B2B Cold Outreach and GDPR (2026): What's Allowed

B2B cold outreach is not banned by GDPR, but GDPR is only half the test. Whether you may send a cold email or make a cold call depends on the ePrivacy rules of your recipient's country. Germany requires prior express consent for marketing emails, even to businesses. The UK allows them to companies with an opt-out, and the US uses an opt-out model under CAN-SPAM. inDeal (indeal.ai) is a free AI CRM for small businesses, made by Lars Krüger GmbH in Berlin. Not to be confused with indeal.io, a different company.

As of October 30, 2026. Legal sources: German UWG Section 7 and AG Düsseldorf 290c C 153/25 (official texts), GDPR Art. 6, 14, 21 (EUR-Lex), EDPB Guidelines 1/2024; UK: ICO (PECR); US: FTC and 16 CFR Part 316 (CAN-SPAM); product: success.indeal.ai and indeal.ai.

Is B2B cold outreach legal under GDPR?

Yes, it can be, but not on every channel and not in every country. For B2B cold outreach you always run two tests: the marketing rules decide whether you may contact someone on a given channel, and GDPR decides whether you may process the contact's personal data to do it.

Both tests must pass. An email that is fine under GDPR is still unlawful in Germany without consent, and a permitted channel does not help if you collected the data without a legal basis.

Marketing is broad. Citing Germany's Federal Court of Justice, the Düsseldorf court defines advertising as any statement aimed at promoting sales, directly or indirectly (AG Düsseldorf, 290c C 153/25). A "partnership request" that pitches your services counts as marketing.

Which channels are allowed for B2B cold outreach in Germany?

It depends on the channel. Germany is a useful benchmark because its rules are strict. Section 7(2) of the Act against Unfair Competition (UWG) lists cases that are "always" an unacceptable nuisance, and it treats consumers and "other market participants," meaning businesses, differently (UWG, English translation).

Every marketing message must also show who is sending it and include a valid address where the recipient can ask you to stop (Section 7(2) no. 3 UWG).

What does "presumed consent" mean for B2B cold calls in Germany?

It means you must have specific reasons to assume the business would welcome your call. The law does not define the term, so it comes down to the individual case.

An assumed need ("every company needs a CRM") is weak. Reasons that start with the business itself are stronger:

• an inquiry or a callback request
• a conversation at a trade show where you agreed to call
• a referral the referred person explicitly agreed to
• an existing business relationship clearly related to your offer

Write the reason down before you call, so you can explain it if there is a dispute.

Marketing calls to consumers need prior express consent; calling them without it can cost up to €300,000 under Section 20 UWG. So check whether you reach your contact as a business or as a private person.

Why isn't "presumed interest" enough for cold emails in Germany?

Because Section 7(2) no. 2 UWG requires prior express consent for marketing by email and does not distinguish between consumers and businesses. An assumed interest in doing business does not replace that consent.

The Düsseldorf district court made this clear on January 19, 2026. A recruitment agency had sent a promotional products company three emails in just under four months, with the subject line "Kooperation Personal" ("staffing partnership"). The court ordered the agency to stop.

Key points from the ruling:

• "Get in touch" is not consent: A call to action on the recipient's website is not consent. Consent must be given for the specific case and show which companies may advertise which products.
• An unsubscribe link is not enough: The recipient did not have to read the unwanted email and opt out. The risk of repeat violations remained.
• Blocking internally is not enough: Stopping further emails and a cease-and-desist declaration "without prejudice" did not suffice. A cease-and-desist declaration backed by a contractual penalty was needed.
• Costs: The sender had to pay €453.87 in legal fees for the warning letter, and the court set a potential fine of up to €250,000 for each future violation.

It is a single local court ruling, but it follows the plain wording of Section 7(2) no. 2 UWG.

How does GDPR apply to B2B prospecting?

GDPR applies as soon as you process data about an identifiable person, such as the name, work email or phone number of your contact. In B2B sales, too, you need a legal basis under Article 6 GDPR.

Usually that is legitimate interest under Article 6(1)(f). Recital 47 says direct marketing may be regarded as a legitimate interest (GDPR, EUR-Lex). The European Data Protection Board makes clear that this does not mean every kind of direct marketing is automatically allowed (EDPB Guidelines 1/2024).

According to the EDPB, three conditions must all be met:

1. Legitimate interest: You pursue a lawful purpose, such as selling your service.
2. Necessity: You only process the data you really need (data minimization).
3. Balancing test: The person's interests do not override yours. A key factor is whether they can reasonably expect to be contacted.

For email, one point matters most: where national law requires consent, the EDPB says you cannot rely on legitimate interest. In Germany, that applies to marketing emails. For letters and well-founded B2B calls, Article 6(1)(f) remains a possible basis.

What must you tell prospects under GDPR Article 14?

If you did not collect the data from the person, for example from a directory, a website or data enrichment, Article 14 GDPR requires you to inform them. If you use the data to contact them, the deadline is your first message at the latest (Art. 14(3)(b)).

The notice should include, among other things:

• Who: your company's name and contact details, and your data protection officer if you have one
• Why: the purpose and legal basis, and for legitimate interest, what that interest is
• What and from where: the categories of data and the source, including whether it was publicly available
• How long: the retention period or the criteria for it
• Rights: access, rectification, erasure, restriction, objection and the right to complain to a supervisory authority
• Recipients: any recipients and transfers to third countries

Article 21(4) GDPR requires you to point out the right to object explicitly, clearly and separately from other information. In practice, a short paragraph in your first message plus a link to a full privacy notice works well.

A sample paragraph (template, not legal advice): "We found your contact details on [source]. We use them based on our legitimate interest in introducing our service to you. You can object at any time; a short reply is enough. Details: [link to privacy notice]."

The "disproportionate effort" exemption (Art. 14(5)(b)) rarely fits cold outreach: if you contact the person anyway, you can inform them.

What happens when a prospect objects?

Then all marketing to that person stops, right away and without discussion. Under Article 21(2) and (3) GDPR, you may no longer process their data for direct marketing once they object. The EDPB stresses that this right is unconditional: the person does not have to give a reason, and there is no balancing test.

German law agrees: clearly unwanted advertising is not allowed (Section 7(1) UWG), and the existing-customer exception ends once the customer objects (Section 7(3) no. 3).

The real question is how you make sure nobody on your team contacts that person again, for example after a new list import.

What are the risks of unlawful cold outreach?

Mainly warning letters and injunctions, and not only from competitors. In the Düsseldorf case, the recipient itself sued.

How do UK PECR and US CAN-SPAM compare?

Both are more permissive than Germany for emails to businesses. Within the EU, GDPR applies everywhere, but email marketing rules are national, so check the recipient's country.

• United Kingdom: Under PECR you do not need consent to send marketing emails to "corporate subscribers" such as limited companies. You must not hide your identity, and you must offer a way to opt out. Sole traders and some partnerships are treated like individuals, and UK GDPR still applies to your contact's personal data (ICO). The ICO is currently reviewing this guidance because of the Data (Use and Access) Act.
• United States: The CAN-SPAM Act does not require prior consent, but it makes no exception for business-to-business email. You need accurate header information, a non-deceptive subject line, a clear ad disclosure, a valid physical postal address and an opt-out that you honor within 10 business days. The FTC lists penalties of up to $53,088 per violating email (FTC, 16 CFR Part 316).

How do you run compliant cold outreach with a CRM?

By building the rules into your workflow. A CRM records sources, reasons for contact and objections, and prevents mistakes across the team.

How this maps to inDeal:

• Suppression list: In the blacklist you block email addresses, LinkedIn profiles, domains and companies. Blocked contacts are not created, not shown and not contacted. Existing leads are flagged, not deleted. Only admins can change the list.
• Import check: During a CSV import, inDeal skips rows on the blacklist and shows them in the result (Creating, importing and enriching leads). The Chrome extension does not create blocked profiles either.
• Record source and reason: The Lead source field shows where a lead came from. You keep lasting facts such as a consent as a pinned note, and calls and emails as activities (Activities, notes and history).
• Cost: The CRM, all users and adding leads by hand or CSV are free. You need credits for data enrichment and for capturing leads with the Chrome lead plugin (indeal.ai).

What AI can and cannot do in this process is covered in AI CRM for small business. For an overview of free options, see Free CRM for small business. To bring your network contacts in cleanly, read How to add LinkedIn contacts to your CRM.

Bottom line: which outreach approach is right for your small business?

The one that holds up in court and does not annoy your target accounts: less mass outreach, more contact triggered by the prospect, and clean records in your CRM.

Without a system you lose twice: leads nobody follows up on, and contacts you email again after they objected. To move warm leads forward, see Lead qualification with BANT.

Keep reading

• AI CRM for Small Business: What It Can Do in 2026
• Free CRM for Small Business (2026): Which One Fits Your Team?
• How to Add LinkedIn Contacts to Your CRM: 4 Ways (2026)
• GDPR-Compliant CRM 2026: EU Hosting Checklist
• Lead Qualification with BANT: Small Business Guide 2026

Frequently asked questions

Sources

inDeal is the AI CRM for small and mid-sized B2B companies.