Glossary Compliance
GDPR consent and cold email: the basics
Also called Legitimate interest
General information, not legal advice. Rules differ by country; check with your own counsel.
Under the EU General Data Protection Regulation (GDPR), you need a lawful basis to process someone's personal data, and B2B cold email usually relies on legitimate interest rather than consent, subject to stricter national email rules in some countries.
GDPR lists six lawful bases, including consent and legitimate interest (Article 6(1)(f)). Legitimate interest requires that your interest in contacting the person is genuine, relevant to their role and not outweighed by their rights. You must tell people where you got their data and let them object.
Separate ePrivacy rules, implemented country by country, also govern electronic marketing. Some countries, such as Germany, generally expect prior consent even for B2B email, while others allow relevant B2B outreach with an easy opt-out.
Why it matters
- It applies when you email people in the EU, wherever you are based.
- Fines can be large, and complaints go to data protection authorities.
- Its principles (relevant, minimal, easy to object) match good outreach practice.
How Reach Crew handles it
Reach Crew finds people from public sources only, writes one to one about their work, and puts a plain opt-out in every first email. Anyone can ask Reach Crew to forget them; they then go on a global do-not-contact list, stored as keyed hashes only, that no workspace will match again. Our privacy policy explains what we collect and why.
Related terms
- Do-not-contact list. A do-not-contact list, or suppression list, is a list of people or addresses that must never be emailed again...
- CAN-SPAM Act. The CAN-SPAM Act is the US federal law, enforced by the FTC, that sets rules for commercial email, including...
- Unsubscribe. An unsubscribe, or opt-out, is a way for a recipient to tell a sender to stop emailing them, which the sender...