Cold Emailing Europe in 2026: What Actually Gets You a German Abmahnung

A founder posts in a GTM Slack community: he wants to cold email prospects in Germany and is worried about a cease-and-desist letter he read about online. The replies are split between "GDPR makes all of this illegal" and "just send it, nobody ever gets caught," and neither answer is right. The real rule is narrower than both: most of the EU runs on GDPR's legitimate interest basis, and Germany is the one market that requires prior consent instead, under its own unfair-competition law. Knowing that one distinction is most of what GDPR compliant cold email in Europe actually requires.

The Letter That Scares Founders Out of the EU Market

A German cease-and-desist letter, an Abmahnung, is the specific cost most teams are actually afraid of, and it is real but bounded. A pre-litigation Abmahnung for an unsolicited commercial email typically runs EUR 400 to 1,000. A repeat pattern or an aggressive "amount in dispute" claim can push a demand to EUR 3,000 or more, and an unresolved case adds legal fees on top. Treat any single figure you see cited online as a floor, not a settled price.

That fear is doing more damage than the letters themselves. Teams who conflate "Germany is strict" with "the EU is closed" skip a continent of legitimate pipeline instead of building the one workflow that would make a German send defensible, or routing German contacts into their own track and sending everywhere else normally.

Germany Is the Exception, Not the EU Default

France, the Netherlands, and the Nordic countries allow B2B cold email under the same legitimate interest basis that covers most of the bloc; Germany is the one market with a separate, stricter rule. Treating every EU country like Germany means under-using a legal basis that is available almost everywhere else.

One default workflow handles legitimate interest across most of the EU. German contacts need a second, consent-gated track. Building both is simpler than it sounds once you know which contacts need which treatment.

What "Legitimate Interest" Actually Requires

Legitimate interest under GDPR Article 6(1)(f) is not a blanket excuse to email anyone with a public inbox; it is a documented, three-part test. A business has to show a real interest in reaching the contact, that the message is something the contact could reasonably expect given their public role, and that an easy opt-out exists and gets honored.

• The contact's job function has to plausibly connect to what you are selling, not a generic "info@" inbox.
• A reasonable person in that role could expect this kind of message, given what they do publicly.
• Every message includes a working, honored way to opt out.

This is where a lot of ad hoc list-building falls apart. A list stitched together from a scraper or a purchased export has no record of where each contact came from, which means there is nothing to point to if a recipient disputes it later. The test only protects you if you can show your work.

Why German Law Runs on Consent, Not Interest

Germany's Section 7 of its unfair competition law (UWG) treats an unsolicited commercial email as "unreasonable harassment" unless the recipient gave prior, express consent, and it does not carve out an exception for B2B. This is a separate statute from GDPR, and it is the one German courts actually apply in cold email disputes.

• Consent means opt-in, given before the first commercial email, not implied by a listed company address.
• A published business contact, even on a company's own "About" page, does not count as consent under German case law.
• The one recognized exception is an existing customer relationship with a narrow, related offer.

In practice: treat German contacts as their own lane. Everywhere else in the EU, document legitimate interest. In Germany, get opt-in first or rely on the existing-customer exception.

The Two Court Rulings Everyone Cites Loosely

Germany's Federal Court of Justice (BGH) settled this question in 2009, and both rulings still anchor enforcement today. Most pages on this topic mention "a 2009 ruling" without naming it; the actual case numbers are worth knowing if a letter ever lands in your inbox.

• BGH I ZR 218/07, "E-Mail-Werbung II," May 20, 2009: sending unsolicited commercial email without prior consent is an actionable interference, B2B included.
• BGH I ZR 201/07, "E-Mail-Werbung III," December 10, 2009: publishing a business email address does not amount to implied consent to receive marketing.

A list with no documented source is a list with nothing to show a court or a recipient who disputes how their email was obtained. The fix is not a better subject line, it is a paper trail that exists before the first send, not after a complaint.

Build the File Before You Hit Send

A defensible legitimate interest assessment is five things, written down before the campaign launches, not reconstructed afterward.

• The specific purpose for contacting this segment, not a generic "sales outreach" line.
• Why the role fits, meaning the contact's job function connects to what you are offering.
• Where the contact came from, with a verifiable source and a match confidence, not a merged spreadsheet.
• The opt-out mechanism in the message, and a process that actually honors it.
• A refresh cadence, so a six-month-old record is not still being treated as current.

Most teams that get this wrong are not trying to break the rules. They are skipping documentation because it feels like busywork, until the one complaint arrives that asks for exactly the five things above.

How Vibe Prospecting Keeps a European List Defensible

Ask Vibe Prospecting, in Claude or ChatGPT, to check a European contact list before you send, and it returns the role, company, and country context a legitimate interest assessment actually needs, powered by Explorium Enterprise Business Data. That is the practical answer to the open question a lot of GTM Slack threads never resolve: how do you verify provenance before a send wave, not after a complaint.

• Ask for a company and role match on a batch of contacts in one chat request instead of five separate exports from five tools.
• The response includes the role and company context your written assessment needs: title, company size, and country, so the country-routing step above is a filter, not a guess.
• Preview a small batch before committing credits, so you are not paying to validate a list you have not decided to use yet.
• A free account with no sales call lets a small team start with a handful of EU contacts and prove the process before scaling it.

A Chat Workflow for Checking a List Before You Send

The whole process fits into one chat session: ask for the match, flag the country, and log the basis, before a single email goes out. Here is a prompt that works in Claude or ChatGPT once Vibe Prospecting is connected.

Check this list of 40 EU contacts for role, company, and country. Flag anyone based in Germany separately, and for everyone else, give me the fields I need to write a legitimate interest note: job title, company size, and whether the role is plausibly relevant to a B2B sales tool pitch.

The output tells you which contacts route through your default legitimate-interest workflow and which ones need an opt-in track for Germany, so the split happens before the campaign launches, not after someone complains.

1. Write the assessment first. Purpose, role fit, and the balancing test, before pulling a single contact.
2. Check the list in chat. One request against Vibe Prospecting instead of five unverified exports stitched together.
3. Route by country. German contacts go into the consent-gated track; everyone else moves on legitimate interest.
4. Ship a working opt-out. Suppress the contact the moment they use it, not at the end of the quarter.
5. Refresh before the next wave. A record that was accurate in January is not automatically accurate in October.

Teams get EU outbound wrong by skipping documentation, not by misreading the law on purpose. A verified source for every contact, a written assessment before launch, and a Germany-specific track are what make legitimate interest defensible instead of theoretical.