Cold email in Italy: is it legal to write to a company that doesn't know you?
For promotional emails, Italian law requires prior consent, and the rule also applies between businesses: Article 130 of the Italian Privacy Code is a special provision, and legitimate interest is not an available route. What remains permitted, what the Italian Data Protection Authority's decisions say, and how to check whether you can write to an address.
Consent is not a formality: in Italy it is the only lawful basis for cold email
No, not without consent: Italian law requires it for promotional email, including between businesses. What article 130 of the Privacy Code says, how the Garante applies it, and which messages you may still send.
In Italy, promotional email requires the recipient's prior consent, including when the recipient is a company: article 130 of the Privacy Code sets the rule, and the Garante has confirmed it applies to addresses collected from public sources too.
Is it legal to send cold email to a company in Italy?
No: in Italy, sending a promotional cold email to a company is not lawful without the recipient's prior consent. The rule is article 130 of the Privacy Code (legislative decree 196/2003), which the Garante — the Italian data protection authority — applies as a special provision that overrides the free choice of legal basis under the GDPR: where article 130 applies, legitimate interest is not an available route. B2B cold email is not a separate category here.
This does not mean that writing to someone who has not bought from you yet is always forbidden. It means that «lawful cold email» is not a type of message but a question of legal basis: the useful question is not «can I do cold email?» but «on what basis am I writing to this address?». There are only a few bases, and they are quick to recognise.
In short
- For promotional email, article 130 of the Italian Privacy Code requires prior consent, including towards companies.
- Legitimate interest is not available: article 130 is a special provision and overrides the free choice of legal basis.
- An address found on a website, in a public directory or on a social network is not consent, and the Garante has said so in writing.
- The only derogation is soft spam (article 130, paragraph 4): an address the recipient gave you when buying a similar service, with a way to opt out in every message.
- Italy is stricter than most of Europe on purpose: the ePrivacy Directive lets each member state decide how far to protect legal persons, and Italy extended that protection.
Why is legitimate interest not enough for a promotional message?
Because alongside the GDPR there is a provision that covers electronic communications only, and email marketing without consent has no alternative basis to fall back on. Article 130 of the Privacy Code implements the ePrivacy Directive and requires consent to send promotional messages by email: it is a lex specialis, a special rule that prevails over the general one. The GDPR lets you choose among six legal bases; article 130 leaves you one. The two decisions that state it most plainly are the Garante's decision of 12 February 2026 and, much earlier, the one of 11 December 2008.
-
Article 130 covers companies too
The ePrivacy Directive lets each member state decide how far to protect legal persons from unsolicited communications, and Italy extended that protection. This is why the practices you read about on English-language sales blogs do not carry over: they come from jurisdictions that treat B2B differently.
-
«I found it online» is not a basis
In its February 2026 decision the Garante rejected the defence of a company that had collected addresses from «public online directories, websites or social media»: a piece of data being publicly reachable does not authorise using it for marketing, because that purpose is foreign to the one it was published for.
-
You cannot get around it with «may I write to you?»
Back in 2008 the Garante made clear that the rule cannot be circumvented by sending a first email that asks for consent while carrying promotional content. A message that introduces your company and its services is promotional, even if it ends with a question.
How do you check whether you may write to an address?
Look at where the address came from
Look at the relationship
Look at what you are sending
Put the way out in writing
Look at where the address came from
Look at the relationship
Look at what you are sending
Put the way out in writing
A typical case: four hundred addresses in a spreadsheet
Before
A list built over six months: companies found on maps, addresses copied from websites, a few contacts collected at a trade fair and some former customers, all in the same column. The send goes to everyone, because there is only one list.
After
The same spreadsheet split in three: people who gave you their address, people who are or were customers for a similar service, and everyone else. You write to the first two groups, with the way out stated in every message. You do not email the third.
What changed
You send far fewer messages, and they go to people who had a reason to reply. More importantly: if anyone asks you on what basis you contacted them, the answer exists, and it is the same for every row of the list.
Six beliefs that get people into trouble
A piece of data being public concerns how reachable it is, not the purposes it may be used for. The Garante put it explicitly: presence in public directories, websites or social networks does not authorise marketing use, because that purpose is foreign to the one the data was made public for.
For a generic mailbox that cannot be attributed to an identified person the argument has some ground — but it does not solve the problem. Article 130 does not protect natural persons only, and in Italy the protection of legal persons was extended. The constraint stays even where the GDPR alone would not reach.
This is the most widespread sentence and, in Italy, the least true. Legitimate interest is one of the GDPR bases, but for promotional email article 130 allows only one. In some European countries the reasoning holds; here it does not.
An easy way to object is mandatory, but it is a requirement added to the legal basis, not one that replaces it. A send without a basis does not become lawful because it is easy to opt out of.
Italy's Registro Pubblico delle Opposizioni covers telephone calls and paper mail. For email there is no register to check: the list of people not to contact is yours to keep, and yours to check before every send.
The Garante closed that route in 2008: a first email cannot ask for consent while carrying promotional content. If the message introduces you and your services, it is already a promotional communication.
What to do now
- Split the list you already have by origin, before you send anything else: the question «where did this address come from?» must have an answer for every row.
- Put the way out in every message and keep a suppression list the system checks before sending, not from memory.
- If you really need cold outreach, talk to a privacy lawyer before you start, not after the first complaint.
AraLith is an Italian software house, based in the province of Rome and running since 2007, that builds email prospecting software: this article is its reading of the legal framework, with the sources cited, and it does not replace legal advice on your case.
Frequently asked questions about cold email and Italian law
Yes. Article 130 does not distinguish between natural persons and companies, and in Italy the protection was extended to legal persons. Writing to a professional or to a company does not change the basis required.
Soft spam is the derogation in article 130, paragraph 4: if the recipient gave you their address in the context of buying a service, you may offer them a similar service without separate consent — provided they were informed at collection and can say no in every message.
It depends on the case, and it is not a question that can be answered in general. In the February 2026 decision the Garante issued a reprimand with no financial penalty, treating the infringement as minor: one email per recipient, immediate deletion of the data, a small business, no prior record and corrective measures adopted. Those are the circumstances of that case, not a rule.
No: the problem only moves. Whoever sells the list should have collected valid consent covering communications from third parties, and that consent should be demonstrable address by address. In practice it rarely is, and the responsibility of the sender remains the sender's.
Because the ePrivacy Directive leaves each member state to decide how far to protect legal persons from unsolicited communications, and Italy chose to extend that protection. The practices behind English-language outreach tools were built in different jurisdictions.
With the usual rules about content: one message per recipient, relevant, short, with a clear reason why you are writing to them and not to a list. That is where the work actually pays off.
Do you have a list and no idea what basis it rests on?
AraLith Mailable keeps the list, the messages and the suppression list in one place, checks it before every send, and sends one message at a time from your own mailbox.
