Is B2B cold outreach legal in Europe? Belgium, the Netherlands and Germany (2026)
Tips
The short answer
Cold outreach to businesses is not prohibited as such in Belgium, the Netherlands or Germany. What differs is which channel you are allowed to use first, and that difference runs the opposite way in each country. In Belgium you may email a company's own address without consent but must screen every phone number against a do-not-call register that covers business lines too. In the Netherlands you may call a BV or an NV without consent but generally may not send that same company a cold email. In Germany you may call a business when you can point to a concrete reason it would want the call, but a first cold email needs express consent with no business exception at all.
That is the whole article in four sentences. The rest sets out the statutes, the enforcement record and what the rules mean for the way you build and work a list. Checked on 11 September 2026. This is not legal advice, and it does not replace your own counsel.
Two sets of rules, not one
Most confusion about European outreach comes from treating "GDPR" as the answer to every question. It is one of two layers.
The GDPR governs how you process a person's data. A named person's work email, direct line and job title are personal data. Recital 47 states that "the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest" (GDPR Recital 47). The Belgian Data Protection Authority confirms that direct marketing qualifies as a legitimate interest, and sets three conditions on relying on it: the processing must be necessary for that interest, the balance of interests must weigh in your favour with particular attention to what the person can reasonably expect, and the right to object must be offered clearly "vanaf het eerste contact", from the first contact, and honoured absolutely when invoked (Data Protection Authority).
National law governs which channel you may use. Each country implements the ePrivacy directive its own way, and those national rules, not the GDPR, decide whether a cold email or a cold call is permitted. They are also the rules with the regulators, the registers and the fines attached. Everything below is that second layer.
Belgium: email is open, the phone is gated
Cold email
Advertising by electronic mail is opt-in under article XII.13 of the Code of Economic Law, with two exceptions set by the Royal Decree of 4 April 2003: existing customers for similar products, and the addresses of legal persons.
That second exception is the one that matters for prospecting. The FPS Economy explains that you may send unsolicited commercial email to addresses that clearly concern only the legal person, such as info@ or sales@, but not to an employee's personal work address without consent, and that the burden of proving the exception applies lies with the sender (FPS Economy).
So the Belgian rule is not "B2B email is allowed". It is "email to the company is allowed, email to the person is not". The practical consequence for a list is that the address type is a compliance field, not a formatting detail.
Cold calling
Belgium runs a national do-not-call register, the Do Not Call Me list, under articles VI.110 to VI.115 of the Code of Economic Law and the Royal Decree of 12 May 2015. Three features of it catch teams out.
It covers businesses. The operator states plainly that "every Belgian telephone subscriber, individuals as well as companies, can add their number to the list", and that the legislation "applies to all telephone subscribers, which means it applies to both B2C and B2B campaigns" (Do Not Call Me). None of the other countries in this article has an equivalent B2B screening list, and in Belgium the check is not optional.
You have to be able to prove you screened. The obligation is framed as evidential: "you must be able to demonstrate that you have consulted and checked the Do Not Call Me list". A screening step that lives in one person's spreadsheet does not meet that standard.
Registration outranks the customer relationship. A registered number may not be called for a telephone marketing campaign even if the subscriber is an existing customer, unless that customer has given explicit permission. Purely informational calls, such as confirming an appointment or flagging a problem with a product, fall outside the regime.
Sanctions run from a warning to fines of up to €80,000.
Post and LinkedIn
Postal mail is the least regulated channel of the three countries and remains a legitimate first touch in Belgium, subject to the GDPR duties above. Whether LinkedIn messages count as electronic messages under these statutes is unsettled, and LinkedIn's own terms apply on top. Treat it as an open question rather than a safe channel. Note that the extension tools used to lift contact details out of LinkedIn have their own compliance history; the record is in our roundup of B2B prospecting tools for European teams.
What is changing
The Belgian federal coalition agreement of early 2025 signalled a move from the current opt-out regime to opt-in for telephone marketing. As of 11 September 2026 that change is not law, and the screening duty above is the one in force. No timetable has been published, and what it would mean for the Do Not Call Me list has not been set out. Build a Belgian calling programme so that a consent requirement can be added later without redesigning it.
The Netherlands: the phone is open, email is gated
The Dutch position is close to the mirror image of the Belgian one, and the statute is compact enough to read directly. Article 11.7 of the Telecommunications Act does the work.
Cold email
Paragraph 1 bans automatic calling and communication systems without human intervention, fax and electronic messages for unsolicited commercial communication "tenzij de verzender kan aantonen dat de desbetreffende eindgebruiker daarvoor voorafgaand toestemming heeft verleend", unless the sender can prove the end user gave prior consent. "End user" here is not limited to consumers, so a company is covered.
Paragraph 3 then carves out one narrow business exception. No prior consent is needed to send to a legal person, or to a natural person acting in the course of a profession or business, if the sender uses electronic contact details "die door de desbetreffende eindgebruiker voor het ontvangen van ongevraagde communicatie voor commerciële, ideële of charitatieve doeleinden zijn bestemd en bekendgemaakt", which the end user has designated and published for receiving unsolicited commercial communication, and uses them in line with the purposes attached to them. A second limb covers recipients established outside the European Economic Area, provided the rules of that country are complied with.
Paragraph 4 keeps the familiar existing-customer exception for contact details obtained when selling a product or service (Telecommunications Act art. 11.7).
Read paragraph 3 carefully, because it is narrower than the Belgian rule it superficially resembles. Belgium asks whether the address belongs to the legal person. The Netherlands asks whether the end user designated and published that address for receiving unsolicited commercial messages. An info@ address published so customers can ask questions is not obviously the same thing. In practice the Dutch exception is far narrower than the Belgian one it resembles, and misreading it as a general B2B carve-out is the most common error we see.
Cold calling
Paragraph 2 extends the ban to other means, meaning live calls, but only "aan natuurlijke personen", to natural persons. Incorporated companies are therefore outside it, which is why calling a BV or an NV remains permitted while the rules for people have tightened twice.
Because the ban covers natural persons, sole traders and partnerships fall inside it while incorporated companies do not. Calling consumers has required prior consent since 1 July 2021, and from 1 July 2026 the exception that allowed companies to call their current and former customers is gone as well. The ACM describes the change as extra protection for "consumenten en kleine ondernemers (zzp'ers en vof's)", consumers and small entrepreneurs, and confirms the narrow carve-outs that remain: charities, lotteries that give money to charities, and publishers of newspapers, weeklies and magazines may still call existing and former customers with an offer (ACM, 25 June 2026). The ACM also confirms that the spam rules for email, SMS and voice messages are unchanged by the July 2026 reform, and that investigations into companies are already running.
Sole traders accounted for 1,788,559 of the 2,599,668 establishments in the Dutch Business Register on 1 January 2026 (KVK), so the legal-form field decides your Dutch channel plan. A BV gets a call. A sole trader or a partnership does not, unless you have consent.
Post and LinkedIn
As in Belgium, postal mail is the lightly regulated channel and LinkedIn is governed by contract rather than statute. Where a Dutch programme has no permitted electronic first touch, those two plus a call to an incorporated company are what is left.
Germany: calls are possible, email is not
Cold email
Section 7(2) No. 2 of the Act against Unfair Competition treats advertising by electronic mail without the addressee's prior express consent as an unacceptable nuisance. There is no business exception. Section 7(3) allows email to an existing customer under four cumulative conditions: the address was obtained in connection with the sale of goods or services, it is used for direct advertising of the sender's own similar goods or services, the customer has not objected, and the customer is told clearly at collection and on every use that they may object at any time (UWG § 7).
For a prospecting team the conclusion is blunt. A first cold email to a German company you have never sold to is not permitted, whether you write to info@ or to a named person.
Cold calling
Section 7(2) No. 1 splits by recipient. Telephone advertising to a consumer requires prior express consent. Telephone advertising to "anderen Marktteilnehmern", other market participants, meaning businesses, requires at least their presumed consent, the "mutmaßliche Einwilligung".
Presumed consent is a real test, not a formality. German case law requires concrete factual circumstances from which a material interest of the called business in this particular offer can be inferred, such as the company continuously needing the goods or services in question. It is explicitly not enough that the product might be useful to the business, because that reading would make telephone advertising to companies effectively unlimited. An existing business relationship supports the inference. Once it is clear the recipient has no interest, presumed consent cannot be relied on again.
Translated into a workflow, that means a German cold call has to be researched before it is placed. A signal, a vacancy, a register change, a technology in use, something specific to that company, is what turns a call from a nuisance into one with a defensible basis. This is the country where a signal-led list stops being a productivity nicety and starts being a compliance argument.
What it costs to get it wrong
Two different mechanisms, and they are often confused.
Regulatory fines under section 20 of the UWG reach €300,000 for telephone advertising to consumers without their prior express consent, €50,000 for failing to document and retain advertising consents as section 7a has required since October 2021, and €100,000 for the remaining offences. The Bundesnetzagentur enforces the advertising-call and documentation offences; the Federal Office of Justice handles the rest (UWG § 20). The fine attaches to the absence of a consent the law requires. A B2B call that fails the presumed-consent test is pursued through the competition route below, not through this fine. In 2025 the Bundesnetzagentur received 39,842 written complaints about unlawful advertising calls, up 6% on 37,561 the year before, concluded 13 larger fine proceedings totalling more than €1.09 million against €1.37 million the previous year, and sanctioned breaches of the consent-documentation duty for the first time. Individual decisions include €210,000 against an energy company on 18 December 2025 and €50,000 against a financial and insurance provider on 9 March 2026 (Bundesnetzagentur).
Civil enforcement is the one that touches B2B outreach most often. Unlawful cold email and calls that fail the presumed-consent test are unfair competition, which competitors and competition associations can pursue by warning letter and injunction, with costs attached. The regulator is not the only party watching, and in B2B it is usually not the first.
What this means for the way you build a list
Five changes turn the rules above into something a team can actually run.
Make legal form a column, and make it decide the channel. A Dutch BV and a Dutch eenmanszaak take different first touches. So do a Belgian BV and the named person who works there. If your list does not carry legal form, your sequence cannot branch on it, and the rule becomes a memo nobody follows. Registers and register-based providers carry this field, which is one reason such a list is easier to run compliantly than a bought file. Our guide to generating B2B leads in Europe covers the sourcing side in six steps.
Carry the address type, not just the address. Generic legal-person address or named individual is a legal distinction in Belgium and a practical one everywhere. Record which you hold.
Put do-not-call screening inside the workflow. Belgium requires you to demonstrate the check. The only version of that which survives an audit is an automated step in the pipeline with a timestamp, not a monthly export.
Record the basis and the source per contact. If you cannot say where a record came from and on what basis you are contacting it, you cannot defend the programme, and you cannot answer an objection properly either. This is the same discipline as ordinary data hygiene, applied to lawfulness.
Write one sequence per country, and treat Germany as research-led. The presumed-consent test rewards exactly what good prospecting does anyway: a specific reason, tied to that company, for calling this week.
This is where Bizzy fits, and it is worth being precise about it. Bizzy builds company data for 33 European countries: directly from the official registers in most of them, and through Creditsafe in eleven, Germany and Austria among them (Bizzy). It carries legal form and activity codes as native fields, layers on buying signals such as hiring activity, funding, leadership changes and website visits, and offers do-not-call cross-checking where local law requires it, including Belgium and the Netherlands (Bizzy GDPR). What it does not do is give you a legal basis. No tool does. It gives you the fields the rules are built on.
Five things teams get wrong
"The GDPR bans cold email." It does not. The GDPR sets conditions for processing personal data, and Recital 47 expressly contemplates direct marketing as a legitimate interest. Whether you may send the email is decided by national ePrivacy rules, which vary as shown above.
"B2B is exempt." Only in parts. Dutch article 11.7(1) covers legal persons. German section 7(2) No. 2 has no business exception. Belgium's do-not-call regime explicitly covers B2B campaigns. The exemptions that exist are narrow and specific.
"A bought list comes with a legal basis." Buying a file is legal; using it is regulated exactly as if you had built it yourself. The seller's consent record, if any, is rarely transferable to you. See buying a Dutch business address list for what a file actually contains.
"An unsubscribe link makes it legal." An opt-out is required in several of these regimes, and satisfies none of them on its own. Where consent is the condition, its absence is the breach, whatever the footer says.
"One European sequence is enough." The three countries in this article disagree with each other on both electronic channels. A single sequence sent to all of them is, by construction, unlawful in at least one.
Read next: B2B cold calling in Europe, from the list to the meeting.
Read next: Sales conversations: 10 questions that make a cold call work.
Frequently asked questions
Is cold calling a company legal in Belgium?
Yes, with a mandatory step first. You must screen the number against the Do Not Call Me list, which covers business subscribers as well as consumers, and you must be able to demonstrate that you screened. Registered numbers may not be called for marketing even if they are existing customers, unless they have given explicit permission. Fines reach €80,000.
Can I cold email a Dutch company?
Usually not without consent. Article 11.7(1) of the Telecommunications Act covers legal persons, and the business exception in paragraph 3 applies only to contact details the recipient has designated and published for receiving unsolicited commercial communication. A generic address published for customer questions does not automatically qualify. Calling an incorporated company is the more reliable Dutch first touch.
Is cold calling allowed in Germany without consent?
Calling a business is allowed on presumed consent, which requires concrete circumstances indicating that this company has a material interest in your specific offer. A general assumption that your product could be useful is not sufficient. Calling a consumer requires prior express consent, and breaches carry regulatory fines of up to €300,000.
Does the GDPR apply to B2B contact data?
Yes. A named employee's work email, direct line and job title are personal data. You need a lawful basis, usually legitimate interest after a documented balancing test, you must inform the person, and you must offer and honour the right to object from the first contact. The national rules above then decide which channels you may use.
What changed in Dutch telemarketing in July 2026?
The exception that let companies call their current and former customers without consent was removed, extending the opt-in regime that has applied to consumers since July 2021. It covers consumers and small entrepreneurs, meaning sole traders and partnerships. Charities, charity lotteries and press publishers keep a narrow exception. The email spam rules were not changed.
Which channel works everywhere?
Postal mail. LinkedIn is an open question rather than a safe default. Beyond those, there is no single compliant European first touch: Belgium points you to email at the company address, the Netherlands to the phone for incorporated companies, and Germany to a researched call. Plan by country, not by campaign.
Where do the rules for other European countries sit?
France, Austria and Switzerland are covered alongside these three in our guide to generating B2B leads in Europe, which sets out the register, the channel rule and the source for each of six countries. For Belgium specifically, the prospecting guide for Belgium goes deeper on sourcing and sequencing in that market.
This article describes public rules as they stood on 11 September 2026 and is not legal advice. Outreach law in all three countries is actively changing; confirm the current position with your own counsel before launching a programme.
