Where Cold Email Is Still Legal in Europe

Six European markets permit B2B cold email outright, and France permits it where the message relates to the recipient's role. Seven require prior consent before you may send at all. The dividing line does not follow the borders most outbound guides assume, and it does not follow the GDPR, which is shared by all of them. It follows each country's own ePrivacy implementation.

Cresco publishes the position we work to for fifteen markets, with the named legal basis for each. This is that table explained, and the places where it surprises people.

Which European countries allow B2B cold email?

Three groups, not two, because France belongs in neither.

Email and LinkedIn

• United Kingdom. PECR treats limited companies, LLPs and public bodies as corporate subscribers, so B2B email is lawful without prior consent. Sole traders are not, and we exclude them.
• Ireland, the Netherlands, Sweden, Norway and Finland. Business contact under legitimate interest, role-targeted, with a way to opt out in every message.

Email, with conditions

• France. B2B is permitted where the message genuinely relates to the recipient professional role. That is narrower than the group above rather than a different kind of permission, and it rewards precise role targeting.

LinkedIn only

The grouping below is operational rather than legal. Each of these markets reaches the same requirement by its own route, and the detail differs, but the answer for a sender is identical in all seven, so we treat them as one segment rather than seven decisions.

• Germany, Austria, Spain, Italy, Poland, Belgium and Denmark. Consent is required before you can email a business. We route these markets to LinkedIn and do not send email into them.

Why the Nordic countries are not one answer

This is the error we see most, and we made a version of it ourselves. Treating the Nordic countries as one block is a convenient shorthand that hides a real split.

Sweden, Norway and Finland treat legal persons as opt-out, so business contact under legitimate interest works there. Denmark does not. The Danish Consumer Ombudsman applies the consent requirement to business recipients, not only to consumers, which puts Denmark with Germany rather than with its neighbours.

Our own published table grouped Denmark with Ireland and the Netherlands until October 2026. We moved it and stopped writing the countries as a single block at the same time, because the shorthand is what let the error sit there unexamined. If your target list was built from a European outbound guide, it is worth checking whether Denmark is in a block it should not be in.

Why one regulation produces fifteen answers

This is the part worth understanding once, because it explains every surprise in the table above and makes the next market you add predictable rather than another thing to look up.

The GDPR is shared. It governs whether you may hold and process a work email address, and direct marketing can rest on legitimate interests under Article 6(1)(f).

What it does not do is grant permission to send. Each country separately implements the ePrivacy Directive, and that national law governs unsolicited electronic marketing directly. The UK's is PECR. Germany's sits in competition law rather than data protection law, which is why a German complaint can come from a competitor rather than a regulator.

So a sender can be fully GDPR-compliant in how the list was built and still be sending unlawfully, because the second question has a different answer in their target market. We unpack that split in our piece on the GDPR and cold email.

What this means for list building

The practical consequence arrives earlier than most teams expect, at list build rather than at send.

• Country is a hard filter, not a sort field. Seven markets cannot receive email at all. Those records belong in a LinkedIn segment from the start, not in a sending list with a note attached.
• Legal form matters in the UK. Sole traders are individual subscribers and need consent. We exclude them, which is covered in our piece on PECR.
• Role relevance is a legal point in France. Not a best practice there. The permission is conditional on it.

What it means for market sizing

This is the part that belongs in a plan rather than a compliance review. If your addressable market is concentrated in German-speaking Europe, southern Europe or Denmark, a large share of it is unreachable by cold email no matter how well the campaign is built.

That is a sizing fact, not a quality problem, and it is much cheaper to discover before a budget is set than after a quarter of weak numbers. The honest version of the plan says: this share of the market is email-addressable, this share is LinkedIn-only and will move slower, and here is what each is expected to produce.

What about the United States?

Different model entirely, and worth stating because teams running both sides of the Atlantic often assume the European rules are a stricter version of the American ones. They are a different shape.

CAN-SPAM works on opt-out: honest headers, a working unsubscribe in every message, and a real postal address. There is no prior consent requirement for B2B email, and no corporate subscriber distinction to get wrong. A list that is lawful to email in the US may be unlawful to email in seven European markets, which is why country has to be a filter rather than a column.

Fifteen markets, not "Europe"

We publish fifteen markets because those are the ones we have taken a position on. That is a deliberate limit rather than an oversight.

Switzerland, Portugal, the Czech Republic and the rest of Europe are not on the table. Neither are Canada, Australia or the rest of the English-speaking world, each of which has its own regime. A provider claiming global coverage is either carrying a lot of unexamined risk or has not been asked the question.

If a market matters to your plan and is not on our table, the honest answer is that we would need to look at it before sending, and we will say so rather than assume it resembles its neighbours. Denmark is the argument for that caution: it sat in a group it did not belong in, on our own published table, because it looked like its neighbours.

How to check a market before you build the list

If a market is not on a published table you trust, three questions settle it faster than reading the directive.

1. Does the national law distinguish business recipients from consumers? The UK does and permits corporate subscribers. Germany does not, and that is the whole difference between them.
2. Which law governs the sending, and is it data protection law at all? In Germany it sits in competition law, which changes who can act against you and how fast.
3. Who can bring a complaint? A regulator moves on a regulator's timetable. A competitor does not, and in some markets a competitor can.

Those three put you in the right posture even before you have an answer, because they tell you what kind of risk you are assessing.

How we hold this position

We publish it rather than discussing it on a call. Our market checker gives the verdict and the named basis for each of the fifteen markets, and the same data drives the table on our outbound service page, so the two cannot disagree.

The table is also the thing we are most likely to be wrong about, which is why it is published rather than described. A buyer who finds an error in it can tell us, and that is worth more than a position nobody can check. Denmark moved because that happened.

Declining seven markets in writing costs us work. We think it is a better signal than a compliance page nobody reads, and it is the fastest way for a buyer to check whether a provider has done this thinking before they commit a budget.

Not legal advice. Where your situation is borderline we will say so and recommend you take advice first.