GDPR-compliant cold email in the EU (2026): how to do outreach legally

Search “cold email templates” and you get American advice: scrape a list, blast it, add an unsubscribe link, done. In the EU that approach isn’t just tacky — parts of it are unlawful. But cold outreach isn’t banned either. Here’s how an EU freelancer can do it legally and effectively, which turn out to be the same thing.

Two rulebooks, not one

Cold email in the EU sits under two regimes: GDPR (how you process personal data — a named person’s work email is personal data) and the ePrivacy rules (electronic marketing messages). US “CAN-SPAM compliant” templates address neither. You need a lawful basis under GDPR and to respect the marketing rules.

Your lawful basis: legitimate interest, done properly

You can’t get consent before you’ve made contact, so cold B2B outreach usually relies on legitimate interest — but that’s not a free pass. To stand behind it, do (and keep) a short legitimate-interest assessment:

• A genuine interest — you have a real, relevant service for this kind of business.
• Necessity & proportionality — you’re contacting a relevant role at a relevant company, not a scraped list of 10,000 randoms. Targeted and small beats mass every time, legally and practically.
• Balance — your interest doesn’t override the recipient’s rights; role/business addresses and tight relevance help, personal Gmail addresses and irrelevance sink it.

What a compliant cold email needs

• Clear identity — who you are, your business, real contact details.
• A genuine, specific reason you’re emailing this person/company (not a mail-merged "Hi {first_name}").
• No deception — honest subject line and sender.
• An easy opt-out / objection — and you honour it immediately and permanently.
• No special-category data and no shady sourcing.
• Low volume, high relevance — this isn’t a numbers game in the EU.

Keep records: your assessment, where you got the contact, and any opt-outs. If someone objects, suppress them for good.

The country traps

GDPR is EU-wide, but marketing-email rules have national flavours. Germany is the big one: under the UWG, unsolicited advertising email generally needs prior consent even B2B, and it’s enforced — so the legitimate-interest route is risky for German recipients. Other countries vary in strictness. If a target market matters, check its national rules or get local advice before you send.

The honest takeaway for outreach

Cold email works far worse in the EU than the US gurus imply, and the compliant version — small, relevant, personalised — is the only version worth sending anyway. So the smarter client engine for an EU freelancer usually leans on warm intros, referrals, content and platforms, with tightly-targeted cold email as a supporting channel, not the whole strategy. The full client playbook is in how to get clients as a freelancer.

The takeaway

• Cold B2B email is lawful in most of the EU — conditionally. Two rulebooks: GDPR + ePrivacy.
• Use legitimate interest, documented — with genuinely relevant, proportionate targeting.
• Compliant = relevant, identified, easy opt-out, honoured objections, low volume.
• Germany effectively needs prior consent even B2B — treat it as a special case.
• Relevance serves law and reply-rate at once — and warm channels usually beat cold in the EU anyway.

Part of the money guide. See also how to get clients as a freelancer and the best freelance platforms for EU freelancers.