most clients arrive with them, because the list was built before anyone asked the question. We segment them out rather than delete them. The records stay, flagged by market, and route to LinkedIn instead of to a sending domain. Nothing is lost, and the segment stops being a liability sitting one bulk send away from a complaint.

If a German record came from a source that did capture consent, an event registration or an existing contract, that is worth establishing on a record-by-record basis rather than assuming it across the segment. Consent is specific to a sender, so inherited consent usually does not survive the question.

We would rather tell a client that seven markets are LinkedIn-only than quietly send into them and let the client carry a complaint. That is how our outbound work is scoped, and it is one of the few things in this industry that is simple to verify before you buy.

If Germany is a core market for you

There are routes that do not depend on unsolicited email, and they are worth planning properly rather than treating as a fallback.

• LinkedIn outreach, role-targeted, with the connection step doing the qualifying work the email subject line would otherwise do.
• Consent captured before contact, through events, content registration or an existing commercial relationship. Slower to build, and it moves you out of the restriction entirely.
• Inbound, where the prospect arrives already searching. Different mechanism, different timeline, and it carries none of this constraint.

Not legal advice. Where your situation is borderline we will say so and recommend you take advice first. If Germany is central to your plan, tell us and we will be straight about what we can and cannot run.