GDPR Opt-In vs Opt-Out for B2B Cold Email: What the Law Actually Requires

Many founders and sales teams are unsure whether a cold email requires prior permission. The answer depends on the destination market, recipient, data source and campaign details.

The short answer: some B2B campaigns may rely on legitimate interest rather than prior consent, but GDPR and local ePrivacy rules require a case-specific assessment. Here is a practical framework for making and documenting that decision.

The Lawful Basis That Covers B2B Cold Email

GDPR Article 6 lists six lawful bases for processing personal data. For cold outreach, the relevant one is legitimate interest (Article 6(1)(f)).

Legitimate interest allows you to process someone’s professional contact details and send them an email if:

1. You have a genuine business reason (prospecting, partnership, a relevant offer).
2. The contact’s role makes the outreach relevant to them professionally.
3. Your interest is not overridden by the contact’s privacy rights.

The third point is where most teams go wrong. Legitimate interest is not a blank cheque. Sending irrelevant bulk email to thousands of random contacts may fail the balancing test; whether a targeted email is permissible still depends on the market, recipient expectations and campaign details. Document the assessment instead of assuming it passes.

Consent (opt-in) is a separate lawful basis. It is stricter, requires an affirmative action from the contact, and must be as easy to withdraw as to give. Some B2B contexts may support legitimate interest, but the applicable ePrivacy and data-protection rules still depend on the destination market, recipient, source and campaign. Do not treat consent as universally unnecessary; document the assessment and obtain qualified legal review where needed.

Opt-in and legitimate interest are different bases; check which rules apply to your campaign.

What a Compliant Cold Email Must Include

Whether you use legitimate interest or any other basis, every email you send must contain:

• Your real identity. Company name, website, and a way to reach you. No vague sender names or obscured domains.
• A clear reason for contact. One sentence is enough. “I noticed you recently expanded into the German market” is better than a generic pitch opener because it signals the email is relevant to them specifically.
• An opt-out mechanism. This can be a simple line at the bottom: “Not relevant? Reply with ‘unsubscribe’ and I will remove you.” A formal unsubscribe link works too. The format matters less than the fact that it is easy to use and you actually honour it.
• Prompt suppression. Once someone opts out, you must stop. Not after one more follow-up. Immediately. Log the opt-out and ensure no future sequences can reach that address.

Agencies building GDPR-compliant cold email infrastructure treat suppression lists as a first-class system, not an afterthought.

The ePrivacy Directive Adds One More Layer

GDPR governs data processing. The ePrivacy Directive (sometimes called the Cookie Law, though it covers much more) governs electronic communications specifically.

Under ePrivacy, most EU member states require prior consent for unsolicited commercial email to individuals, including sole traders. However, emails sent to corporate addresses (role-based or named contacts at registered companies) are generally treated as B2B communications and fall outside the individual-consent requirement.

The practical rule is not one-size-fits-all: if the email address belongs to a person acting in a professional capacity at a company, legitimate interest may be relevant under GDPR, but destination-market ePrivacy and sending rules still require a separate assessment. Personal consumer addresses often require opt-in; confirm the applicable rule before sending.

This is why signal-based outreach that targets verified business contacts at relevant companies is both more effective and more legally defensible than broad list blasting.

What Opt-Out Actually Means in Practice

Opt-out does not mean silence equals consent to continue. It means:

• You have the right to send the first email (and a reasonable follow-up sequence) without prior permission.
• If the recipient says stop, you stop. No exceptions, no “just one more.”
• You cannot re-add an opted-out contact to a new campaign six months later and treat the opt-out as expired.

A suppression list that persists across campaigns and tools is not optional, it is a compliance requirement.

At Asphia, every sequence we build or run includes a suppression layer that spans tools. When a contact opts out of one campaign, they are excluded from all future sends for that client. This is part of what it means to run done-for-you cold email that is actually GDPR-native rather than bolted-on compliant.

The Legitimate Interest Assessment (LIA)

If you are building an outbound function for a European market, you should document your legitimate interest assessment. This is a short internal record that covers:

• What data you hold (name, email, job title, company).
• Why you hold it (prospecting relevant contacts for your offer).
• How you collected it (Apollo, LinkedIn, Clay enrichment from public sources).
• Why you believe the contact’s interests do not override yours (the email is relevant to their role, it is not intrusive, it is easy to opt out).

You do not file this with a regulator. You keep it in case of a complaint or audit. The ICO in the UK and the EDPB at EU level have both published guidance confirming that legitimate interest can apply to B2B marketing where the balancing test is met.

If you are running outbound into Germany, the Netherlands, or other markets with active DPAs, a documented LIA is practical protection, not just theory.

Bottom Line

GDPR is not a blanket ban on B2B cold email, but it is not a blanket permission either. Relevant, targeted outreach still needs a market-, recipient-, data-source- and campaign-specific assessment. Opt-out rights must be respected immediately; every email must identify you and give a clear way to stop.

Teams building outbound for European markets with this framework in place run cleaner, more effective campaigns than those treating compliance as an obstacle. The law and good outbound practice point in the same direction: relevance, transparency, and respect for the contact’s time.