Cold email and the law in the EU, Germany, the UK and the US

Before you start

This lesson gives an overview, not legal advice. It describes the rules as they stood on 1 November 2026 and simplifies them for teaching. Laws and court decisions change, and real cases often turn on details. Every section links the official text; a real company should ask a lawyer or its data protection officer. All companies, people and situations are invented.

Materials

• The hook email (below), projected.

• The four fact sheets, one per expert group: GDPR, ePrivacy and Germany, UK, US.

• The eight case cards, cut out or projected, and one empty solution grid per mixed group.

• Optional: devices to open the official sources.

Step by step

1. Hook (10 minutes)

Contoso and Northwind have never been in touch. Ask for a quick vote in three versions: both companies are in Germany; both are in the UK and Northwind is a limited company; both are in the US. Keep the votes on the board.

2. Input: two layers of rules (10 minutes)

Explain on the board:

• Layer 1: data protection. Who may use personal data, and how. In the EU this is the GDPR; the UK has its own UK GDPR. A named work address such as anna.berger@northwind.example is personal data, because it identifies a person. A general address such as info@northwind.example often is not.

• Layer 2: marketing rules. When advertising by email is allowed at all. In the EU these come from the ePrivacy Directive, written into each country's own law (in Germany the UWG). The UK has PECR, the US has CAN-SPAM.

• A cold email has to pass both layers wherever both apply.

• Opt-in means: you need permission (consent) before the first advertising email. Opt-out means: you may send, but must stop when asked.

3. Expert groups (20 minutes)

Each group reads one fact sheet, checks the official source and prepares a two-minute summary: what does the rule cover, does it need consent, what must every email contain?

Fact sheet 1: GDPR (EU)

Source: Regulation (EU) 2016/679 on EUR-Lex.

• Lawful basis (Article 6(1)). Personal data may only be used on one of the listed grounds. For marketing these are usually consent (point a) or legitimate interests (point f). Recital 47 says direct marketing may be a legitimate interest, but only if the person's interests and rights do not outweigh it. The company has to weigh this and should write the weighing down.

• Information duty (Article 14). When the data did not come from the person, the company must tell them who it is, why it uses the data, on which legal basis, what kind of data, where the data came from, how long it is kept and which rights they have. If the data is used to contact the person, this must happen at the latest with the first message.

• Right to object (Article 21). People can object to direct marketing at any time (21(2)). After an objection, their data may no longer be used for marketing (21(3)). The right must be pointed out explicitly, clearly and separately from other information, at the latest in the first message (21(4)).

• Consent must be provable (Article 7(1)). A company that relies on consent must be able to show it.

Fact sheet 2: ePrivacy Directive (EU) and the UWG (Germany)

Sources: Directive 2002/58/EC on EUR-Lex and § 7 UWG on gesetze-im-internet.de.

• Article 13(1) ePrivacy: email for direct marketing is only allowed with prior consent.

• Article 13(2), the existing customer exception (often called "soft opt-in"): a company that got a customer's email address when selling them something may advertise its own similar products, if the customer could object easily and free of charge when the address was collected and can do so in every message.

• Article 13(5): the consent rule covers people (natural persons). For companies and other legal persons, each country must make sure their interests are "sufficiently protected". That is why the rules for email to companies differ from country to country.

• Article 13(4): hiding the sender's identity, or giving no valid address to stop the messages, is never allowed.

• Germany, § 7(2) No. 2 UWG: advertising by email without the prior express consent of the addressee is always an unreasonable nuisance. The law does not distinguish between consumers and businesses here, so in Germany cold advertising emails to businesses generally need prior express consent too. Compare phone calls: for calls to businesses, § 7(2) No. 1 only needs at least presumed consent.

• § 7(2) No. 3 UWG: advertising that hides the sender's identity or has no valid address for a stop request is always unlawful.

• § 7(3) UWG: the existing customer exception, with four conditions: the address came from a sale, the advertising is for the company's own similar goods or services, the customer has not objected, and the customer was told clearly, when the address was collected and in every email, that they can object at any time without extra cost.

• German courts read "advertising" broadly. Breaches are mostly pursued in civil courts, for example through formal warnings (Abmahnungen) from competitors or associations, or claims by the recipient. The GDPR applies in addition.

Fact sheet 3: PECR and UK GDPR (United Kingdom)

Sources: regulation 22 of PECR on legislation.gov.uk and the ICO's guidance on business-to-business marketing.

• Regulation 22 covers email marketing to individual subscribers: private people, sole traders and some partnerships. They need to have given consent, unless the soft opt-in applies (22(3): details obtained in a sale or negotiation, own similar products, a simple way to refuse at collection and in every message). Since 5 February 2026, charities have a similar exception (22(3A)), added by the Data (Use and Access) Act 2025.

• Corporate subscribers (companies, limited liability partnerships, Scottish partnerships and some government bodies) are not covered by regulation 22, so email marketing to them does not need consent under PECR.

• Regulation 23 applies to all marketing emails: the sender's identity must not be hidden, and there must be a valid address to ask for the messages to stop. The ICO advises honouring opt-outs from companies too.

• UK GDPR still applies when a person can be identified, for example a named employee's address: lawful basis, information and the right to object.

• If you cannot tell whether a contact is a sole trader or a company, the ICO says to treat them as an individual subscriber.

Fact sheet 4: CAN-SPAM (United States)

Source: the FTC's CAN-SPAM Act compliance guide for business.

• Opt-out model: no prior consent is needed for commercial email. There is no exception for business-to-business email: the rules apply to all of it.

• Every commercial email must: use honest header information (From, To, Reply-To, routing); have a subject line that is not deceptive; be identified as an advertisement; contain a valid physical postal address; explain clearly how to opt out.

• Opt-outs must be honoured within 10 business days, and the opt-out must keep working for at least 30 days after sending. It may not cost anything or require more than an email address, a reply or one web page. Opted-out addresses may not be sold or passed on.

• Responsibility stays with the company whose product is advertised, even if another firm sends the emails.

• Penalties: the FTC's guide lists up to $53,088 for each email in violation (adjusted for inflation over time).

4. Case cards (30 minutes)

Mixed groups solve each card: which rules apply, is it allowed, and what is needed or missing?

1. Contoso GmbH, Berlin, wants to email the purchasing managers of 300 German manufacturing companies. It found the named addresses on the companies' websites. Nobody has been in touch before.

2. Fabrikam Ltd, Manchester, emails the general info@ address of 200 UK limited companies with an offer for office chairs. The emails name Fabrikam and contain an unsubscribe link.

3. Fabrikam Ltd also wants to email a self-employed plumber (a sole trader) at his business address. They have never been in contact.

4. Northwind Traders Inc., Seattle, emails 500 purchasing managers at US companies. The emails have the subject line "Re: your order" although nobody ordered anything, and no postal address.

5. Coho Winery, Germany, sold wine to a customer in its online shop in June. At checkout the customer was told that she could object to advertising emails at any time. Coho now wants to email her about its new red wines.

6. Litware, a software company in an EU country whose national rules (assume this for the case) allow advertising emails to company addresses without consent, wants to email named managers at other companies. Which GDPR duties remain?

7. Tailspin Toys, an EU company, wants to buy a list of 5,000 "B2B contacts with consent" for 400 euros. The seller says the list is "fully GDPR compliant".

8. Wide World Importers, UK, receives a reply from a contact: "Please stop emailing me." A salesperson suggests deleting everything about her from the CRM so she is "forgotten".

5. Compare and discuss (15 minutes)

Groups compare their grid with the model grid. Spend most of the time on the cases where groups disagreed, usually 2, 6 and 7. Then return to the votes from the hook.

6. Exit ticket (5 minutes)

Each learner writes one rule that is the same in all four systems and one that differs.

Differentiation

• Easier: compare only Germany and the US with cases 1, 4 and 5. Give learners this decision path: Is it advertising? Is the recipient a person or a company? Which country's rules apply? Is there consent or an existing customer relationship? Does every email say who sends it and how to stop?

• Harder: write the Article 14 information text for case 6 in plain language, in no more than 120 words. Or research how a second EU country of your choice protects companies under Article 13(5) and compare it with Germany, naming the official source.

Homework

Rewrite the hook email for the US version so that it meets CAN-SPAM, and add a short paragraph that would give the GDPR information and the notice of the right to object if Anna Berger were in the EU.