Answer
Is cold B2B email GDPR-compliant in the EU?
Cold B2B email is GDPR-compliant in the EU under the 'legitimate interest' legal basis — if you can show a clear business case, your message is relevant to the recipient's role, you offer easy opt-out, and you respect data-subject rights. Cold email to consumers (B2C) requires explicit consent and is much more restrictive.
The full explanation
GDPR doesn't ban cold B2B email — it requires you to process personal data lawfully. The legal basis for cold outbound is Article 6(1)(f) 'legitimate interest', which requires: (1) Clear business purpose (selling a relevant product/service), (2) Necessity (you couldn't reasonably reach this contact via another low-impact channel), (3) Balancing test (the recipient's privacy interest doesn't outweigh yours — usually true for work email + work-related pitch). Practically: send only to corporate email addresses (not personal), include a clear identification of yourself and your purpose, provide a one-click unsubscribe, honor opt-out requests within 30 days, and don't enrich beyond business-context data (work email, role, company are fine; phone, salary, personal info are not). EU member states layer national rules — Germany requires double opt-in for marketing emails, France permits B2B opt-out but B2C opt-in. Tools like LinkedCamp's data handling is GDPR-aligned by default for B2B contexts.
- ✓Legal: legitimate interest (Article 6(1)(f))
- ✓Required: clear purpose, easy opt-out, honor data-subject rights within 30 days
- ✓Send only to work email + work-related role/pitch combinations
- ✓Don't enrich beyond business context (work email, role, company)
- ✓Germany requires double opt-in; France permits B2B opt-out; check national rules
Related questions
Yes — under GDPR Article 28, any vendor processing personal data on your behalf must have a Data Processing Agreement. LinkedCamp, Lemlist, Apollo, HeyReach all offer DPAs on request. Most reputable platforms have a standard template; enterprise tiers offer redlined custom DPAs.
No — under GDPR, an opt-out is permanent. Add the email to your suppression list and never email that address again, even for a new product. Re-emailing an opt-out is a clear GDPR violation and can trigger DPA complaints.
Try LinkedCamp free
AI agents, dedicated IP, multi-channel sequences — starting at $69/mo. 14-day trial, no credit card.