EU B2B cold email has no universal yes or no. The answer changes with country, recipient type, data source and message.1 The non-obvious point is that the processing decision and the sending decision can split: a route that looks acceptable for data use can still fail the electronic marketing test. Start with the legal route, then write the message and preserve the permission behind it.
Run the check
- Classify the channel
- Check the data basis
- Test the business route
- Record the decision
Use this order before a campaign reaches a contact. Each step answers a different question, so a clear answer at one stage does not settle the next one.
| Stage | What you are trying to learn | Example question |
|---|---|---|
| Classify the channel | Whether the email is direct electronic marketing that requires opt-in consent2 | Is this message marketing, or is it a service communication? |
| Check the data basis | Whether legitimate interests still leaves a separate consent requirement for the sending channel in the applicable case3 | What basis covers the personal data, and what rule covers the send? |
| Test the business route | Whether a company representative can be contacted about business-related products or services only in the context of the position they hold4 | Does this message fit the recipient's work? |
| Record the decision | The consent form, when consent was given, through whom it was obtained, and the contact information5 | Can I reconstruct why this contact was eligible? |
If the route depends on a national business-contact exception, confirm that the exception applies in the country concerned and that the message stays within the recipient's work context. If you cannot explain the route in one sentence, pause the send and resolve that gap first.
Build the consent request
Write the request so a person can see what they are agreeing to, who will use the permission and how the contact can stop it. A vague checkbox leaves too much of the decision unstated.
A consent route uses a specific, unambiguous choice, such as opting into a marketing email list.6 The request should name the business, set expectations about the content and frequency, and state the opt-out method.7
For an existing customer, a useful prompt can explain that future messages concern similar products and ask the person to tick the contact methods they want:
"Thank you for your order, we would like to tell you about similar products in the future. If you'd like to receive marketing messages, please tick any of the boxes below:"8
Keep express written consent voluntary and separate from the condition of buying a product or service.9 Give the person the affirmative action. A sales or service workflow should not silently turn a record into marketing permission.
For later promotional broadcasts on WhatsApp, obtain a separate, explicit marketing opt-in.10 Review the applicable requirements before relying on a fully generic opt-in.11 Move on only when the wording, the contact method and the intended content match the permission you plan to rely on.
Keep the record usable
Permission needs a trail that another person can inspect without guessing. Store the decision close to the contact record, and make the scope easy to compare with the planned message.
Adding someone to a subscriber list asserts that you have permission to email them.12 A lead generator may collect consent for multiple businesses and pass both consent and contact information onward.13 Treat a third-party consent flag as a starting point for verification. Check which business the person agreed to hear from, what contact method was covered, and whether the proposed message fits that choice.
Use the record to answer four practical questions: what did the person see, what action did they take, when did they take it, and who collected it? Keep the wording or form that created the permission, along with the source and the contact details. If the record cannot answer those questions, keep the contact out of the campaign until someone can.
What not to do
These shortcuts create the exact gaps that make a campaign hard to defend. Remove them from the workflow before anyone starts sending.
- Do not adopt either assumption that GDPR made cold email illegal or that B2B email has no rules; both assumptions are wrong.14
- Do not treat compliance with CAN-SPAM as proof of compliance with GDPR.15
- Do not let a sales or service team member opt a prospect in through your system; the prospect should take the affirmative action.16
- For WhatsApp, do not count a scraped, purchased or imported phone number as valid consent.17
Use the decision path before a sequence leaves your system. If you cannot explain the sending rule and show the permission or exception behind it, pause the campaign and resolve the gap first.