Is B2B cold email in Germany legal? What section 7 UWG actually says

The GDPR is not the bottleneck

Conversations about cold outreach almost always circle the GDPR. It governs whether you may process a contact's data, and legitimate interest gives you a basis there that people argue about but nobody rejects outright.

The tighter constraint sits elsewhere: the German act against unfair competition. Section 7(2)(2) UWG treats advertising by electronic mail without the recipient's prior express consent as an unreasonable nuisance. With no distinction between private and business addresses.

That surprises people, because sales conversations tend to claim the opposite. Anyone telling you that B2B cold email is unproblematic has either not read the statute or is hoping that you have not.

The narrow exception

Section 7(3) UWG allows advertising without consent when four conditions come together: you obtained the address in connection with a sale to that customer, you are advertising your own similar goods or services, the customer has not objected, and they were clearly informed of their right to object both when the address was collected and on every use.

That is an existing-customer rule. It does not fit a recipient who has never bought anything from you. Anyone claiming this exception covers B2B in general is confusing it with the rule for telephone advertising, where presumed consent can be enough when calling a business.

That confusion is the most common error of reasoning in this market. For the telephone, section 7(2)(1) UWG does say that presumed consent suffices for other market participants. For email that clause is absent. The legislator did not forget it, they meant it.

A single email can be enough: the Federal Court of Justice

A common argument runs that one single, well-made mail cannot seriously bother anyone. The Federal Court of Justice (BGH) saw it differently. Its order E-Mail-Werbung II of 20 May 2009 (case I ZR 218/07) concerned one unsolicited advertising email sent to a law firm. According to the court, even that single mail without prior express consent can be an unlawful interference with the recipient's established business.

The reasoning is sober: if the single mail were allowed, mails from many senders would add up, because sending is cheap and easy to automate. So it does not matter whether you write only once. The decision is old, but it is still cited as the leading case, and nothing about the consent requirement for email advertising has been relaxed since.

Email, phone, letter, LinkedIn: the channels compared

For B2B cold outreach the channels are not treated equally in law. The overview below summarises the German position. It is a simplification and does not replace a case-by-case review.

On the phone: presumed consent is no blank cheque. Courts usually require a concrete reason from which the business's interest can be inferred. A general need that any company might have is usually not enough.

On LinkedIn: we are not aware of a BGH decision that expressly classifies LinkedIn direct messages. In a notice order of 3 May 2023 (18 U 154/22) the Higher Regional Court of Hamm stated that messages via services such as Xing, Facebook, LinkedIn or WhatsApp fall under the concept of electronic mail. The CJEU also reads the concept broadly. Anyone being sold LinkedIn as the legally safe alternative to email should therefore be sceptical.

The GDPR side: legitimate interest, duty to inform, right to object

Alongside the UWG, the GDPR applies, and it follows its own logic. The legal basis for processing contact data for prospecting is usually Article 6(1)(f) GDPR, legitimate interest. Recital 47 says expressly that direct marketing may be regarded as a legitimate interest. That is a may, not an automatic yes: your interest has to be balanced against the interests of the person you write to, and you should record that balancing test in writing.

What matters is how this relates to the UWG. The GDPR basis does not make a mail lawful under competition law. Conversely, it is often argued in practice that advertising which is unlawful under section 7 UWG will struggle to survive the Article 6(1)(f) balancing test too. So each level has to hold up on its own.

The biggest practical gap in many campaigns is the duty to inform under Article 14 GDPR. It applies whenever you did not collect the data from the person themselves, so for bought data sets, research tools, websites or directories. If the address is used to communicate with the person, you have to inform them at the latest at the time of the first communication (Article 14(3)(b)). That covers, among other things:

• who the controller is, with contact details and the data protection officer where there is one,
• the purpose and legal basis of processing, including the legitimate interest pursued,
• which categories of data are processed and which source they come from,
• recipients, storage period and the data subject's rights, including access, erasure, objection and complaint to a supervisory authority.

In practice a short, clear paragraph in the first mail with a link to a full privacy notice is usually enough. The exception for disproportionate effort in Article 14(5) generally does not help with direct outreach, because anyone who is writing anyway can also inform.

Then there is the right to object under Article 21 GDPR. Anyone can object to direct marketing at any time (paragraph 2), and after an objection their data may no longer be processed for that purpose (paragraph 3). Unlike other objections there is no balancing here. Under Article 21(4) the right has to be brought explicitly to the person's attention at the latest at the first communication, clearly and separately from any other information.

A sentence such as “You can object to the use of your data for marketing at any time, a short reply is enough” belongs visibly in the first mail, not hidden in the footer.

Addresses from LinkedIn, from an imprint, from a trade fair

The most common follow-up is whether a publicly available address changes things. For the GDPR the source does matter. For section 7 UWG it does not: the provision turns on the absence of consent, not on how hard the address was to find.

An address in an imprint exists so the company can be reached, not so it can be advertised to. The same goes for generic addresses such as info@ or contact@: they are business addresses, and publishing them does not amount to consent to advertising. And a business card handed over at a trade fair is something different from a stack of cards out of a prize draw, depending on what was said. Anyone wanting to rely on that should be able to document the conversation.

In short: the source improves your position under the GDPR and changes little about the UWG question. The two levels are assessed separately, and both belong in the conversation with your counsel.

What actually happens when someone complains

The realistic consequence is not a regulator but a letter from a lawyer. A recipient or a competitor sends a warning notice (Abmahnung) and demands a cease-and-desist undertaking with a penalty clause, plus reimbursement of legal costs. A competitor relies on the UWG, while a business that received the mail usually relies on the protection of its established business under the Civil Code, as in the BGH case.

What this costs depends mainly on the value in dispute, which courts set very differently for unsolicited advertising. There are no reliable averages, so we give no figures. The legal fees for a single warning notice are rarely a threat to a business. The undertaking is the more expensive part.

Because signing one binds you going forward. If it happens again a contractual penalty falls due, and that is quickly a good deal higher than the first warning. Which is why such a letter should never be answered without a lawyer, however conveniently pre-drafted the enclosed text looks. It is often drawn wider than necessary, and the deadline is short, but that is no reason to sign unchecked.

That is no reason to panic, but it is the reason this decision belongs to you and not to your agency.

What belongs in every mail

Independently of the consent question, business emails are subject to the same mandatory details as business letters on paper. Depending on the legal form, that follows from section 37a HGB for registered merchants, section 35a GmbHG for the GmbH and section 80 AktG for the stock corporation. The UG is a form of GmbH and also falls under section 35a GmbHG.

• company name and legal form, registered seat or place of business,
• the registry court and commercial register number,
• for a GmbH all managing directors, for an AG all board members and the chair of the supervisory board, each with surname and at least one first name written out,
• an identifiable sender and a valid address to which the recipient can send an opt-out request at no extra cost. Section 7(2)(3) UWG requires this expressly.

Two more things are not required everywhere but always sensible: a sender who is a real person and answers replies, and one sentence letting the recipient opt out. Both cut the likelihood of a complaint substantially, and both help deliverability too.

And one obvious point that is nonetheless often broken: anyone who objects comes off the list, immediately and permanently, across every campaign and every sending domain. A second mail after an objection is the surest route to a lawyer's letter.

Documenting objections so it holds up

In a dispute what counts is not what you intended but what you can prove. An objection should therefore be recorded so that it can later be traced when it arrived and what happened next. A central suppression-list entry with a few fields has proved useful:

• the email address and, if requested, the whole domain,
• date and time of receipt and the channel the objection came through,
• the wording or a screenshot of the reply,
• when and by whom the address was blocked in every tool, and whether a short confirmation was sent.

The suppression list itself is the exception to deletion: anyone who never wants to be contacted again has to stay on a list for that to work. Keep only what is necessary there, and settle retention with your data protection adviser.

Who is liable when an agency sends

This is the question most often overlooked. Hiring an agency does not hand over the responsibility. Section 8(2) UWG is clear here: if an agent commits the infringement, the injunction claim also lies against the owner of the business. The advertiser is whoever benefits, and that is you. The agency itself can be pursued as well.

So settle three things in writing before the start: who bears the cost if a lawyer's letter arrives? Who decides on audience and copy, and who signs them off? And what happens to the data when the engagement ends? If the agency processes personal data on your behalf, a data processing agreement under Article 28 GDPR belongs in the package as well.

An agency that waves these questions away is a warning sign. We say plainly that the assessment sits with you and your counsel and that we work to your instructions. Anything else would be a promise we could not keep.

Setting up a campaign as legally safe as possible

None of this means nobody runs cold email. It means a residual risk remains and that you should know about it before starting a campaign, rather than discovering it afterwards. Without consent it cannot be removed entirely, but it can be reduced considerably:

1. Assess the risk with counsel before any budget is spent, and record the decision in writing.
2. Draw the audience narrowly: role, industry and a concrete reason that makes the message relevant to exactly this person.
3. Split contacts by country and treat Austria and Switzerland under their own rules.
4. Document the source of every record, because Article 14 GDPR requires it.
5. Record the legitimate interest balancing test under Article 6(1)(f) GDPR in writing.
6. Before every send, check against the suppression list, existing customers, open quotes and, for Austria, the ECG list.
7. Put the mandatory details, a real sender, an opt-out route, the privacy notice and the objection notice into the first mail.
8. Write short and personal, with no attachment, and a few follow-ups rather than endless sequences.
9. Block objections in every tool within one working day and document them as described above.
10. Review complaint and opt-out rates weekly and pause the campaign if they rise.

The risk falls with the quality of the approach. In our experience a mail to a person whose role and situation were visibly researched, with a clear sender, no attachment and a way to be left alone in one sentence, rarely triggers a complaint. A bulk mail to a bought list regularly does.

Complaint rate is therefore also a quality metric. Recording it systematically shows early whether the audience is drawn too wide. When it rises that is not a legal problem to sit out, it is a sign the list does not fit.

Austria and Switzerland are not the same

Treating the German-speaking region as one market overlooks that each country has its own rules. In Austria, section 174(3) of the Telecommunications Act 2021 provides that sending electronic mail for direct marketing without the recipient's prior consent is unlawful. The provision does not distinguish between consumers and businesses, so consent is needed towards companies too.

The existing-customer exception in section 174(4) resembles the German one. It falls away, among other things, if the recipient has entered themselves in the list under section 7(2) of the E-Commerce Act. This so-called ECG list is kept by the regulator RTR, and both individuals and companies can register free of charge. It has to be checked before sending.

Switzerland, in Article 3(1)(o) of its unfair competition act, generally requires prior consent for bulk email advertising, with an exception for existing customers and similar offers. Every send needs a correct sender and a notice of an easy, free way to unsubscribe. The federal authorities focus on automated sending, not on a minimum number of mails.

Under Article 3(1)(u), an asterisk next to an entry in the telephone directory means that someone does not want advertising messages from companies they have no business relationship with. People with no directory entry at all are treated the same. In practice this mainly concerns advertising calls, but it says a lot about the recipient's stance.

For a campaign that means splitting the audience by country, checking the relevant lists, and when in doubt building for the strictest of the three regimes. That costs some preparation and saves the argument afterwards.

The questions for your lawyer

First: how do you assess the risk for our specific audience and offer? Second: what has to appear in every mail, and how do we word the notice under Articles 14 and 21 GDPR? Third: how do we document objections so it holds up in a dispute? Fourth: who is liable when an agency sends in our name?

Four questions, one appointment, and you know what you are getting into. That is considerably cheaper than the alternative, and it is the one part of this article we genuinely urge you to act on.

Once the assessment is done and you want help with execution: how we set up campaigns, with a narrow audience, clean documentation and to your instructions, is described on our B2B lead generation page. Working this way we have booked more than 2,000 meetings since 2023.

Frequently asked questions

Sources

1. Section 7 UWG, unreasonable nuisance (gesetze-im-internet.de)
2. GDPR, Regulation (EU) 2016/679, Articles 6, 14, 21 and Recital 47 (EUR-Lex)
3. BGH, order of 20 May 2009, I ZR 218/07, E-Mail-Werbung II (dejure.org)
4. OLG Hamm, notice order of 3 May 2023, 18 U 154/22 (NRWE)
5. Section 174 TKG 2021, unsolicited messages (Austrian RIS)
6. RTR, ECG list under section 7 E-Commerce Act