Post
Email remains the B2B channel with the best return on investment: minimal cost, total measurability, direct contact with decision-makers. But it’s also the channel where companies make the most legal mistakes without knowing it, because the rules change from country to country, and “everyone does it” is not a defence that works in front of a data protection authority.
Content
I work daily with email campaigns across several European markets, and in this article I’ll share the practical picture: what the rules say, how they change between the main countries, and what separates campaigns that get replies from those that end up in spam. A necessary premise: this is an informational article, not legal advice, and for your specific case a lawyer’s opinion remains irreplaceable.
The two layers that add up: GDPR and ePrivacy
On the commercial email front, two layers of rules coexist. The GDPR governs the processing of personal data (and a named business email — name.surname@company.com — is personal data). The ePrivacy Directive, transposed differently by each State, specifically governs unsolicited commercial communications. It’s this second layer that creates Europe’s patchwork map.
The map: opt-in and opt-out in the main markets
France — contact with professional addresses is generally permitted if the message is relevant to the recipient’s role and there’s a clear way to object.
Germany — among the strictest regimes in Europe: express consent required even in B2B, with active case law and concrete fines. A market to approach through other channels or with consent built beforehand.
United Kingdom (post-Brexit) — its own rules (UK GDPR + PECR): B2B towards corporate bodies operates under an essentially opt-out regime, with transparency and unsubscribe obligations.
Ireland — an opt-out regime for B2B with conditions; be careful though, because it hosts the European headquarters of big tech and the Data Protection Commission is anything but dormant.
The operational consequence: a European campaign isn’t one campaign, it’s several campaigns — separate lists per country, separate rules, separate messages.
The real risk isn’t what you think
In the practice of proceedings, what most aggravates a company’s position is often not the single unsolicited email: it’s how you handle what comes afterwards. Ignoring a deletion request, failing to respond within the deadline to a data access request (“where did you get my address?”), having no process to handle objections: these are the behaviours that often turn a complaint into a fine. Before you hit send, make sure you have: a register of where your contacts come from, a working unsubscribe mechanism, and a process to respond to data subject requests within 30 days.
One extra point of attention: open-tracking pixels also fall within scope — in much of Europe they require consent. In cold campaigns, better to measure replies than opens.
What works (once the legal front is sorted)
Relevance above everything. The reply rate is decided before writing: in the selection. A hundred hand-picked contacts beat ten thousand contacts scraped from a list.
Real personalisation, not the {name} variable. One line proving you know who the recipient is (their website, a recent piece of work, a typical problem in their industry) is worth more than any template.
Brevity and a single ask. Under 120 words, one clear question at the end. No attachments on first contact.
Technical gradualness. A dedicated domain, progressive volumes, email authentication configured (SPF, DKIM, DMARC): deliverability is technical work, not a detail.
Honesty. Who you are, why you’re writing to them specifically, how to stop receiving. It sounds counterintuitive, but transparency increases replies: in B2B, nobody answers what looks like a bot.
I build multi-market B2B acquisition systems that hold the two pieces together: compliance and results. If this topic concerns you, let’s talk.
Frequently asked questions about B2B email marketing
Is B2B cold email legal in the UK? Broadly yes, towards corporate bodies, under an opt-out regime (UK GDPR + PECR) with transparency and unsubscribe obligations. Emails to sole traders and partnerships are treated closer to consumer rules — always verify the recipient’s legal form.
Can I use emails found on company websites? The fact that an email is public doesn’t equal consent to receive commercial communications: publication has a purpose (e.g. institutional contact) and use must respect it, along with the rules of the recipient’s country.
What does a company sending non-compliant emails risk? GDPR fines can reach percentages of turnover, but the typical path starts with complaints and data subject requests: that’s where correct handling makes the difference between a clarification and proceedings.
Are generic addresses like info@ safer? Generic addresses not referring to an individual fall under a more permissive regime in several countries, but the rules on commercial communications still apply: transparency and the ability to object are always required.
How many emails a day can I send without landing in spam? It depends on domain reputation: a new domain starts from a few dozen a day with gradual growth over weeks. Sudden volume is the fastest way to burn deliverability.
