B2B cold email: what is allowed in France, Germany, Spain and Italy

In France, a prospecting email may be sent to a business contact without their prior consent, provided it relates to their professional activity, informs them and lets them object easily. Germany and Italy, by contrast, require prior consent, even between businesses; so does Spain, according to its data protection authority, although this reading is debated for generic addresses. Outside the EU, the United Kingdom and the United States are more permissive, Canada stricter.

This article is general information, current as of 13 October 2026. It does not constitute legal advice.

Which law applies when you write to a foreign company?

The reflex "I am sending from France, so French law applies" is risky. The EU E-Commerce Directive excludes the permissibility of unsolicited commercial communications by email from the country-of-origin principle (Directive 2000/31/EC, annex). The prudent assumption is therefore to apply the rule of the recipient's country. Canada says so expressly: its law applies to messages accessed from Canada (Mystrika).

Two notions recur. An opt-out regime allows sending as long as the recipient has not objected. An opt-in (consent) regime requires prior agreement that is freely given and verifiable.

What does France allow?

The CNIL accepts B2B prospecting on the basis of legitimate interest when the message relates to the recipient's profession, the recipient has been informed and they can object; each message must identify the sender and offer a simple way to refuse further mailings. Generic addresses of legal entities, such as contact@ or info@, are not subject to these rules (CNIL, 10 June 2026).

When addresses come from public sources, the source must be stated no later than the first communication (CNIL, 30 April 2020). Collection itself is scrutinised: on 5 December 2024 the CNIL fined KASPR €240,000 for collecting the contact details of LinkedIn members who had restricted their visibility and keeping them for five years, in a database of around 160 million contacts (CNIL, 19 December 2024). For web scraping, the CNIL asks in particular that robots.txt files and CAPTCHAs be respected (CNIL, 19 June 2025).

Why is Germany the strictest?

Section 7 of the Act against Unfair Competition (UWG) classes as unreasonable harassment any email advertising sent without prior, express and provable consent, between businesses as well as to consumers; presumed consent is not enough (IHK). The only exception covers existing customers, for similar products (IT-Recht Kanzlei).

Two channels remain open. B2B telephone calls are permitted on presumed consent if there is a concrete link with the business of the company called; mere presence in a directory is not sufficient. Personally addressed postal mail is in principle allowed (IHK). The main risk is civil: competitors or associations can bring injunction proceedings (IT-Recht Kanzlei).

What do Italy and Spain say?

In Italy, Article 130 of the Privacy Code requires the recipient's prior consent. The Garante has clarified that this obligation applies whatever the recipient's legal nature, natural or legal person (Garante, 7 May 2015): an info@ address is no exception.

In Spain, Article 21 of the LSSI prohibits commercial emails that have not been requested or expressly authorised by their recipients, except where there is a prior contractual relationship involving similar products (BOE). The AEPD applies this rule to legal entities (AEPD, E/01415/2017). A software vendor's guide published in May 2026 argues the opposite for generic or role-based addresses (Overloop): this position does not bind the authority. A non-compliant mailing is a minor infringement, punishable by up to €30,000; a mass mailing, or more than three messages to the same recipient in one year, becomes a serious infringement, from €30,001 to €150,000 (LSSI, Articles 38 and 39).

And outside the EU: the United Kingdom, the United States, Canada?

In the United Kingdom, the PECR regulations allow emails to be sent without consent to "corporate subscribers": companies, Scottish partnerships, LLPs and government bodies. Sole traders and some partnerships are treated as individuals. The sender must identify itself and provide a valid address for unsubscribing (ICO). Since the Data (Use and Access) Act 2025, most of which came into force on 5 February 2026, PECR fines can reach £17.5 million or 4% of worldwide turnover (Harper James, March 2026).

In the United States, the CAN-SPAM Act provides no B2B exception. It requires accurate header information, identification of the message as an advertisement, a valid postal address and processing of opt-out requests within 10 business days, with a penalty of up to $53,088 per non-compliant email (FTC).

In Canada, the anti-spam law (CASL) requires express or implied consent. Implied consent can arise from a conspicuously published address, with no statement refusing messages, if the message relates to the recipient's role (CRTC). Administrative penalties reach up to CAD 10 million per violation for a business (Mystrika).

Which regime applies, country by country?

Which deliverability rules come on top of the law?

A lawful mailing can still go unseen. Google asks all senders to keep a spam rate below 0.3% in Postmaster Tools and recommends staying under 0.1%. Above 5,000 messages a day to Gmail, it also requires SPF, DKIM, DMARC and one-click unsubscribe (Google).

Since 5 May 2025, Microsoft has required domains sending more than 5,000 messages a day to Outlook.com, Hotmail and Live to publish SPF, DKIM and DMARC; non-compliant messages are first routed to the junk folder (Microsoft, 2 April 2025). A targeted, short and useful message limits complaints, which weigh on the entire sending domain.

How do you build a prospect list without risk?

Company data (company name, activity, website) is not personal data; names and personal addresses are. Three rules reduce the risk:

1. Choose reusable sources. A website's terms of use can prohibit extraction, even from an unprotected database (CJEU, 15 January 2015). LinkedIn prohibits automated scraping and messaging tools (LinkedIn).
2. Inform people and limit retention. In Spain, the AEPD imposed €1.8 million on Informa D&B in 2025 for processing, without a legal basis or information, the data of 1.6 million sole traders taken from a public census (PPC Land).
3. Keep a single suppression list shared by all campaigns and applied in every country.

France remains the only one of the four countries where B2B email without prior consent is clearly permitted. In Germany, Italy and Spain, first contact goes through other channels: trade fairs, postal mail, and content that leads prospects to give their consent.