Can any freelancers out there tell us about being legally prosecuted for sending (single but unsolicited) emails to prospective clients (in the EU)?

In the EU of course there is the 'opt-in' law on unsolicited emails. (A recipient must opt in first.) And you can't even send an introductory email first to ask if a recipient wants your email (that would amount to the same thing, which is prohibited, so how you can legally get a recipient's permission to send them an email? - can you only call them or send them a letter?) I'm talking about single emails (not mass email advertising, which is indeed reprehensible) to get your name and service out into the market, to persons or firms who may really need what you're offering.

I've always wondered whether some firm or person has actually reacted to a single unsolicited email by taking the sender to court for breaking this EU Directive (every EU state has its own version in law). It seems improbable, but with people you never know.

Has anybody found a 'work-around' to cover an email sender from this risk? (Maybe write at the bottom of the email something like: 'not a commercial offer in the sense of the law' ?)

  • What you are proposing is flat-out illegal. Don't forget that an unsolicited telephone call is also illegal in most cases. And yes, I, in the UK, report every single unsolicited email that gets through to me to the ICO and every phone call and SMS to OFCOM. It is up to them to prosecute, rather than the individual. Occasionally I receive confirmation that prosecution has successfully taken place.
    – Chenmunka
    Jun 17, 2020 at 9:33
  • Wow, thanks for filling in some gaps in my knowledge! This is tough stuff. So I could also be prosecuted for sending an ('unsolicited') letter by post with similar content (-not to speak of calling a tel. number by error)? And someone who needs a good service, and who hears mine is good, could by law not even send me an email to get in contact? Talk about the 'nanny state'. And what about all the new freelancers (what with the pandemic) who have something to offer but can't even try to get new clients (except through rip-off platforms)?
    – user24862
    Jun 17, 2020 at 16:11
  • @Chenmunka - What they're proposing is perfectly legal, as long as they avoid making reference to specific individuals
    – Valorum
    May 31, 2021 at 10:38

1 Answer 1


There are a couple of ways to get around these restriction.

#1 - Avoid GDPR entirely.

The GDPR primarily relates to the storage of data relevant to the individual. If the email doesn't contain information that could reasonably identify an individual, then the GDPR doesn't apply since there's no personal data being controlled. Spam these as often as you like, just being mindful not to breach your domain's rules on unsolicited contacts.


  • JohnSmith@company.com = X
  • FinanceDirector@company.com = X
  • CustomerService@company.com = ✓
  • Info@company.com = ✓

#2 - Claim immunity

This one is slightly harder because you may well end up needing to call a lawyer if you get snarky emails from the ICO.

Q3: Can I send cold emails to people under GDPR?

Yes, you can send cold emails to people at companies under GDPR. Those need to be B2B emails that meet certain requirements. Firstly, you can’t send them to just anyone. You need to target your prospects very carefully. You need to have a strong reason to claim that the company the person works for can benefit from what your company offers in the email. Moreover, your business activity should be logically connected with the business activity of your prospect. That will be a legal basis to send someone an email without their previous consent to process their data.

Secondly, in each of your email messages, you need to inform your cold email recipients what personal data you are processing, for what purpose, and how they can remove their data from your mailing list, or change them. That’s how you fulfill the information duty described in GDPR.

Thirdly, you should not process your cold email addressees’ personal data for longer than it’s necessary. GDPR does not specify any particular period of time. We advise removing from your lists the data of prospects who have not replied within 30 days from sending them your first message. That’s how you abide by the data storage limitation principle while sending cold emails.

"GDPR for Cold Sales Email Senders – FAQ" - Cathy Dawiskiba – Chief Growth Officer – Woodpecker Marketing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy