.webp)
Is cold calling in B2B really allowed without prior consent? Can I reach out to potential business clients via email? And how can you set up modern lead management with AI-powered automation while staying GDPR-compliant? Hardly any topic in B2B sales causes as much uncertainty as the legal landscape surrounding cold outreach.
First, the good news: B2B cold outreach isn't banned across the board. However, its legality depends heavily on the channel used, the context of the outreach, and the type of data being processed. This article clarifies what is permitted for phone and digital cold outreach, which legal frameworks apply, and how you can implement automated outreach processes in a legally sound way.
What's allowed in B2B cold outreach: the legal basis
Two sets of regulations, which are often confused, are crucial for legal assessment: the Act Against Unfair Competition (UWG) and the General Data Protection Regulation (GDPR). Both serve different purposes. The UWG regulates whether the advertising approach itself is permissible - regardless of whether personal data is processed. The central rule is Section 7(2) of the UWG, which distinguishes between different advertising channels. The GDPR, on the other hand, applies whenever personal data is collected, stored, or processed - which is practically every form of contact where names, phone numbers, or email addresses are recorded.
Cold calling: When is it allowed in B2B?
When it comes to cold calling, the rule is: it is generally permissible if "presumed consent" can be assumed. Such presumed consent exists when there is a factual connection between your offer and the business activities of the company you are contacting.
In concrete terms, this means: if you offer a SaaS tool for HR automation and call a mid-sized company that is currently expanding its team according to publicly available information, you are on safe ground - the factual connection is obvious. If, however, you are selling insurance solutions and are cold-calling random company numbers from a purchased list, you will have a much harder time legally.
For a call to be truly permissible, the factual connection between the offer and the company's activities should be demonstrable, the call should take place during standard business hours, and you should not use private numbers of executives or employees without their separate consent. Any objection must be respected and documented immediately, and the phone number should come from publicly accessible or legally acquired sources.
A common mistake in practice: interpreting "presumed consent" too broadly. Case law emphasizes that assuming such consent is only justified if there is a very specific, objectively verifiable interest on the part of the company being contacted. If you cannot clearly document why that specific company was contacted, you risk a formal warning.
Cold email outreach: significantly more restrictive
While cold calling is permissible under certain conditions, much stricter rules apply to cold email outreach. Section 7(2) No. 2 of the UWG generally requires prior express consent for advertising via email - and this applies to the B2B sector as well.
The common assumption that email outreach is allowed in B2B without consent is a widespread misconception. While there are some voices in legal discussions that suggest for functional email addresses like info@unternehmen.de some might argue for a more generous interpretation, but current case law and the reality of cease-and-desist warnings tell a different story: without documented consent, cold email outreach is legally actionable.
In practice, exceptions are rare. The existing customer privilege under Section 7(3) of the German Unfair Competition Act (UWG) only applies to similar products within an ongoing business relationship - meaning it doesn't apply to true cold outreach by definition. Furthermore, situations where consent might be clearly implied are interpreted extremely narrowly by the courts.
If you still want to use cold emails for B2B sales, be aware: any unsolicited marketing email can trigger a cease-and-desist letter, complete with a formal undertaking and legal fees. The question isn't whether it's legally risky, but rather how high that risk is in any given case.
To learn how to align your AI-driven sales processes with both GDPR and EU AI Act regulations, check out our guide on EU AI Act readiness.
GDPR in B2B cold outreach: data protection requirements
Regardless of whether cold outreach is permissible under the UWG, you must still meet GDPR requirements when processing personal data. The most relevant provision here is Article 6(1)(f) of the GDPR - processing based on legitimate interest.
A legitimate interest exists if your company has a valid business reason for reaching out, such as acquiring new corporate clients, and this interest is not outweighed by the fundamental rights and interests of the individuals you are contacting. The key is the so-called balancing of interests test, which you must conduct and document in advance.
Any form of cold outreach involving personal data processing comes with two sets of obligations. First, the information requirements under Articles 13/14 of the GDPR: upon first contact, you must inform the individuals about who is processing their data, for what purpose, on what legal basis, how long it will be stored, and how they can object. For phone calls, this can be done verbally or via a follow-up email; for email contact, the mandatory information must be included directly in the first email or clearly linked. Second, documentation requirements: you must be able to prove the legal basis (the documented balancing of interests), record the source of the data, and maintain robust objection management with opt-out lists and deletion schedules.
These obligations apply to both manual and automated outreach. Ignoring them risks not only cease-and-desist letters but also fines from data protection authorities.
Automating cold outreach: GDPR-compliant tools and processes
Modern B2B sales teams are increasingly relying on automated outreach processes - from lead enrichment and personalized sequences to AI-powered scoring. The crucial factor is ensuring that all tools and workflows you use meet data protection requirements.
Looking for software to get started without burning through budget? Check out our overview of the top free AI tools for sales teams.
Lead enrichment and data sources. Tools like HubSpot, Pipedrive, or specialized providers like Apollo or Clay allow you to automatically enrich contact data, for example by cross-referencing it with publicly available databases or social media profiles. This is only legally permissible if the data source itself is legitimate and the use can be justified by a legitimate interest. In practice, this means: only use publicly accessible or lawfully acquired data, avoid social media scraping without consent (such as on LinkedIn or Xing), document the origin of the data for audit purposes, practice consistent data minimization - meaning only collect what you truly need - and check the privacy policies of the tools you use, including data processing agreements and third-country transfers, in advance.
Automated email sequences. Email sequences sent automatically based on user behavior or scoring results are widely used in B2B marketing. Legally, the same rules apply here as for manually sent emails: without consent, promotional content is generally prohibited. Many marketing automation platforms offer features like "cold outreach sequences" or "sales cadences" - these can only be used in a GDPR-compliant manner if there is either documented consent or if the emails fall under the existing customer privilege, which by definition is not the case for genuine cold outreach. If you still want to conduct automated email outreach, you should limit yourself to functional business addresses, reduce the promotional tone (e.g., by providing factual information instead of obvious sales pitches), and include a prominent, transparent opt-out mechanism. This reduces the risk, but does not eliminate it.
AI-powered lead scoring. AI models that automatically evaluate and prioritize leads typically process extensive personal data: company information, behavioral data from the website, and interaction data from emails or social media. Here, too, the legal basis of "legitimate interest" is often applicable, provided the balancing of interests is positive. It becomes critical if scoring models include sensitive characteristics: industry, company size, or geographic location are unproblematic, but personal characteristics such as age, gender, or ethnic origin would be problematic and, in most cases, impermissible. Detailed documentation of the scoring criteria used and the data flows is mandatory here.
Want to learn how algorithms identify sales-ready prospects with precision? Check out our practical guide on predictive lead scoring to see how AI supports your sales team.
Checklist: How to make B2B cold outreach legally compliant
Implementing this in a legally compliant way requires a structured approach. This checklist covers the most important compliance requirements:
Before reaching out:
- Document the factual connection between your offer and the target company (justify presumed consent)
- Conduct a GDPR balancing of interests and record it in writing
- Document the origin of the contact data (source, time, legal basis)
- Maintain an internal opt-out list (take into account objections from previous contacts)
- Prepare privacy notices (website, email footer, phone script)
During outreach:
- On phone calls: clearly state your name, company, and the purpose of the call right at the start
- In emails: include or link to the mandatory information required by Article 13 of the GDPR
- Document any objections immediately and enter them into the CRM
- No calls outside of standard business hours
- No repeated contact attempts after an objection has been made
After making contact:
- Only store contact details for as long as they are needed for the intended purpose
- Regularly delete data according to set timeframes (e.g., 12 months without business contact)
- Include an opt-out mechanism in all follow-up emails
- Document the contact history in the CRM (date, channel, outcome, objection)
- If consent is given: use a double opt-in process and archive the proof
Bottom line: B2B cold calling is allowed – but with clear boundaries
Cold calling in the B2B sector isn't prohibited, but it is subject to strict legal requirements. While cold calling by phone remains permissible under the assumption of implied consent, cold emailing without documented consent is legally tricky and carries significant risks of warning letters in practice.
The GDPR doesn't ban cold calling per se, but it does require a solid legal basis, transparent information obligations, and a documented balancing of interests. If you use automated outreach processes, you also need to ensure that all tools are configured to be GDPR-compliant and that data flows are clearly documented.
The best way to handle legally compliant B2B acquisition is a mix of permissible cold calls, inbound methods, and permission-based email marketing. If you use automated workflows, you should invest in clean data sources, documented processes, and regular compliance reviews. This way, you not only minimize legal risks but also build lasting customer relationships.
FAQ: Frequently asked questions about B2B cold calling
Is cold calling allowed in B2B?
Yes, cold calling is generally permitted in the B2B sector, provided there is presumed consent. This means there must be a factual connection between your offer and the business activities of the company you are calling. The assumption of presumed consent should be objectively justifiable and documented. It is also important that you respect any objections immediately and record them in your opt-out list.
Is cold emailing allowed in B2B?
According to Section 7 (2) No. 2 of the German Act Against Unfair Competition (UWG), advertising via email is only permitted with prior express consent – even in the B2B sector. The common belief that there is an exception for business email addresses is not supported by current case law. Cold emailing without documented consent can lead to legal warnings and should be avoided. Exceptions, such as the existing customer privilege, do not apply to genuine cold outreach by definition.
Is cold calling part of B2B sales?
Yes, cold calling remains a staple of many B2B sales strategies, especially in industries with long decision-making cycles and clearly defined target audiences. It doesn't replace inbound marketing or referrals, but it’s a great way to supplement them when companies want to actively identify new target customers instead of just waiting for incoming leads. The key is to ensure it is done legally and is well-documented, as described in this article.
Note: This article provides general guidance and does not replace professional legal advice for individual cases.
Posted by:
Jens is the co-founder of bakedwith, a boutique consultancy firm specialising in smart automation and AI. He helps medium-sized companies and corporations to optimise processes, reduce manual work and achieve growth through efficient workflows. Previously, he was Growth Lead at OMR and worked as a freelancer, helping numerous companies optimise their CRM and automation systems. Jens is passionate about combining growth and efficiency to enable teams to focus on what matters most.
.png)
.avif)
.webp)
