Is Cold Email Legal in Germany? GDPR & UWG §7 Compliance Guide 2026

German commercial email requires a case-specific review. GDPR governs the processing of personal data, while UWG §7(2) No. 2 generally requires prior express consent for advertising by email, subject to the narrow existing-customer exception in §7(3).

Workflow example:

Germany applies a distinct rule to advertising by email. A GDPR basis for processing contact data does not, by itself, authorise a message under UWG §7.

Germany applies two separate legal frameworks to email outreach - GDPR and UWG (Gesetz gegen den unlauteren Wettbewerb, the Unfair Competition Act). Understanding the distinction between these two laws is the single most important thing you need to know before prospecting into the German market.

This guide organises the main legal questions and links to primary sources. It is not legal advice, and the campaign facts still need review by qualified German counsel.

Two Laws, Two Questions: GDPR vs. UWG

Germany applies two separate legal frameworks to outbound email, and they answer different questions. Start with the current official text of UWG §7 and the GDPR.

GDPR requires a separate processing analysis. Recital 47 says that processing for direct marketing may be a legitimate interest; it is not a blanket authorisation. Document necessity, the balancing test, transparency, data minimisation, and objection handling for the specific campaign.

UWG Section 7 blocks the actual email. This is Germany's implementation of the ePrivacy Directive, and it functions as "lex specialis" - a specialized law that overrides GDPR on the specific question of electronic communications. UWG Section 7(2) No. 2 states that email advertising without prior express consent constitutes "unreasonable harassment." This applies regardless of whether the recipient is a private individual or a business.

The practical consequence is clear: a documented basis for processing contact data does not by itself authorise an advertising email. You need to assess both frameworks.

The Double Opt-In Question

The common claim that Germany always requires double opt-in needs nuance. The statute requires prior express consent for advertising by email; the evidence needed to prove that consent depends on the facts and current case law.

The statute: Neither GDPR nor UWG Section 7 explicitly mandates double opt-in as a method. UWG Section 7(2) requires "prior express consent" for email marketing but does not specify how that consent must be verified.

The evidence question: German case law makes proof of consent important, and double opt-in is commonly used to create an audit trail. It is not an irrebuttable guarantee that the underlying consent was valid, nor should unrelated decisions be cited as making it the only accepted method.

The bottom line: have German counsel review the wording, collection event, confirmation message, and retained evidence. The mechanism alone does not cure a consent that was not specific, informed, and properly documented.

Is There a B2B Exemption for Cold Email in Germany?

For advertising by email, UWG §7(2) No. 2 generally requires prior express consent without creating a general B2B exemption. Other channels have different, fact-specific rules.

National implementations and regulator guidance differ. Do not carry a rule from France, the Netherlands, the United Kingdom, or another market into Germany without a current jurisdiction-specific review.

In Germany, none of these exemptions exist for email. A B2B sales email to a CEO at their corporate address requires the same level of consent as a promotional email to a consumer. This also applies to generic corporate addresses (info@, kontakt@). German courts (OLG Munich, 29 U 857/12) have confirmed that UWG Section 7(2) protects businesses from unsolicited commercial email at any address, personal or generic.

How Germany Compares to Other EU Markets

The Existing Customer Exception: UWG Section 7(3)

UWG Section 7(3) provides a narrow existing-customer exception. Its four cumulative conditions must all be met; sender identification and a valid objection address are separate requirements under Section 7(2) No. 3. Consult the current official text of UWG §7.

1. Prior business relationship. A real contractual relationship must exist. The email address must have been obtained directly from the customer in the context of a sale or service agreement. Merely requesting information, leaving items in a shopping cart, or creating an account without completing a transaction was historically not sufficient.
2. Similar products or services only. You can only advertise products or services that are similar to what the customer already purchased. German courts apply a strict standard: products must be "interchangeable" or serve "the same or at least a similar need or purpose." You cannot use this exception to cross-sell your entire product range.
3. No prior objection. The customer must not have previously objected to receiving marketing communications from you.
4. Clear opt-out in every email. The customer must be informed of their right to object at no cost, both at the time of data collection and in every subsequent email.

Separate sender requirement: the message must clearly identify the sender and provide a valid address where the recipient can request that messages stop. Confirm any additional Impressum duties with German counsel.

The ECJ Inteligo Media Judgment (13 November 2025)

In Case C-654/23, the Court examined a specific model in which registration for an online publication gave access to free content while additional articles and analysis were sold. It held that the newsletter at issue could fall within Article 13(2) of the ePrivacy Directive.

The judgment is not a blanket rule that every SaaS free trial or freemium signup counts as a sale. Teams should obtain German legal advice before relying on the existing-customer exception for a non-paying registration.

The Court also addressed the relationship between the ePrivacy Directive and GDPR. The underlying processing still requires a documented legal analysis; satisfying an email-marketing exception does not remove every GDPR obligation.

Five Outreach Options to Review for Germany

UWG §7 sets channel-specific rules, while GDPR governs the underlying processing. None of the options below is automatically lawful; use them as a review checklist with German counsel.

Option 1: Business Phone Call

Presumed consent under UWG §7(2) No. 1 is fact-specific. Industry relevance, an intent score, or a website visit alone does not establish it. If counsel approves the call, define the permitted wording and the evidence required for any later email permission.

Option 2: Inbound Consent Collection

Forms, webinars, events, and other inbound flows can collect permission, but the wording, scope, confirmation method, transparency, and retained evidence must be reviewed together. Double opt-in can support proof; it does not validate defective consent by itself.

Option 3: Existing-Customer Email

Use UWG §7(3) only when all four cumulative conditions are documented. Do not assume that a free trial or freemium registration qualifies; the Inteligo Media judgment is fact-specific.

Option 4: LinkedIn Contact

Assess the connection request or message, platform rules, data source, and advertising character separately. A connection acceptance is not permission for advertising by email. If counsel approves a route to collect email permission, retain the required channel-specific evidence.

Option 5: Postal Mail

Postal outreach still requires a GDPR processing basis, transparency analysis, and review of applicable competition-law rules. Do not treat it as a blanket safe harbour.

Intent Data and Cold Email: What Signal Tools Can and Cannot Do

Intent platforms are everywhere in B2B sales: 6sense, Bombora, Clearbit Reveal, LinkedIn Sales Navigator alerts, Leadfeeder, RB2B, and newer AI-powered tools like Sortlist Radar. They identify which companies visit your website, research your category, or show buying signals on third-party sites. The question every sales team asks when they switch these tools on for the German market: "If a German company visits our pricing page three times this week, can we just add the contacts to an Overloop sequence and hit send?" [LinkedIn]

The answer is no. And the reasoning is the most misunderstood point in German B2B compliance.

Why intent signals do not unlock cold email in Germany

UWG Section 7(2) treats channels differently:

• Section 7(2) No. 1 allows "presumed consent" (mutmassliche Einwilligung) for B2B phone calls when there are concrete, specific indications that the business would welcome the call.
• Section 7(2) No. 2 requires "prior express consent" for email. No presumption, no exception for intent data, no relief for "warm" leads.

A Radar signal, a Bombora surge, a pricing-page visit, or a comparison-site request can help prioritise research. It does not automatically establish presumed consent for a phone call, and it does not replace prior express consent for advertising by email. Assess the signal's provenance, the identity resolution, and the proposed channel separately.

Mentioning the signal in the email makes it worse

Sales teams often try to turn the intent signal into email copy: "Hi Max, I noticed your team visited our pricing page twice this week." That wording raises several separate questions that require legal review:

1. UWG Section 7(2) No. 2: whether the advertising email has prior express consent or fits the narrow existing-customer exception.
2. TDDDG and GDPR: how the visit was measured, whether device information was accessed, and what personal data was processed.
3. Transparency: what information must be provided about the source, purpose, recipients, and retention of the data.

Referencing observed behaviour can make the data trail obvious to the recipient. Do not use it as copy before the collection, identity-resolution, transparency, and channel analyses have been approved.

Risk by channel when acting on intent signals

A reviewable intent-to-email workflow

The signal is a research trigger, not a permission slip. Route it through a documented legal and operational review before choosing a contact channel.

1. Signal fires. Your intent platform flags Company X: three visits to the pricing page, a demo comparison request on a third-party site, a surge in category research, an AI Search query matching your keywords.
2. Review the signal. Confirm its source, identity resolution, processing basis, transparency requirements, and retention.
3. Approve a channel. German counsel determines whether the facts support a phone, LinkedIn, postal, or other contact route; do not treat the score alone as approval.
4. Record channel-specific permission. If the interaction produces valid permission for email, retain the evidence and scope required by the approved workflow.
5. Release the email step. Configure the sequence only after the documented approval event has been tested.

A LinkedIn-first variant still needs its own assessment. A connection acceptance is not email consent, and automation or message content may change the analysis.

Hypothetical scenario: Sortlist Radar + agency Overloop campaign

Assume a Sortlist agency in Germany receives a Radar signal about category research and wants to run an Overloop campaign. The signal is a planning input, not proof that any channel is permitted.

Non-compliant version (don't do this):

• Radar flags "Company X researched SEO agencies"
• Agency exports contact list
• Overloop sequence sends email: "Hi Max, saw you were looking at SEO agencies on Sortlist..."
• Result: sending the advertising email without the required consent creates exposure under UWG §7. Whether the data collection or tracking also engages the TDDDG or GDPR depends on the actual technology, data source, transparency notices, and legal basis.

Reviewed version:

• Radar flags "Company X researched SEO agencies"
• The agency documents the signal source and asks German counsel whether the specific facts support a contact route.
• The representative uses only the approved channel and wording.
• Any email permission is recorded in the designated system with the required scope and evidence.
• The email step remains blocked until the approved event is present and tested.

A LinkedIn alternative should follow the same review: assess the outreach message and platform rules, do not treat acceptance as email consent, and release email only after the required evidence is recorded.

Phrases to never put in an email to a German prospect

• "We noticed you visited [specific page]"
• "Our system flagged your company as a match"
• "Based on your recent research into [topic]"
• "You downloaded our guide on [X]" (unless they actually opted in through a form and you can prove it with a double opt-in confirmation)
• "Your colleague [name] suggested I reach out" (without their written permission)

Each phrase exposes the underlying data source and can increase legal or trust risk. Have the collection and outreach workflow reviewed before using behavioural signals in copy.

Data Handling Requirements

Even when you are not emailing German contacts, collecting or enriching identifiable contact data can be processing under the GDPR. Document the purpose, legal basis, transparency, minimisation, retention, and rights-handling analysis.

Common Data Fields to Assess

Each field still needs a documented purpose, legal basis, source, retention period, and necessity analysis. Being professional or publicly available does not remove GDPR obligations.

• Professional email addresses
• Company name, industry, size
• Job title and professional role
• Business phone numbers
• Publicly available business information

Required Disclosures (GDPR Art. 13/14)

Articles 13 and 14 set different transparency duties depending on how the data was obtained, with exceptions and timing rules that depend on the facts. Review the complete provision and identify which items apply before collection or first contact.

• Your identity as the data controller
• Purpose of data processing
• Legal basis (legitimate interest) and the specific interest
• Data source - where you obtained their contact information
• Data retention period
• Right to object, right to erasure, right to access
• DPO contact information, where applicable
• Right to lodge a complaint with a supervisory authority

Legitimate Interest Assessment (LIA)

If you rely on legitimate interest, document the assessment before processing. A common structure covers three tests:

1. Purpose test: What specific business outcome does the processing serve?
2. Necessity test: Could you achieve the same outcome with less data or a less intrusive method?
3. Balancing test: Do the individual's rights and freedoms override your legitimate interest?

There is no universal 17-month statutory retention period for prospect data. Set and document a period that follows from the purpose, necessity, expectations, objection history, and current authority guidance; review records sooner when the facts or purpose change.

Data Minimization

Collect only what is necessary for the approved purpose. Avoid enriching additional attributes merely because they are available, and document why each retained field is needed.

Tracking Pixels and Open Tracking (TDDDG)

Email tracking requires a separate technical and legal assessment. TDDDG §25 addresses storing information on, or accessing information from, an end user's terminal equipment, while GDPR governs any personal-data processing.

Whether a particular open or click-tracking implementation falls within those rules depends on how it works and what data it processes. Document the implementation, obtain German legal advice, and verify that the platform can disable the relevant tracking when required.

Practical impact: Identify whether your platform inserts open or click tracking and assess those features separately with German counsel. If the approved workflow requires tracking to be off, confirm the setting at the relevant campaign or segment level and test the rendered message.

What Are the Penalties for Non-Compliant Cold Email in Germany?

Potential enforcement depends on the conduct, the claimant or authority, and the legal basis involved. Do not use one headline maximum as the expected consequence of a particular email.

1. Competitor Abmahnung (Cease-and-Desist)

This is the most common enforcement mechanism and the one most companies underestimate. Under German unfair competition law, competitors can send a formal Abmahnung demanding you stop sending unsolicited email and pay their legal costs.

• A recipient or eligible market participant may seek an injunction or other relief, depending on standing and the facts.
• Costs and remedies depend on the procedure, claim value, and outcome.
• Repeated conduct can affect the available remedies and risk assessment.
• Obtain German legal advice promptly if you receive an Abmahnung.

2. Data Protection Authority (DPA) Enforcement

German data-protection authorities may investigate GDPR issues connected to the underlying processing. The GDPR's statutory maxima depend on the type of infringement and do not predict the amount in a specific case. The Bundesnetzagentur also enforces rules in its remit, but its phone-marketing totals should not be presented as cold-email fines.

3. Civil Claims

Individual recipients and businesses can claim damages directly. Consumer protection associations can bring collective actions. German courts have a long track record of ruling against unsolicited commercial email.

How Should You Evaluate an Outreach Tool for Germany?

No platform determines whether a campaign is lawful. Start with the approved legal workflow, then verify the provider's current DPA, subprocessors, processing regions, transfer mechanisms, channel capabilities, suppression behaviour, tracking controls, and export or deletion paths.

For a campaign that lacks prior express consent or the narrow existing-customer exception, the email step may not be available under UWG §7. Assess alternative entry channels with counsel, and review every provider's current DPA, subprocessors, processing regions, and transfer mechanisms.

Use this checklist when reviewing both the campaign workflow and the platform you plan to use:

Overloop does not make legal decisions for you. Map each requirement in the approved workflow to a documented platform control, verify the control exists in the current product, and test its actual behaviour before launch. Any gap needs a manual process, another system, or a decision not to run the campaign.

German market: legal review first, channel-specific permission documented, controls tested before email.

Compliance Checklist: B2B Outreach in Germany

Use this checklist before launching any campaign that targets German prospects.

Before You Start

• Document your Legitimate Interest Assessment (LIA) for data processing
• Prepare your GDPR Article 13/14 disclosures
• Confirm your DPA is in place with your data processor
• Set up consent tracking in your CRM
• Set and document a case-specific retention period; do not rely on a universal 17-month rule

For Cold Prospects (No Prior Relationship)

• Do NOT send cold email without documented consent
• Phone route: use only if counsel concludes that concrete facts support presumed consent under UWG §7(2) No. 1; then follow the approved evidence process
• LinkedIn route: assess the message, platform rules, data source, and advertising character separately; connection acceptance alone is not email consent
• A LinkedIn connection acceptance alone is NOT consent - you must ask and receive explicit permission for email
• Only add to email sequences after consent is recorded
• Alternative: postal mail with opt-in CTA for email

For Existing Customers (UWG §7(3))

• Verify that the recipient is genuinely an existing customer. Do not assume a free-trial registration qualifies: the ECJ's Inteligo judgment is fact-specific, and the German application of UWG §7(3) should be reviewed for the proposed workflow.
• Send only about similar products or services
• Check that the customer has not previously objected
• Include a clear, cost-free opt-out in every email
• Include full sender identification and Impressum

Every Email You Send

• Working one-click unsubscribe link
• Clear sender identification
• Impressum with company legal details
• Link to privacy policy
• Data source disclosure (how you obtained the contact)
• Consider disabling tracking pixels for German recipients (TDDDG)

Recent Legal Developments (2025–2026)

ePrivacy Regulation Proposal Withdrawn (October 2025)

The Commission withdrew the 2017 proposal on 6 October 2025. The existing ePrivacy Directive remains part of the applicable framework, alongside GDPR and national rules such as Germany's UWG and TDDDG.

ECJ Case C-654/23 (13 November 2025)

In Inteligo Media, the Court addressed when a newsletter tied to an online publication falls within the existing-customer exception in Article 13(2) of the ePrivacy Directive and clarified its relationship with GDPR. It should not be read as a blanket permission for free or freemium registrations.

German Consent-Management Ordinance Effective (April 2025)

Germany's Einwilligungsverwaltungsverordnung took effect on 1 April 2025. It governs recognised consent-management services under TDDDG §26; it is not an email-specific safe harbour.

Increasing DPA Enforcement Activity

German state DPAs continue to increase enforcement actions. The trend toward treating email tracking pixels as requiring separate consent is accelerating.

Frequently Asked Questions

The Bottom Line

Germany is not impossible for B2B outbound. It is different. The law restricts the channel - unsolicited email - not the activity of B2B prospecting.

Prospecting channels and data collection each require their own legal assessment. Existing-customer email may be available only when every condition in UWG §7(3) is met; do not assume that free-trial users qualify. Consent can be collected through appropriate inbound or direct interactions when it is specific, informed, and documented.

What you cannot safely do is load a list of German email addresses into a sequence and assume the send is lawful. Other European markets also have jurisdiction-specific consent, privacy, and electronic-marketing rules; none should be treated as giving general permission for list-based outreach without a current review.

The companies that succeed in the German market are the ones that adapt their workflow. Phone-first or LinkedIn-first sequences. Consent-gated email steps. Proper documentation. It requires more effort per contact, but German B2B deals tend to be larger and stickier than other markets. The compliance overhead is worth it.

Multichannel software can help coordinate a reviewed workflow, but orchestration does not confer legality. Overloop combines native email and LinkedIn sequence steps, and teams using Aircall can add Call Tasks through the integration. Before launch, define the approval gate, verify the platform's current controls and privacy documentation, and obtain legal advice for the campaign.

Build the workflow once. Run it for every German campaign. Stay on the right side of the law.