National ePrivacy implementation

Treat the recipient's country as part of the send decision. GDPR applies across the EU, while electronic marketing rules are implemented by individual countries, so cold email legality varies across Europe.¹ The ePrivacy Directive generally requires opt-in consent before direct electronic marketing.² The address type, person's business role, customer history and national rule can all change the result for a B2B contact.

The order of the check

1

Map

2

Separate

3

Apply

4

Test

5

Suppress

1. Map
2. Separate
3. Apply
4. Test
5. Suppress

Run these checks in order and save the result with the contact record. Move to the next stage only when the current answer is clear.

Stage	What you are trying to learn	Example question
Map	The recipient country and address type	Is this a personal address, a business address or a shared mailbox?
Separate	The data protection basis and the email permission	What permits processing this contact, and what permits this email?
Apply	The national rule for unsolicited email	Which country's rule applies to this recipient and send?
Test	Whether a B2B or customer exception fits	Is the message tied to the person's business role or an existing sale?
Suppress	Whether an objection blocks future marketing	Has this address or person objected, and where will that block live?

Start with the channel rule

Email permission is a separate check. Record the channel decision before approving the list or message.

Article 13 of the ePrivacy Directive regulates unsolicited electronic-mail marketing through national law.³ This creates a country question alongside the data protection question. In many countries, B2B email either does not require consent or uses a lower consent standard than other email.⁴

Record the two decisions separately. A data protection basis can explain why you may process contact data, while the national electronic-marketing rule determines whether you may use email for the outreach. If the answers differ, hold the send until the channel rule is resolved.

Classify the recipient and address

Start by recording whether the address belongs to a person, a company representative or a shared business inbox. Then check whether the message fits the recipient's business role.

A company representative may be contacted for direct marketing of business-related products or services without prior consent only in the context of the position that person holds.⁵ The role, message and product should fit together. If they do not, stop and find the rule that supports the send.

A corporate email address still needs objection handling. Guidance states that the law does not require organisations to stop marketing emails sent to a corporate email address, while many organisations stop as good practice after receiving an objection or opt-out.⁶ Record the objection against both the address and the person so a later list refresh does not reopen the decision.

Apply the recipient country's rule

Check the country before approving the copy. The general EU rule provides the starting point, while the recipient country's implementation determines how the send works in practice.

Build a country matrix with entries for prior consent, B2B treatment, customer exceptions and objection handling. Keep Germany as a separate route because it requires consent even for B2B email.⁷ A rule that works for one country needs a fresh check before you apply it to another.

The matrix should answer one operational question: can this address receive this type of commercial email under its country's rule? If the answer is unclear, pause the send. Rules vary by country, so check the matrix before sending email abroad.⁸

Test the available exception

Check the source of the address, the relationship with the recipient and the connection between the message and the earlier transaction.

Marketing emails may be sent on an opt-out basis when the recipient's details were collected in the context of the sale of a product or service, under Article 13(2) of Directive 2002/58/EC.⁹ This route concerns a customer relationship and does not automatically cover a newly sourced prospect. Keep the transaction or collection context with the send record.

Member states have implemented this exception differently, with differences that may apply especially to B2B communication.¹⁰ Identify the relationship, then apply the country entry. If the exception is absent, narrower in that country or unsupported by the record, use the stricter route required by the matrix.

Handle objections before the next send

Make suppression part of the workflow, with one place that every campaign checks before delivery.

A data subject has the right to object at any time to processing personal data for direct marketing.¹¹ When the person objects, the personal data must no longer be processed for that marketing purpose.¹² Treat an objection as a stop signal across campaigns that use the same contact, and keep the suppression record when the source list is replaced.

What not to do

Keep these failure modes in the launch review.

• Do not treat legitimate interest as permission to skip the email rule. In most cases, relying on legitimate interests does not remove the ePrivacy Directive's consent requirement.¹³
• Do not apply one EU-wide B2B rule to every country. Germany requires consent even for B2B email.⁷
• Do not send abroad before checking the country matrix.⁸
• Do not process a contact for direct marketing after an objection.¹²

Before the next campaign, show the country, address type, business-role fit, customer history and objection status beside each contact. Route unclear records to review and release only sends whose channel rule and recipient facts match.