GDPR B2B Email Marketing: Consent, Soft Opt-In, and Penalties

GDPR B2B email marketing compliance rests on one requirement above all: before you send a marketing message to a business contact in Europe, you need a documented legal basis under Article 6 of the GDPR, and you need to respect the ePrivacy rules of the country where the recipient sits. Skip either piece and your organization is exposed to fines of up to €20 million or 4% of global annual turnover, whichever is higher.¹

Two Laws Govern Every B2B Email

Two frameworks apply in parallel, and confusing them is one of the most common mistakes. The GDPR governs the processing of personal data, including names, job titles, and email addresses. The ePrivacy Directive (2002/58/EC) sits alongside it and governs electronic marketing communications specifically. Each EU member state has transposed the ePrivacy Directive into its own national law, so rules vary by country.

ePrivacy generally requires prior consent before sending electronic marketing messages, but it includes two carve-outs that matter for B2B. First, most member states exempt messages sent to corporate subscribers (companies, LLPs, and government bodies) from the consent requirement. Second, the directive allows a “soft opt-in” for existing customers.² Even where ePrivacy doesn’t require consent, the GDPR still applies to the personal data in your database, so you always need an Article 6 basis on top.

Legitimate Interests and the Three-Part Test

Most B2B email marketing runs on legitimate interests under Article 6(1)(f). Recital 47 recognizes direct marketing as a potential legitimate interest, which gives the approach a solid starting point.² “Potential” is the key word. You still have to work through and document a three-part test before sending anything.

The European Data Protection Board sets out three conditions that must all be satisfied:³

The interest itself must be lawful, clearly defined, and real. “We want to grow revenue” is too vague. “We want to introduce our compliance software to data protection officers at mid-size firms” works.
The email campaign must be necessary to achieve that goal. If a method using less personal data would work as well, you should use that method.
Your interest must not be overridden by the recipient’s privacy rights. That means weighing how intrusive the contact is, whether the person would reasonably expect to hear from you, and what safeguards are in place, such as easy opt-outs.

If the recipient’s rights outweigh your marketing purpose at the third stage, you cannot send. Supervisory authorities expect a written record of this analysis, not an assumption that B2B email is low-risk by default.⁴

When Consent Is the Only Option

Consent under Article 6(1)(a) is your alternative basis. In some situations it is the only option, because when the ePrivacy rules in the recipient’s country require consent for the type of message you’re sending, legitimate interests under the GDPR won’t override that national requirement.

GDPR consent has four ingredients built into its definition: freely given, specific, informed, and unambiguous.⁵ The person must take a clear affirmative action, such as ticking an unchecked box. Pre-ticked boxes, silence, and bundling consent with a service agreement all fail. Consent gathered through confusing language, or made a condition of accessing something unrelated, is invalid.

Consent also comes with strings that legitimate interests does not. The person must be able to withdraw consent at any time, and doing so must be as easy as giving it. A single unsubscribe link meets this; forcing someone to log into a portal, navigate to account settings, and confirm by email does not.⁵ You also carry the burden of proof. No timestamped record of when and how a person opted in means no valid consent.

Who Counts as a Corporate Subscriber

The corporate-versus-individual distinction is one of the most consequential details in B2B compliance, and companies get it wrong constantly. Under ePrivacy rules in most European countries, corporate subscribers get fewer protections from direct marketing. You can generally send unsolicited emails to a company’s generic address (like info@company.com) or to named employees at incorporated businesses without prior consent, provided you still comply with the GDPR for any personal data involved.

Corporate subscribers are entities with separate legal identity: incorporated businesses, limited liability partnerships, Scottish partnerships, government bodies, and similar organizations.⁶ The defining feature is that the business is a legal person distinct from the individuals behind it.

Individual subscribers get the same protection as private consumers. This category includes sole traders, non-LLP partnerships, and other unincorporated groups.⁶ Because those businesses are legally indistinguishable from the people running them, cold-emailing them without a proper basis is treated identically to emailing a private individual. Misclassifying a sole trader as a corporation is exactly the kind of mistake that draws regulatory attention.

The Soft Opt-In for Existing Customers

If you already have a commercial relationship with a business contact, you may not need fresh consent to market to them. The ePrivacy soft opt-in applies when every one of these conditions is met:

You collected the person’s email address during a sale or negotiations for a sale.
The marketing relates to products or services similar to what the customer originally bought or discussed.
You gave the person a clear, simple way to refuse marketing use of their details when you first collected them, and they did not use it.
Every subsequent email includes an easy way to unsubscribe.

The exception is narrower than many marketers assume. If a customer bought accounting software from you, emailing them about your new accounting add-on fits. Emailing them about your unrelated recruiting platform probably doesn’t, because the products aren’t similar enough. The exception evaporates entirely if you didn’t offer an opt-out at the point of collection.

Cold Outreach and Purchased Lists

Cold B2B email sits in the riskiest compliance territory. Without a prior relationship you can’t claim the soft opt-in, so your basis will almost always be legitimate interests, and the balancing test scrutiny is higher. The recipient didn’t expect to hear from you, so their reasonable expectations weigh against you in the assessment.

Purchased lists layer more risk on top. Buying a contact list does not transfer legal compliance along with the data. You remain fully responsible for proving that every contact can be lawfully processed. If the vendor scraped emails without any basis, or collected them under a consent framework that didn’t contemplate your use, the liability falls on you.⁴

Before using any third-party list, verify how the data was originally collected, confirm the vendor keeps auditable records of their sourcing, and document your own legitimate interest assessment for each category of contact. Check the list against your suppression file so you aren’t re-contacting people who already opted out.

When personal data wasn’t collected directly from the individual, Article 14 adds transparency duties. You must provide the recipient with your identity, the purpose of your processing, the source of their data, and their rights, no later than your first contact with them.⁷ Skipping this because “it’s just a cold email” is a common and expensive mistake.

What Every Marketing Email Must Include

Every marketing message to a business contact must satisfy the transparency requirements of Articles 13 and 14. The specific disclosures depend on whether you collected the data directly or obtained it elsewhere, but the core requirements overlap.⁸

At minimum, your email or a linked privacy notice must include:

Your organization’s name and a valid contact address, physical or digital.
A clear statement that the message is marketing. Disguising a promotional email as a personal note or transactional message violates transparency rules.
Your legal basis. If it is legitimate interests, you must identify the specific interest.
The source of the address, if you didn’t collect it directly from the recipient.⁷
A visible, easy-to-use unsubscribe link or reply instruction that works without creating an account or logging in.
The recipient’s rights to access, correct, or delete their data, and to lodge a complaint with a supervisory authority.

Not everything needs to appear in the email body. Most compliant organizations put sender identity, purpose, and the unsubscribe link in the email itself, and link to a full privacy notice covering the remaining disclosures. The notice must be easy to find, not buried three clicks deep on your website.

Handling Opt-Out Requests

When a business contact objects under Article 21, the result is absolute. You cannot argue that your legitimate interests override the objection, and you cannot ask the person to explain their reasons. Once they say stop, you stop.⁹

Article 12(3) gives you a maximum of one month to act on any data subject request, including an Article 21 objection.¹⁰ In practice, a month is far too long for an unsubscribe. Most supervisory authorities and recipients expect marketing to stop within days. If your email platform can’t suppress an address within 48 hours, your process needs fixing.

Tell recipients in your initial privacy notice, and at the latest in your first message, that they have the right to object to direct marketing at any time and free of charge.¹¹

Why Deleting Opted-Out Contacts Backfires

The instinct when someone opts out is to delete the record entirely. That instinct will get you in trouble. Wipe the contact and you lose the record of the objection. The next time you import a list from a trade show, a partner, or a purchased source, that same address can reappear with no flag, and you’ll email someone who already told you to stop.

A suppression list solves this by keeping the minimum data needed to enforce the opt-out, typically just the email address and the date the objection was recorded. The contact stays permanently excluded from marketing sends, even if their details re-enter your system through a new source. This complies with Article 21(3), which requires that personal data “shall no longer be processed” for direct marketing once an objection is made; retaining data solely to prevent future contact is not marketing processing.⁹

Keep suppression lists stripped to identifiers only. No job titles, no company names, no campaign history. The sole purpose is to stop future emails, and storing anything beyond what’s needed for that purpose creates unnecessary risk.

The Documentation Regulators Ask For

If you rely on legitimate interests, you need a written Legitimate Interest Assessment on file before your first send. Article 5(2) requires controllers to demonstrate compliance with the data protection principles, and supervisory authorities will ask for this document during an investigation.

The EDPB guidelines say your assessment must address each of the three conditions and should cover:³

The interest itself: what you’re trying to achieve and why it qualifies as legitimate.
The necessity analysis: why email marketing is needed to achieve the goal and whether less intrusive alternatives exist.
The balancing factors: the nature of the data, the context of the relationship, the recipient’s reasonable expectations, the impact on the recipient, and any safeguards you’ve put in place, such as frequency caps, easy opt-outs, and audience targeting.

Beyond the assessment, Article 30 requires a record of processing activities that covers your marketing.¹² The record must include the categories of recipients, the purpose of each processing activity, the categories of personal data involved, any transfers to third countries, and anticipated retention periods. If consent is your legal basis, you also need a timestamped record of when and how each person opted in, including the specific information they were shown.

These records must be in writing and available for inspection by supervisory authorities on request.¹² Organizations that can’t produce them are, for regulatory purposes, non-compliant regardless of how careful their actual marketing might be.

Sending Data to Non-EEA Marketing Platforms

If your email platform is hosted outside the European Economic Area, every contact record you upload is a data transfer that needs its own legal basis. This catches many marketers off guard because the transfer happens automatically the moment you add contacts to a campaign tool.

For transfers to U.S.-based platforms there are two main mechanisms. If the platform participates in the EU-U.S. Data Privacy Framework, the European Commission’s adequacy decision (effective July 10, 2023) allows the transfer without additional safeguards. You can verify a provider’s participation on the official Data Privacy Framework List, and the provider must renew its certification annually to stay eligible.¹³

If your platform is not DPF-certified, you’ll need Standard Contractual Clauses. These are pre-approved contractual templates adopted by the European Commission that bind the data importer to EU-equivalent data protection standards.¹⁴ Both parties must sign the clauses and complete the required annexes. SCCs are not a formality; they create enforceable obligations, and regulators check whether they’re actually implemented.

What Non-Compliance Costs

GDPR violations carry two tiers of administrative fines. The higher tier, which covers violations of the core processing principles and data subject rights most relevant to marketing, reaches up to €20 million or 4% of worldwide annual turnover, whichever is higher.¹ The lower tier, which covers obligations like record-keeping failures, caps at €10 million or 2% of turnover.

Fines are not the only exposure. Individuals whose data is mishandled have the right to seek compensation for damages. Regulatory investigations consume significant internal resources, and a published enforcement action can damage B2B relationships for years. The organizations that get caught most often aren’t running sophisticated schemes. They’re the ones that skipped the Legitimate Interest Assessment, bought an unchecked email list, or treated every business contact as a corporate subscriber without verifying the recipient’s legal structure.

1
General Data Protection Regulation. General Data Protection Regulation Art. 83 – General Conditions for Imposing Administrative Fines
2
General Data Protection Regulation. GDPR Email Marketing
3
European Data Protection Board. Guidelines on Processing of Personal Data Based on Article 6(1)(f) GDPR
4
General Data Protection Regulation. General Data Protection Regulation Art. 6 – Lawfulness of Processing
5
General Data Protection Regulation. General Data Protection Regulation Art. 7 – Conditions for Consent
6
Information Commissioner’s Office. Business-to-Business Marketing
7
General Data Protection Regulation. General Data Protection Regulation Art. 14 – Information to Be Provided Where Personal Data Have Not Been Obtained From the Data Subject
8
General Data Protection Regulation. General Data Protection Regulation Art. 13 – Information to Be Provided Where Personal Data Are Collected From the Data Subject
9
General Data Protection Regulation. General Data Protection Regulation Art. 21 – Right to Object
10
General Data Protection Regulation. General Data Protection Regulation Art. 12 – Transparent Information, Communication and Modalities
11
European Commission. What Happens if Someone Objects to My Company Processing Their Personal Data
12
General Data Protection Regulation. General Data Protection Regulation Art. 30 – Records of Processing Activities
13
Data Privacy Framework. Data Privacy Framework Program Overview
14
European Commission. New Standard Contractual Clauses – Questions and Answers Overview