Every blog post says something different and half of them are selling a tool. Some say B2B cold email is fine under legitimate interest, some say you need consent, some say it depends on the country.
I want to email maybe 30 companies a day, all businesses, all from public sites. What is the actual shape of this?
Different angle: the regulatory risk to someone sending 30 a day is not the thing that will actually cost you. The thing that costs you is one irritated recipient who decides to make a point, and then you spend a fortnight writing careful letters instead of building. That risk is managed by not being annoying - one email, one short follow-up, obvious opt-out, never a fourth message - far more than by picking the right legal basis in a document nobody reads.
Setting this up was less work than reading about it. My sheet has address, company, source URL, date collected, date emailed, and status. The unsubscribe link is a one-line endpoint that writes a row into a suppression table, and the send script checks that table before every message. Took an evening. In about 600 emails I have had two opt-out requests and one person who replied to ask how I found them, which the source column answered in one sentence.
I skip Germany and Austria entirely for cold outreach and target the UK, the Netherlands, the Nordics and the US. It costs me some market and removes the only jurisdictions where I have heard of people actually getting letters.
One technical nuance worth knowing: a generic role address like info@ or sales@ usually is not personal data at all, which takes the data protection layer out of the picture. It does not remove the unsolicited-commercial-email rules, which apply to the message rather than the address, so it is a partial mitigation and not a loophole.
Skipping a whole country feels absurd when you first read it, and then you get your first sharply worded reply from a Berlin CTO explaining the law to you and it stops feeling absurd. The cultural norm around unsolicited business email is genuinely different there, and the norm is what generates complaints.
Identify yourself, say why you are emailing them specifically, one line opt-out, delete on request, skip Germany. That is the entire compliance surface at 30 a day.
@proof_pilar · 2w ago · 2 replies
The reason the posts contradict each other is that there are two layers and people only ever describe one of them.
Layer one is the general data protection rules, where direct marketing is explicitly acknowledged as something that can rest on legitimate interest rather than consent. That is the layer the 'it's fine' posts are talking about.
Layer two is the electronic communications rules, which are implemented separately by each country and specifically govern unsolicited commercial email. This is where it diverges. Germany is strict enough in practice that commercial email to a business generally needs prior consent. The UK, by contrast, exempts corporate subscribers, so B2B mail to a company address is permitted with identification and an opt-out. Several other member states have their own B2B carve-outs with their own wording.
So the honest answer is 'mostly yes, with real exceptions, and it depends where they are'. Practical baseline regardless: identify yourself and the company clearly, say why you are contacting that specific person, include a working opt-out in every message, honour deletion requests promptly, and record where each address came from.
Reply
Report
@weatherfront_wu · 2w ago
The 'where did the address come from' record is the one that saves you. I had exactly one formal access request in two years and answering it took ten minutes, because the source URL and the date were columns in the same sheet as the address. Without that it would have been a very uncomfortable letter to write.
Reply
Report