Outbound in the EU
Cold email in Europe, and the rule that changes at every border.
GDPR gets the blame. ePrivacy does the damage. One of those is the same in all 27 countries and the other is written separately by each of them, which is why there is no single European answer and why most compliance advice you will read is answering the easier question.
Two rulebooks, not one
GDPR decides whether you may hold and use someone's details at all. The ePrivacy Directive decides whether you may send them the message. They are separate instruments and they fail in separate ways, so passing one tells you nothing about the other.
The difference that matters is in the word. GDPR is a regulation: it took effect directly and reads identically in every member state. ePrivacy is a directive: each country wrote its own version into national law. So the half of the question people worry about is the half that is already settled, and the half nobody mentions is the one that moves.
The half nobody reads
Article 13 of the ePrivacy Directive governs unsolicited commercial messages. Paragraph 1 sets the default: electronic mail for direct marketing needs prior consent. Paragraph 3 is where that default stops being European.
Member States shall take appropriate measures to ensure that unsolicited communications for the purposes of direct marketing, in cases other than those referred to in paragraphs 1 and 2, are not allowed either without the consent of the subscribers or users concerned or in respect of subscribers or users who do not wish to receive these communications, the choice between these options to be determined by national legislation.
Consent, or a right to refuse. Each country picks. That single clause is the reason a campaign can be routine in one EU market and a problem in the one next door, and it is the reason anyone offering you a pan-European compliance playbook has not read the national implementations.
"It's B2B" is doing less work than you think
The comfort most outbound teams rely on comes from paragraph 5, which says the strict paragraphs apply to subscribers who are natural persons, and leaves business recipients to national law:
Paragraphs 1 and 3 shall apply to subscribers who are natural persons. Member States shall also ensure, in the framework of Community law and applicable national legislation, that the legitimate interests of subscribers other than natural persons with regard to unsolicited communications are sufficiently protected.
Read it again, because the exception is narrower than the way it gets quoted. The lighter treatment is for subscribers who are not natural persons. Almost all B2B outbound goes to a named individual at a company, and a named individual is a natural person wherever they happen to be sitting. An address like info@ is a different case from an address with someone's name in it, and the second is most of your list.
This is not a modern reading. The EU's own Article 29 Working Party made the point in 2004: of the member states that had an opt-in regime for email at the time, most had applied it to business recipients as well, and it noted that telling a natural person's address from a company's is often not possible from the address itself.
What does not change, in any country
Paragraph 4 is the floor, and it carries no national discretion at all. You may not disguise or conceal who the message is from, and there must be a valid address where someone can tell you to stop.
That sounds like the easy part. In practice it is the part that quietly breaks, and not because anyone refuses a request. It breaks because the request is honoured in one place and not the others: removed from the campaign but not the CRM, from one mailbox but not the other three, and the person hears from you again six weeks later. That second message is what turns an irritation into a complaint.
One suppression list that every tool reads before a send, at domain level as well as address level, is the only version of this that holds. Everything else is a diagram of good intentions. There is more on how opt-outs actually arrive, which is rarely as a tidy click.
The GDPR half is a test, not a box
On the data itself, B2B outbound usually relies on legitimate interest rather than consent. That is a real and available ground. It is also a test with three conditions that all have to hold: a legitimate interest being pursued, a genuine need to process the data for it, and the rights of the person not overriding it.
The European Data Protection Board's 2024 guidelines put one line in the middle of that test which is worth sitting with, because it closes the argument most outbound teams reach for first:
The fact that certain types of personal data are commonly processed in a given sector does not necessarily mean that the data subject can reasonably expect such processing.
Everyone does it is not a defence. Nor is a privacy policy: the same guidelines say that meeting your information duties is not on its own enough to make processing something people can reasonably expect. What carries weight is a written assessment made before the campaign rather than after a complaint, and relevance does most of the work in it. The further a message sits from the recipient's actual job, the weaker the ground gets.
And then there is where the data physically sits
Data residency is a separate question again, and the two get confused constantly. Hosting outside the EU can be perfectly compliant with the right transfer mechanism. An EU-hosted tool used carelessly is still a problem. Residency is not compliance.
It matters for a different reason: some buyers, particularly in regulated industries and the public sector, will simply refuse a vendor who cannot answer the question. And the question does not arrive tool by tool. A client asks it once, about the whole stack, which means you have to know it for every part of it.
So we read it, out of the vendors' own data processing agreements and sub-processor lists rather than off review sites. Thirty-nine tools. Seven of them keep customer data in the EU according to the vendor. Lemlist is the clearest case in the set, France on OVH with nothing leaving the EEA. Lusha's own two pages contradict each other, one saying AWS in the United States and the other AWS in Ireland. Airscale and Prospeo are French companies that publish no region at all.
That work is public, with the vendor's own document linked beside every answer: The Stack.
What this looks like when we run it
RELAY™ is the engine that does the sending, and the compliance work is not a layer on top of it. It is four habits built into how a campaign is set up.
- The market decides the rules, before the list is built. Which countries a campaign reaches changes what is allowed in it, so that is settled first rather than discovered later.
- The assessment is written before the send. Why this audience, why this message, why the balance falls the way we say it does. Kept, not improvised after a complaint.
- One suppression list, read by every tool. Opt-outs, current customers, live opportunities, competitors and anyone the client has asked us to leave alone, at domain level as well as address level.
- Only the fields a campaign actually uses. Enrichment returns everything it has and it costs nothing to keep, which is exactly why lists fill up with personal detail that serves no purpose and would be awkward in a subject access request. The rest gets dropped on import.
Who answers when a recipient asks where their data came from is settled in writing at the start, because an agency that builds the list itself is making controller decisions, not only processor ones.
What it looks like in a regulated market
CubeChem trades controlled pharmaceutical active ingredients into Europe, which is about as unforgiving a setting for outbound as exists. Miloš already knew the players. What he needed was timing, and a reason to call that would survive scrutiny.
Since July 2026, SONAR™ has captured and scored 28 market signals, mapped 15 EU manufacturers across five countries and identified 27 procurement and supply chain leaders, each with a compliance-safe reason to call. It produced three conversations with manufacturers in a month.
Read how that was built, or see the rest of the case studies.
What it costs
No price list, because the same engine is different work in different markets. One country and one kind of signal is not six countries every week. Three things move the number: how wide the work goes in markets, languages and segments, how deep it goes in signals and research per company, and how much we run versus your own team.
Getting the actual number takes a twenty minute conversation. How an engagement works has the rest of it.
Questions people actually arrive with
Is cold email legal in the EU?
Do I need consent before sending?
Does hosting in the EU make us compliant?
What if someone asks what we hold about them?
Can you tell me the position for my specific market?
Where this comes from
Every quotation above is from the instrument itself rather than from a summary of it.
- Directive 2002/58/EC, consolidated text, Article 13 on unsolicited communications.
- Article 29 Working Party, Opinion 5/2004 on unsolicited communications for marketing purposes.
- EDPB Guidelines 1/2024 on processing personal data based on legitimate interest.
Blackorange is not a law firm and nothing here is legal advice. It is what we have had to understand to run outbound into European markets without causing problems for the people who hired us.
Tell us which markets
you want to reach
We will tell you honestly what is straightforward there, what is not, and whether there is something worth building.
Talk to Alfredo30 minutes. No prep. No pitch.
Want the tool by tool answer first? The Stack has all 39.