A founder I work with forwarded me an email at 11pm last spring. One of his SDRs had sent a three-step sequence to a procurement lead at a mid-sized manufacturer near Stuttgart. The reply was four sentences in German and one attachment. The attachment was a letter from a law firm, and it was asking for a signed cease-and-desist plus a few hundred euros in fees.
His first question was the one I always get: "Are we breaking GDPR?"
Short answer: probably not the part he was worried about. GDPR was not the law that produced that letter. German competition law was. And that mix-up is not a small detail, because it means most of what B2B teams do to "get GDPR compliant" fixes the wrong thing. They write a legitimate interest memo, paste a privacy policy link in the email footer, feel covered, and carry on sending into the one country where the footer was never the issue.
I am not a lawyer and this is not legal advice. What I am is the person who has had to build the CRM fields, suppression logic and audit trail behind this at a dozen B2B companies selling into Europe. That is the part almost nobody writes about, so that is the part I will cover.
The two laws everyone merges into one
There are two separate rulebooks sitting on top of a cold email, and they do different jobs.
GDPR governs whether you are allowed to hold and process someone's personal data at all. A work email address with a name attached is personal data. Your lawful basis for holding it is usually Article 6(1)(f), legitimate interests. Recital 47 says out loud that processing for direct marketing purposes may be regarded as a legitimate interest. So GDPR is, on this specific question, the permissive law.
ePrivacy governs whether you are allowed to send the message. Article 13(1) of the ePrivacy Directive requires prior consent for unsolicited commercial email. And critically, Article 13(5) lets each member state decide whether that protection extends to legal persons, meaning companies rather than individuals. That single clause is why there is no such thing as "the EU rule" for cold email. There are twenty-seven of them.
ePrivacy is a directive, not a regulation. Directives get transposed into national law, and national legislatures made different choices. That is not a loophole or a grey area. It is the design.
That last row catches out a lot of US teams. GDPR Article 3(2) applies to controllers outside the EU when they offer goods or services to people in the EU. If your sequence is filtered to German job titles at German companies, you are targeting people in the EU. Where your Postgres instance lives does not enter into it.
The country map is the actual rule
Here is the practical version. Treat it as a starting map for your own counsel, not a final answer, because national case law moves and I have seen firms disagree on the edges.
Germany deserves the extra paragraph because it is where most of my clients want to sell and where most of the advice they read is wrong. Two things make it different.
First, the enforcement route. A German company does not need to complain to a data protection authority. Under the UWG, competitors and certain associations can send an Abmahnung directly, which is a formal warning with costs attached. It is fast, it is private, and it never shows up in a fine database. This is why the "show me a single case of a B2B cold email getting fined" argument is so misleading. The bad outcome in Germany usually is not a fine.
Second, the double opt-in expectation. German case law has pushed towards double opt-in as the standard for proving consent, which effectively rules out cold email as most outbound teams run it. Plenty of companies still send into Germany and most of them hear nothing. That is a risk position, not a compliance position, and the founder should be the one choosing it rather than the SDR.
The clause that actually produces fines
If you only take one operational thing from this piece, make it Article 14.
Article 14 covers what you owe someone when you obtained their data from somewhere other than them. Bought a list, scraped a site, pulled it from a provider, enriched it in Clay. In all of those cases you have to tell that person who you are, what you are doing with their data, your lawful basis, how long you will keep it, their rights, and where you got it from. The timing is specific: within a reasonable period and at the latest within one month, or, if you are using the data to communicate with them, at the latest at the time of the first communication.
At the time of the first communication. That means the first cold email itself has to carry the notice or link to it. Not a privacy policy URL buried under a logo, but a real statement that this person's data came from a named source.
Almost nobody does this. And when regulators go looking at prospecting, it is one of the first things they find, because it is binary and easy to check.
Of the CNIL's 83 sanction decisions in 2025, totalling €486,839,500 in fines, 10 concerned commercial or political prospecting. Two were issued on the same day in May against data brokers: SOLOCAL MARKETING SERVICES was fined €900,000 and CALOGA €80,000, both for prospecting without a valid basis and passing data to partners.
Read the pattern in those cases rather than the numbers. The common thread is not aggressive sending volume. It is that the company could not explain where the data came from, and could not show that the person had ever been told. The paperwork failure is the violation.
I have seen the same thing in a friendlier form. A client got a subject access request from a prospect in the Netherlands asking a simple question: where did you get my email address. The CRM had the contact, the sequence history, the opens. It did not have the source. Three people spent two days reverse-engineering which enrichment run had created that record, and they still ended up guessing. That is the actual cost of unsourced data, and it lands long before any regulator does.
Compliance here is a data model problem, not a legal opinion problem.
A legal memo tells you what you are allowed to do. It does not tell you, for any given contact in your CRM, which rule applied and why. Only your fields can do that, and most CRMs have none of them.
Your enrichment waterfall is a chain of custody
Most B2B teams now run some version of a waterfall enrichment setup in Clay: try provider A, fall back to B, then C, keep the first verified hit. It is the right way to get coverage and it is what I build for clients. It also quietly destroys your ability to answer the Article 14 question, because by default the record stores the email address and forgets which provider produced it.
Fix that first, before any of the policy work. The rule I use is simple: no contact enters a sequence unless three fields are populated.
The third field is the one that changes behaviour. Once send_rule exists as a property rather than a policy document, your sequences can filter on it. In HubSpot it is a dropdown property on the contact, set by workflow, and it is the kind of thing that belongs in the CRM architecture work rather than in a slide. German contacts stop being a judgment call an SDR makes at 8am and become a segment that outbound tooling cannot touch. I build this as a small n8n workflow (here is how we use it across RevOps) that runs on contact creation: read country and company legal form, write the rule, write the source from whichever enrichment step succeeded, and flag anything it cannot classify for human review rather than guessing.
The fourth field is the one that saves you. Opt-outs have a habit of living inside whatever sending tool was in use at the time, which means they evaporate the moment you switch from Outreach to Smartlead, or when you migrate CRMs. Emailing someone who already told you to stop is the single worst fact pattern you can hand a regulator, and it is entirely self-inflicted. Suppression belongs in the CRM, at domain level as well as contact level, and it never gets deleted. If you want this running without anyone touching it, that is a straightforward automation build.
The soft opt-in got wider, and most teams have not noticed
One genuinely useful development, and it is recent enough that most of the guides still online predate it.
Article 13(2) of the ePrivacy Directive has always carried a "soft opt-in" exception: you can email someone about similar products without prior consent if you got their address in the context of selling them something, and you offer an easy objection at collection and in every message.
On 13 November 2025 the CJEU ruled in Inteligo Media SA (C-654/23) that this exception can cover free accounts, where the free service is indirectly paid for through the provider's paid offering. The court also held that where the Article 13(2) conditions are met, you do not need to separately identify an Article 6 GDPR basis for that sending. ePrivacy stands on its own.
For a B2B SaaS company with a free tier, a free trial, a community edition or a gated tool, that is a real change. Those users may be reachable about your similar paid products without treating it as cold outreach at all, provided the objection mechanics are right at both ends.
Which points at the strategic move I push clients towards regardless of the law. Every hour spent arguing about whether you can cold email a German procurement lead is an hour not spent building a motion where they come to you first. Identifying the companies already on your website and reaching out to accounts showing real intent is both a better conversion story and a much shorter compliance conversation, because you have an actual relationship to point at.
Three things I would stop doing today
Buying scraped lists. Not on ethics, on liability. You inherit whatever the seller did wrong, you cannot document the origin, and you fail Article 14 the moment anyone asks. If the vendor cannot tell you the specific source for a specific record, the record is unusable. That is also the honest filter to apply when choosing between data providers.
The "we're US-based" argument. Article 3(2) is about who you target, not where you sit. If your ICP filter says Germany, you are in scope. Decide that consciously.
Fake opt-outs. The unsubscribe link that only removes someone from one sequence while leaving them in three others is worse than no link. It creates a documented promise you then break, and it is trivially provable from your own logs. One suppression list, honoured everywhere, or do not offer the link.
None of this is a reason to stop doing outbound in Europe. I run outbound in Europe. It is a reason to know which rule you are operating under for each contact, and to have the fields that prove it. Teams that get this right spend less time on it than teams that get it wrong, because it stops being a debate and becomes a property on a record.
The upside nobody mentions: the same discipline that makes you defensible also makes you better at outbound. If you cannot say where a contact came from and why they are relevant, that is usually not a legal problem first. It is a targeting problem, and it was costing you reply rates long before it ever cost you a letter from a lawyer. Sharpen the ICP definition and half of this gets easier by itself. That is usually where our go-to-market work starts, and the compliance side falls out of it for free.
Not sure what your CRM could prove today?
We audit outbound data trails for B2B teams selling into the EU and UK: where every contact came from, which rule applies, and whether your suppression list actually holds. Thirty minutes, no deck.
Book an audit →FAQ
Is cold email illegal under GDPR?
No. GDPR does not ban B2B cold email. It governs whether you may hold and process the personal data, and Article 6(1)(f) legitimate interests generally covers B2B prospecting, with Recital 47 naming direct marketing as a possible legitimate interest. The law that decides whether you may send the message is ePrivacy, implemented differently in each member state. Confusing the two is the most common mistake I see.
Do I need consent to cold email a company in Germany?
In practice, yes. UWG §7(2) No. 2 treats email advertising without prior express consent as unreasonable harassment, and it does not distinguish between private individuals and businesses. German case law has moved towards double opt-in as the standard for proving consent. Enforcement typically arrives as a cease-and-desist letter under competition law rather than a data protection fine, which is why it stays invisible in fine databases. Take local advice before you decide to send there.
What does GDPR Article 14 require in a cold email?
If you obtained the data from somewhere other than the person, you must tell them who you are, what you are doing with their data, your lawful basis, retention period, their rights and the source of the data. When the data is used to contact them, that has to happen at the latest at the time of the first communication. A generic privacy policy link is weaker than a plain line naming where you got the address and a working objection route.
Can I email UK businesses without consent?
For corporate subscribers, generally yes. The PECR electronic mail consent rule does not apply to limited companies, LLPs, Scottish partnerships or public bodies, so you can email them without prior consent. Sole traders and ordinary partnerships are treated as individual subscribers and need consent or the soft opt-in. UK GDPR still applies to the underlying data, so you still need a lawful basis, transparency and a working opt-out.
Does GDPR apply if my company is based in the US?
Yes, if you are targeting people in the EU. Article 3(2) extends GDPR to controllers outside the EU who offer goods or services to people in the Union. Filtering your prospect list to EU countries and job titles is targeting. Server location, company registration and where your team sits do not change that.
How long can I keep prospect data I never contacted?
There is no fixed number in the regulation, so it comes down to what you can justify against your stated purpose. I set clients up with a default of 24 months from source_date for uncontacted B2B prospect records, with automatic deletion after that unless the contact has engaged. The point is less the exact number than having one, applying it automatically, and being able to show it running. A documented data retention rule inside the CRM is worth more than a longer policy document nobody executes.