This is an operational overview, not legal advice. European marketing rules vary by country and carry real penalties, and a US or Asian company selling into Europe should take advice on the specific markets it is entering.
Two things surprise companies running outbound into Europe from outside it.
The first is that GDPR applies to them. Not to their European subsidiary, to them, in Austin or Bangalore or Sydney, because the regulation follows the data subject rather than the sender.
The second is that GDPR is not the rule that decides whether you may send the email. A separate layer of national law governs electronic marketing, it differs substantially country to country, and the Regulation that was supposed to harmonise it was withdrawn by the European Commission in early 2025. So the fragmentation is not a transitional state anyone is waiting out. It is the operating environment.
The two layers
Keep these separate, because conflating them is the source of most bad advice.
Layer one, GDPR. Governs whether you may hold and process a European person’s data. Applies extraterritorially where you offer goods or services to people in the EU or monitor their behaviour. Being outside Europe is not a defence.
Layer two, national electronic marketing rules, derived from the 2002 ePrivacy Directive. Governs whether you may send the message. The Directive required consent for unsolicited email to individual subscribers and left the business-to-business question to each member state, which is exactly why the picture is uneven.
You need both. A perfect GDPR position does not make an email lawful in a market that requires prior consent for B2B email, and consent does not excuse you from GDPR’s transparency obligations.
Layer one: holding the data
Your lawful basis is almost always legitimate interest
Consent is impractical for cold outreach, you cannot obtain consent from someone you have not contacted. The basis normally relied on for B2B prospecting is legitimate interest.
That basis is not self-executing. It requires a documented balancing assessment: your interest in the processing, the necessity of it, and the impact on the individual. The relevant factors are the ones you would expect, whether the contact is being approached in a clearly professional capacity about something plausibly relevant to their role, whether the data was obtained from a legitimate source, and whether the volume and persistence are proportionate.
The practical implication: a tightly targeted programme has a stronger legal position than a broad one, for the same reason it has a better reply rate. Emailing 400 people whose role plainly relates to what you sell is a defensible balancing exercise. Emailing 40,000 scraped addresses because the filter was loose is harder to defend on any of those factors.
The obligation almost nobody meets
GDPR requires that when you obtain personal data from a source other than the individual, you tell them, what you hold, where you got it, why you are processing it, your lawful basis, and their rights. Where the data is used to communicate with them, that information has to reach them no later than the first communication.
In practice this means your first cold email needs a transparency element: a short statement of where the data came from and a link to a privacy notice that covers prospect data specifically. Not the generic website notice written for customers, one that names data sourced from third-party providers and the legitimate-interest basis.
This is the most commonly missed European obligation in cold outreach, and it is also the cheapest to satisfy. Two lines in a footer and one page on your site.
Objection is absolute
A request to stop receiving direct marketing must be honoured, without a balancing test and without delay. “Remove me” means removed, across every channel and every tool you use.
Which makes cross-system suppression a compliance control rather than a hygiene nicety. A prospect who objects by replying to an email, and who then receives a LinkedIn message two weeks later because that channel runs in a different tool, is a straightforward failure. One suppression list, keyed to the person, synced everywhere.
Two structural obligations for non-EU senders
An EU representative. A controller outside the EU that is subject to GDPR generally has to designate a representative inside the EU, with a narrow exemption for processing that is occasional, low-risk and free of large-scale sensitive data. Whether a continuous outbound programme is “occasional” is exactly the sort of question to put to counsel rather than resolve optimistically. Many US companies running sustained European outreach have not considered it at all.
A record of processing activities. Mostly administrative, and it is the first thing requested if anyone ever asks questions.
The UK has a parallel regime post-Brexit with its own representative requirement. If you are selling into both, that is two sets of obligations rather than one.
Layer two: sending the message
Here is where the country-by-country reality bites. The shape of the landscape, in three groups:
| Group | Markets | B2B email position |
|---|---|---|
| Consent-first | Germany, Austria, Italy, Spain | Unsolicited commercial email generally requires prior consent, including to business recipients. Germany’s position under its unfair competition law is long-established and actively enforced, including by competitors. |
| Professional-relevance | France, Netherlands, Belgium, Nordics, Ireland | B2B email to a person at their professional address is generally permissible where the message relates to their professional function, with clear identification and a working opt-out. |
| Corporate-subscriber | UK | The marketing rules bite on “individual subscribers”. Emails to corporate subscribers sit outside that restriction, subject to UK GDPR. Sole traders and most partnerships count as individuals rather than corporates. |
Three consequences for how you actually run this.
Germany cannot be run on the same playbook as the UK. This is the single most important operational point on the page. A sequence that is fine for a London-based corporate recipient is a different proposition sent to a Munich recipient. Teams that treat “Europe” as one segment are usually running their Germany risk unknowingly.
Segment campaigns by country, not by region. Different lists, different sequences, different channel mixes. It is more work and it is the only version that is manageable.
The strict markets are not closed markets. They are markets where the first touch should not be unsolicited commercial email. LinkedIn, events, content, inbound, partner introductions and warm referrals all remain available, and in Germany specifically a LinkedIn-led approach is both lower risk and closer to how business relationships are actually formed there.
Calling and messaging
Phone. National do-not-call registries, permitted hours and recording-consent rules all vary, and several European markets require all-party consent to record. Check per market before the first dial. Cold calling compliance covers the landscape.
WhatsApp. Widely used for business in Southern Europe and barely used for it in Germany and the Nordics, with the same consent questions as email layered on top. WhatsApp outreach by region has the regional picture.
LinkedIn. Connection requests and messages on the platform are not electronic mail under these marketing rules, which is part of why LinkedIn is the pragmatic first channel in the consent-first markets. GDPR still governs the data you hold about the person.
The operational parts nobody mentions
Compliance is where the attention goes. These are what actually make or break European outbound.
Language. English works for technology buyers in the Netherlands, the Nordics and Ireland. It works considerably less well in France, Germany, Italy and Spain, and it works worst in exactly the markets where the formal rules are strictest. A German-language sequence written by someone who speaks German, not translated, outperforms an English one by a wide margin. Machine-translated outreach is visible and reads as carelessness.
Register and directness. German business communication is direct and expects substance early; the chatty American opener reads as unserious. French correspondence is more formal, and skipping the courtesy is noticed. Dutch recipients are direct to a degree that visitors sometimes find startling, and they reply honestly, which is useful. These are not stereotypes to lean on, and they are real differences in what a professional message looks like.
Titles and formality. Several languages distinguish formal and informal address, and getting it wrong is the equivalent of a misspelled name. In German-speaking markets, academic titles still matter in some sectors.
August, and the rest of the calendar. European holiday patterns are not American ones. August is substantially lost in France, Italy and Spain. Mid-July to mid-August is weak across Southern Europe. Germany varies by state. The weeks around Christmas and Easter are longer than US equivalents. A quarter planned without this produces a sending volume that looks fine and a reply rate that collapses for reasons nothing to do with the message.
Time zones. Europe spans three. Sending to Lisbon and Helsinki at the same local-send time means two different local times. Trivial to fix and frequently missed.
A practical sequence for entering Europe
If you are starting from outside, in this order:
- Pick two or three countries. Not “Europe”. Choose on market fit, then on how workable the rules are, the UK, Netherlands, Nordics and Ireland are the usual starting set for an English-language programme.
- Get advice on those specific markets before sending. Two or three countries is a tractable brief; twenty-seven is not.
- Write the prospect privacy notice and the transparency lines for the email footer.
- Sort suppression properly, one list, person-level, synced across every channel and tool.
- Build country-level campaigns with localised copy where the language requires it.
- Open the strict markets on LinkedIn rather than with cold email, and revisit when you can resource local-language outreach and have taken advice.
- Plan the calendar around European holidays before setting volume targets.
The short version
GDPR applies to you wherever you send from, and it is not the rule that decides whether the email may be sent. A separate national layer governs that, it differs by country, and the Regulation meant to harmonise it was withdrawn in 2025, so country-by-country is permanent.
Legitimate interest is the usual basis and it requires a documented balancing assessment, which a tightly targeted programme passes more easily than a broad one. Tell recipients where you got their data, no later than the first message. Honour objections immediately, across every channel. Check whether you need an EU representative.
Germany, Austria, Italy and Spain generally expect prior consent for commercial email including B2B. France, the Netherlands, Belgium, the Nordics and Ireland allow professionally relevant B2B email with a working opt-out. The UK turns on whether the subscriber is corporate or individual.
Segment by country. Open the strict markets on LinkedIn. Write in the local language where it matters, and plan around August.
Next: the outbound compliance guide, or selling into the US from APAC.
Frequently asked questions
Does GDPR apply to a US company sending cold email to Europe?
Yes. GDPR applies extraterritorially where you offer goods or services to people in the EU or monitor their behaviour, so being established outside Europe is not a defence. A UK equivalent applies separately post-Brexit.
Can you send B2B cold email in Germany?
Germany’s position is consent-first: unsolicited commercial email generally requires prior consent, including to business recipients, and it is actively enforced. The practical approach for German prospects is to open on LinkedIn or through warm channels and take local advice before any email programme.
What lawful basis covers cold B2B email under GDPR?
Legitimate interest, supported by a documented balancing assessment covering the professional context, relevance to the recipient’s role, the source of the data and the proportionality of volume. Tightly targeted programmes are easier to defend than broad ones.
What do most companies miss when emailing European prospects?
The transparency obligation. Where personal data is obtained from a third-party source and used to contact someone, they must be told what you hold, where it came from and their rights, no later than the first communication, which means a prospect-specific privacy notice, not the generic customer one.
Sources: European Commission withdraws ePrivacy Regulation proposal, Hunton · The ePrivacy Regulation is finally dead, Lewis Silkin