This article is general information, not legal advice. Rules change and your situation may differ; check with a lawyer before a large campaign.
The short answer
Business-to-business cold email is lawful in France, across the EU and in the UK when a few conditions are met. The recipient is contacted in a professional capacity, the message concerns their professional activity, the sender is identified, and the person can opt out easily. Business-to-consumer cold email is a different matter and generally requires prior consent.
The EU and GDPR
GDPR governs how you process personal data, and a professional email address is personal data. You need a lawful basis; for B2B prospecting that basis is usually legitimate interest. In practice that means your message must be relevant to the recipient’s role, you must tell them where their address came from if they ask, you must respect a refusal immediately, and you must not keep data longer than needed.
The ePrivacy rules layered on top vary by country. France’s CNIL position is that professionals can be prospected without prior consent when the message relates to their function and they can object; many EU countries follow the same logic for B2B.
The UK
Under PECR, unsolicited marketing email to corporate subscribers (limited companies, LLPs) does not require consent, though you must identify yourself and offer an opt-out. Sole traders and partnerships are treated as individuals, where consent is required. UK GDPR applies to the personal data in the same way as in the EU.
What this means in practice
- Target companies, not private individuals, and address the person by their role.
- Say who you are and why you are writing, in the first email.
- Make opting out one reply away, and honour it the same day.
- Keep a suppression list and check new lists against it.
- Do not buy lists of unknown origin and send to them unchanged.
- Keep volumes low; the law is one reason, deliverability is the other.
The honest risk
The legal risk of a careful B2B campaign is low. The reputational risk of a careless one is high, and it does not need a regulator: it needs one annoyed recipient who knows your clients.