B2B Cold Email and GDPR: What You Can Send, Opt-Outs and Where AI Fits

BOTrento Team23 October 20268 min read

Two sets of rules, not one

Most confusion comes from mixing up two laws that apply at the same time.

• GDPR governs how you handle personal data: finding it, storing it, using it and deleting it. A work email address that identifies a person (a firstname.lastname pattern at a company domain) is personal data, even though it is a business address.
• ePrivacy rules govern electronic marketing messages. They are implemented nationally, so they differ from country to country. Some countries treat business recipients more leniently, others ask for prior consent or apply the same rules as for consumers.

In practice you must satisfy both. Passing the GDPR test does not automatically clear you under the local marketing-email rules, and the other way round.

Legitimate interest for B2B email: when it holds up

Legitimate interest is the basis most B2B senders rely on for cold outreach. It is not a free pass. It needs a short, written balancing test showing that your interest is real and that it does not override the recipient's rights and reasonable expectations.

Signs the balance is in your favour

• The offer is clearly relevant to the recipient's job (a rental company emailing event producers about equipment, not a random list).
• The contact would reasonably expect to hear from suppliers in your field.
• You collected the address from a legitimate, identifiable source, such as the company website or a public professional profile, and you can say where.
• The message is short, honest about who you are and why you are writing, and not repeated aggressively.

Signs it will not hold up

• Bought or scraped lists with no known source.
• Generic addresses mixed with private ones, or sole traders and small partnerships, which some countries treat like consumers.
• Targeting that has nothing to do with the person's role.
• Ignoring previous opt-outs.

Checklist before you send a cold email

Run through this for every campaign, not just once a year.

1. Check the country. For each target market, confirm whether national rules allow unsolicited emails to business contacts without prior consent. If unsure, ask a lawyer who knows that market.
2. Check the recipient type. Corporate role-based contacts are usually safer than sole traders or private addresses.
3. Write the balancing test. A half page: purpose, why the recipient would expect it, what data you use, how you limit it.
4. Know your source. Record where each contact came from and when.
5. Identify yourself. Real sender name, company and a reply address that works.
6. Explain the basis in the message or link. One line on why you are writing and where you got the address, plus a link or contact for your privacy information.
7. Add a clear opt-out. Simple, free and honoured promptly.
8. Keep a suppression list. Everyone who objects goes on it, and it is checked before every send.
9. Limit follow-ups. A short sequence is easier to defend than endless chasing.

For the wider GDPR picture on tools and processors, see our GDPR and AI checklist for enquiries and quotes.

Opt-outs: the part regulators and recipients notice first

Under GDPR, people have a right to object to direct marketing, and that right is effectively absolute for this purpose. Handle it like this:

• Make the opt-out visible in every email, not buried in small print.
• Accept a plain reply such as "please remove me" as well as a link.
• Act quickly and stop all outreach, including from other team members and other tools.
• Keep the minimum needed to remember the objection (the address on a suppression list), so you do not email them again.
• Sync the suppression list across Pipedrive, HubSpot, your mailbox and any spreadsheets. Most opt-out failures come from a second list nobody updated.

Where AI fits in cold outreach

AI does not change the rules. The legal basis, the national restrictions and the opt-out apply exactly as before. What AI changes is speed, and that makes mistakes easier to repeat at scale.

Sensible uses

• Drafting a first version of an email from facts you have already checked.
• Adapting a message to a recipient's role or language.
• Preparing follow-up drafts and reminding you about promises made.

Lines not to cross

• Sending automatically without a person reading the message.
• Feeding the model more personal data than the task needs.
• Letting AI invent personal details, claims or "I saw your recent post" lines that are not true.
• Using AI to build contact lists from unclear sources.

Also check your tool's data handling. Storing data on an EU server is not the same as the language model processing text inside the EU. Our articles on where your data is when you use AI and the EU AI Act for small businesses explain both points, and this checklist covers what to ask a vendor.

A short cold email template

Adapt this to your own offer, and have it reviewed for each target country.

Subject: Production crew hire for your autumn events

Hello Ms Novak,

I am writing because you organise corporate events and we rent AV and staging equipment to agencies in your region. I found your contact on your company website.

If it would help, I can send a short overview of what we have available for events in November and December.

If you would rather not hear from us, just reply "no thanks" and I will remove you from our list straight away. Our privacy information is here: [link].

Kind regards,
[Name, company, phone]

It says who you are, why this person, where you found the address, and how to stop further emails.

How BOTrento handles AI drafts with human approval

BOTrento Chief of Staff is a managed process for enquiries, quotes and follow-ups. It prepares drafts of replies, quotes and follow-ups in four languages (CS, EN, DE, FR), and nothing is sent without a person approving it. BOTrento does not send emails on its own, so a person always makes the final call on wording, recipient and timing.

It also catches promises such as "I'll get back to you by Friday" and reminds you, and each working morning it shows a short Today overview. It does not replace your CRM or your suppression list, so keep that list in the system you already use.

On privacy: data is stored on servers in Germany (EU). The text needed for a task is processed by the language model provider via API, using our account or, optionally, your own API key (see the API keys help page). That is not a closed computation, so mention it in your records. AI usage is included in the plan within a monthly limit.

You can see the approach in the process demo, or learn what BOTrento is. The 14-day free trial needs no card and no API key. It starts with your first successful data upload, and you have 7 days to prepare. Afterwards you keep read-only access and export for 30 days.