Is cold email legal under GDPR?
This article describes how the rules are commonly understood. It is not legal advice. A lawyer who knows your country and your list can tell you what applies to you.
What does GDPR say about cold email?
The General Data Protection Regulation covers the processing of personal data. A name and a work email address are personal data, so sending a cold email to a named person is processing under GDPR. The regulation does not prohibit it. It requires a legal basis, and one of the six is legitimate interest. Its recital 47 says processing for direct marketing may be regarded as carried out for a legitimate interest.
You have to be able to show legitimate interest. Regulators describe three questions:
- Purpose. Is the interest real and lawful? Selling a product to a company that could use it can qualify.
- Necessity. Is email a reasonable way to reach that person, and do you hold only the data you need?
- Balance. Would the person reasonably expect this message, and does it override their interests? A message that matches their role is easier to defend than one sent to a list nobody checked.
Write the answers down. A short, dated note per campaign is evidence if a regulator or a recipient asks.
Why does GDPR not settle the question alone?
Because email marketing has its own rules. The ePrivacy Directive, in Article 13, governs unsolicited electronic communications, and each country turned it into national law. The result differs:
| Question | What varies |
|---|---|
| Is prior consent needed? | Some countries require it for every recipient, others only for individuals |
| Who counts as a business? | A sole trader may be treated as an individual |
| What must the message contain? | Identity, a real address and an easy way to opt out are common |
In the UK, the Privacy and Electronic Communications Regulations apply. They treat company recipients differently from individual subscribers, and sole traders and some partnerships count as individuals. Germany is known for requiring prior consent for business email too. Poland's electronic communications law has required prior consent, business recipients included, since 10 November 2024. Check the rule for each country on your list before you send.
What must you tell the recipient?
When you did not collect the data from the person, GDPR Article 14 requires you to inform them. The information includes who you are, the purposes and legal basis, the interest you rely on, the categories of data, the source and the retention period. You may give it at the latest in the first communication if you use the data to contact them.
For a cold email this means the first message carries three things: a real sender with a name and company, one sentence on why you are writing, and a link to a privacy notice that holds the rest. The source matters most. "I found your details on your company's team page" is an honest answer. A vague answer is a weak one.
What is the right to object?
Article 21 gives a person the right to object to direct marketing at any time, at no cost. After an objection you must stop processing their data for that purpose. The right has to be brought to the person's attention clearly, at the latest at the first communication.
In practice this is an unsubscribe link that works in one step. Anything that asks for a login, a reason or a second email is a barrier. Reply "no" and "stop" should also be treated as objections, so read replies and act on them.
How do suppression and exclusion lists work?
An objection is only worth something if it holds. A suppression list is a record of addresses that must never receive a message again. The same list applies to every campaign, including the ones that did not trigger the objection. Keeping the address there is the usual way to honour a request, and the list should hold what that purpose needs.
Your exclusion rules can go further:
- Addresses that objected or bounced.
- Competitors and existing customers you do not want in outreach.
- Domains of organisations that asked not to be contacted.
- Lists you bought without proof of where the data came from.
Check the source of any list before you import it. A list with no origin is a list you cannot explain in your first message.
A checklist before you send
- Name the legal basis and write the three-question assessment.
- Check the national rule for each country on the list.
- Put your identity, the reason and the source in the first message, with a link to your privacy notice.
- Add a working unsubscribe link and the
List-Unsubscribeheader. - Apply one suppression list across every campaign.
- Delete data you no longer need.
How does anymail fit in?
You decide who is on the list and on what basis. anymail acts as processor under a data processing agreement. The application and the database run in Germany, and a suppression list applies across your campaigns. Messages can carry a visible unsubscribe line and the one-click List-Unsubscribe header, and an address that unsubscribes goes to Suppressions. The deliverability page describes these controls.
Frequently asked questions
Do you need consent to send a cold email under GDPR?
GDPR itself lets you rely on legitimate interest as a legal basis for direct marketing. National rules that implement the ePrivacy Directive can still require prior consent, and they differ by country and by whether the recipient is a company or an individual.
Is a work email address personal data?
It can be. An address such as a first name and surname at a company identifies a person, so GDPR applies to it. A generic address such as a shared inbox identifies fewer people but still needs care.
What must the first email tell the recipient?
Who you are, why you hold their address and where you got it, what the legal basis is, how long you keep the data, and how to object. A link to a privacy notice can carry most of it.
Does an unsubscribe request mean you delete the address?
Not necessarily. Keeping the address on a suppression list is the usual way to make sure you never write to that person again, and the list should hold only what that purpose needs.
See which companies are warming up.
Start free trial