B2B email marketing — do you need the recipient’s consent? The rules by country

In business-to-business email marketing, the rules differ clearly between countries. Consent from consumers is required everywhere, but for a business recipient the answer depends on the country and on what kind of address it is. This page is read directly from the laws and from the authorities’ own guidance, and every claim links to its source.

The short answer

In Finland you may send marketing to a company’s generic address (such as info@company.fi) without prior consent, as long as the recipient can opt out in every message. A named work address (firstname.lastname@company.fi) needs consent unless the recipient’s role is closely connected to what you are marketing. Norway allows generic addresses too, but a named address always needs consent. In Sweden the law requires consent when the recipient is a natural person. Denmark and Germany require consent from every recipient, info@ addresses included. If your list covers more than one country, ask everyone for consent.

Two questions: who, and which address

The rules on electronic direct marketing come from Article 13 of the EU ePrivacy Directive, which requires prior consent. For business recipients, however, countries have reached different solutions, and the answer depends on two things:

• Is the recipient a business or a person? A named work address identifies a person, even if the message is about their work.
• Which country is the recipient in? The rules differ by country, so on a list that spans several countries it pays to follow the strictest.

The rules by country

← scroll →

Sources linked below by country, read on 25 September 2026. In every country you may market your own similar products to an existing customer without separate consent, if the address was obtained in the context of a sale and the customer was given the chance to refuse.

Finland: generic addresses free, named addresses depend on the role

Section 200 of the Act on Electronic Communications Services requires prior consent from natural persons, and section 202 allows marketing to legal persons as long as they can object with every message. The Office of the Data Protection Ombudsman draws the line by the form of the address: an email address in the form firstname.lastname@company.fi is, as a starting point, regarded as a natural person’s address. That needs consent.

The exception depends on the person’s role. According to the Office, consent is not required if the person works in a role to which the marketed goods or services are closely connected. Accounting software, for example, relates to a finance director’s work, but hardly to that of a salesperson at the same company. The Office requires the sender to make sure of this before the first message and to be able to demonstrate it afterwards, for example by documenting the assessment.

Sweden: consent from natural persons only

Section 19 of the Swedish Marketing Act requires prior consent when the marketing is aimed at a “fysisk person” — a natural person. Legal persons are covered by section 20: a message must always contain an address where the recipient can ask for the marketing to stop, and according to the section this “gäller även vid marknadsföring till en juridisk person” — also applies to marketing to a legal person. The law does not say directly how a named work address is treated, and we found no guidance on it from the Swedish authorities. On the wording, consent is needed when the recipient is a person.

Norway: named addresses always need consent

Section 15 of the Norwegian Marketing Control Act prohibits marketing to natural persons without consent. Forbrukertilsynet’s guidance (point 2.4) is stricter than the Finnish rule: the ban also covers a person’s individual work address, such as ola.nordmann@firmaX.no, “uansett om e-posten inneholder tilbud til virksomheten” — even if the email contains an offer to the business. There is no role-based exception. A generic address, such as post@firmaX.no, may be emailed. If you cannot tell from the address whether it belongs to a person, the guidance puts the risk on the sender.

Denmark: consent from everyone

Section 10 of the Danish Marketing Practices Act prohibits email marketing to “nogen” — anyone — without prior consent. The Consumer Ombudsman’s guidance (p. 7) says so directly: the ban covers all recipients, consumers, businesses and public authorities alike, and it makes no difference whether the message goes to a generic mailbox such as info@virksomhed.dk or to a named manager or employee.

Germany: consent from everyone, the phone is different

Section 7 of the German Act against Unfair Competition (UWG) treats phone and email differently. For phone marketing to a business, presumed consent (“mutmaßliche Einwilligung”) is enough, but email advertising always requires the recipient’s prior express consent, whether the recipient is a consumer or a business. In Germany, proving consent means double opt-in in practice, because the German data protection authorities expect it for verifying consent given electronically.

Netherlands: only an address published for the purpose

Paragraph 3 of article 11.7 of the Dutch Telecommunications Act allows marketing without consent to a legal person or to a natural person acting in their profession only if the recipient has published the address specifically for receiving unsolicited messages and it is used for that purpose. Otherwise the main rule is the same as for consumers: the sender must be able to prove that consent was given in advance.

GDPR comes in when the address identifies a person

Marketing law tells you whether you may send the message. Data protection law governs whether you may process the named address. Under Recital 47 of the GDPR, “the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest”, and Finland’s Office of the Data Protection Ombudsman gives direct marketing as an example of where a controller’s interest may be legitimate. Two obligations still apply:

• The right to object. Under Article 21, the person has the right to object to direct marketing at any time, after which their data may no longer be used for it.
• Say so in the first message. Under paragraph 4 of the same article, the right to object must be brought to the person’s attention at the latest at the first communication, clearly and separately from any other information.

Other data protection duties, such as the data processing agreement and data location, are covered in our guide to email marketing and GDPR.

A purchased business list works in none of the tools

In B2B marketing, buying a ready-made business list is tempting. Whatever the law says, it will not work with an email tool: all seven tools we compare prohibit importing purchased, rented or third-party lists in their own terms or help pages. Every cell in the table links to the page the ban was read from.

← scroll →

Yes = the help page describes the feature. No = the help page says it is absent or points to an external tool. — = not found in the help pages; that does not mean the feature is absent.

What to do now

1. Sort your addresses. Mark on the list whether each address is generic or named and which country the recipient is in. Those two things decide whether you need consent.
2. Document the role assessment. If you send to named work addresses in Finland without consent, record why the recipient’s role relates to your offer.
3. Ask for consent where the law requires it. In Denmark and Germany it is mandatory for everyone, in Norway for every named address.
4. Add an opt-out and objection option to every message. The Finnish, Swedish, Danish and German laws require it, and for named addresses so does Article 21 of the GDPR.

Choosing a tool for marketing to businesses is covered in our guide to the email tool for a consultant, and the main comparison shows the prices of all seven at three list sizes.