B2B email compliance is not one rulebook. It is ten different ones, and a campaign that is fine in Pune can draw a cease-and-desist letter in Düsseldorf.
ARS B2B Social Bridge built the B2B Email Compliance Atlas 2026 to put those rules side by side. It is a free 16-page PDF, and this article is the short version. Here's the thing: "it's B2B, so it's fine" is wrong in at least five of the ten markets we mapped. This is general information, not legal advice.
Get the full B2B Email Compliance Atlas
Ten country playbooks, a consent spectrum, a pre-send checklist, sample consent wording and vendor questions. No placeholders, no fluff.
- 10 countries
- Calls
- Lead sharing
- Checklist
- Vendor questions
Figures come from the GDPR legal text, Revision Legal and the ARS atlas. Revision Legal is a law-firm summary, so read the TCPA numbers as directional and confirm with counsel.
What does the B2B email compliance atlas cover?
The B2B Email Compliance Atlas 2026 is a free 16-page PDF from ARS B2B Social Bridge. It maps consent rules for B2B email, calls and lead sharing in ten countries: the US, UK, Canada, Australia, Germany, France, Japan, South Korea, Taiwan and India. It adds a checklist, sample consent wording and vendor questions.
We wrote it for demand generation heads, SDR managers and marketing-ops teams who run one CRM across many borders. Each country gets one card: the law, the email rule, the phone rule, the penalty and one watch-out. The table shows how the PDF is organised.
| Section | Pages | What you get |
|---|---|---|
| Findings and matrix | 3 to 4 | Five headline findings and a consent spectrum |
| Country playbooks | 5 to 9 | Ten cards covering email, phone, penalties and watch-outs |
| Syndication and lead sharing | 10 | Seven rules for bought and partner leads |
| Myths and 2026 changes | 11 | Six myths with facts, plus the dates to watch |
| Checklist and consent wording | 12 | Twelve pre-send checks and a sample consent block |
| Vendor questions | 13 | Ten questions to ask before you buy data |
| Limits, method and sources | 14 to 15 | What we could not verify, with source quality for each market |
It pairs with our B2B lead quality report 2026. Compliance gets a lead through the door legally. The quality report helps you decide whether that lead deserves a sales call.
Is B2B cold email legal without prior consent?
It depends on the country. The US and France let you send B2B email first if you meet conditions, such as an opt-out and a role-relevant message. Canada, Australia, Germany, Japan and South Korea lean on consent first. The UK splits by recipient type. One global policy will fail somewhere.
The consent spectrum for B2B email, lightest to strictest. This is our editorial reading, not a legal grade.
The pattern matters more than any single rule. Business email is not a loophole. CAN-SPAM covers B2B email in the US. Japan's rule applies to business recipients. Germany's rule reaches generic inboxes.
So set your default to the strictest market you actually sell into. Then relax it country by country, with a local lawyer reading the exceptions.
What are the B2B email compliance rules in each country?
Each atlas card covers one country: the law, the email rule, the phone rule, the penalty and one watch-out. The table below gives the B2B email and phone position for all ten markets. Read the full card before you act, because a table row cannot carry the exceptions.
| Country | Regime | B2B email | Phone |
|---|---|---|---|
| United States | Opt-out | Send first with honest headers, a postal address and a working opt-out | Written consent for autodialled mobile calls |
| United Kingdom | Split | Corporate bodies yes. Individuals need consent or the soft opt-in | TPS and CTPS screening |
| Canada | Opt-in | Express or implied consent. Unsubscribe within 10 business days | CRTC rules and the National Do Not Call List |
| Australia | Consent-first | Consent (express or inferred), sender ID, working unsubscribe | Do Not Call Register rules |
| Germany | Strict | Prior express consent, including generic inboxes | Presumed consent only on concrete facts |
| France | Conditional | Allowed if notified at collection and role-relevant | Objection right applies; Bloctel is consumer-only |
| Japan | Strict | Prior opt-in, with narrow exceptions | Check with local counsel |
| South Korea | Strict | Advance consent, with extra night-time rules | Check with local counsel |
| Taiwan | Notice | Opt-out route at first contact; consent beyond the collection purpose | PDPA Article 20 duties |
| India | Consent-led | DPDP Act: plain-language notice, withdrawable consent | TRAI rules for calls and SMS |
Our sources differ in quality. For the UK, Canada and Australia we read regulator pages: the ICO, the CRTC and the ACMA. For Germany, France, Japan, Korea, Taiwan and India we relied on law-firm and industry summaries, and the atlas marks each card with a source-quality badge.
Why is Germany the hardest market for B2B email compliance?
Germany's UWG §7 asks for prior express consent for commercial email, with no general B2B exemption. Per Overloop, the rule reaches generic inboxes such as info@. The existing-customer exception has four cumulative conditions, and a free trial sign-up does not automatically qualify. Calls follow a separate test.
Overloop also warns that GDPR legitimate interest does not by itself authorise an advertising email. Intent signals, such as a website visit or a data-provider alert, do not replace consent either.
Calls and email are judged separately
For B2B phone calls, presumed consent may apply, but only on concrete facts that the business would welcome the call. Industry fit or an intent score alone is not enough. A permissible call does not clear the follow-up email.
The risk is mostly a letter, not a fine
The usual first hit is a competitor's cease-and-desist letter (an Abmahnung) with legal costs. Data-protection authorities and civil claims sit behind it. There is no single headline fine to plan around. The official statute page blocked automated access, so confirm details with German counsel.
Does the UK treat every B2B contact the same way?
No. Per the ICO, you can email corporate bodies such as companies, LLPs and Scottish partnerships. Sole traders and some partnerships count as individuals, so you need their consent, or the soft opt-in for existing customers. UK GDPR still covers the personal data inside work addresses.
The soft opt-in does not cover prospects, bought-in lists or charity fundraising. So tag every UK contact as corporate or individual in your CRM. A Ltd company is corporate. A plumber trading under his own name is not.
On fines, our earlier desk research says PECR penalties were aligned with UK GDPR levels from 5 February 2026. The ICO email page does not state fines, so check the ICO before you quote a figure.
What happens if you break B2B email compliance rules?
Penalties differ widely. US TCPA damages are $500 per violation, up to $1,500 if wilful, per Revision Legal. GDPR fines reach €20 million or 4% of worldwide turnover under Article 83(5). In Germany, the usual first hit is a competitor's cease-and-desist letter with legal costs.
| Market | What can happen | Source quality |
|---|---|---|
| United States | TCPA damages of $500 per violation, up to $1,500 if wilful. Private lawsuits are possible. | Law-firm summary |
| EU GDPR markets (Germany, France) | Up to €20 million or 4% of worldwide turnover for the most serious breaches. Lower tier: €10 million or 2%. | Legal text (Article 83) |
| Germany | Competitor cease-and-desist letters with legal costs, plus data-protection enforcement and civil claims. | Industry summary |
| Australia | Reports quoting the ACMA cite up to A$2.1 million a day for repeat offences. The ACMA page states no amount. | Secondary (Mondaq) |
| Japan | A secondary source puts the corporate fine at up to ¥30 million. | Secondary (Monolith) |
| Canada, South Korea, Taiwan | Amounts not verified in this edition. Check the statute or local counsel. | Not verified |
Fines are only part of it. A cease-and-desist letter, a blocked sending domain or a damaged partner relationship often costs more than the penalty.
How does lead sharing change B2B email compliance?
When a partner collects the lead, your consent depends on what the person agreed to at the partner's form. Name who may contact them, keep proof for every lead and send a source notice. Under GDPR Article 14 that notice is due within one month. Bought lists do not move the risk, per the ACMA.
Syndication means a partner collects the lead and you receive it. You did not build that form, but you inherit its consent. That is why the atlas gives lead sharing its own page.
Name who will contact the person
Consent that says "partners" is weak. Name your company, or list the sponsors beside the form.
Keep proof for every lead
Store the timestamp, form version and consent text. The ACMA and the CRTC both put the burden of proof on the sender.
Send the source notice
Under GDPR Article 14, tell people where you got their data within a reasonable period, and at the latest within one month.
Pass opt-outs back
Put a duty and a timeline in the partner contract. An opt-out that never reaches you is still your breach.
One more trap: in Germany, a content download is not consent to email. And the ACMA says purchased or rented lists do not remove your responsibility. Once a lead is clean, judge how good it is with our B2B lead quality report.
What should you check before every B2B email?
Check six things: the contact's country, whether they are a company or an individual, your consent proof, your sender identity, a working opt-out and role relevance. Then match each market's clock: 10 business days in Canada, 5 working days in Australia and one month for the GDPR source notice.
- Which country is this contact in, and which atlas card applies?
- Is the contact a company or an individual (UK, and sole traders)?
- Do you hold consent proof where the market needs it?
- Does the message name you and your legal business?
- Is there a free, working opt-out in every message?
- Does the message relate to the recipient's job (Canada, France)?
The PDF carries the full twelve-point checklist and a sample consent block. The sample names the sender, the purpose and the sponsors, and leaves the box unticked.
What do critics say about strict consent rules?
Critics say strict opt-in rules shrink lists and slow outreach. Supporters reply that smaller, consented lists convert better and cost less to defend. We found no primary study that settles it, so we quote no number. Test it on your own data before you pick a side.
Opt-in lists are smaller. That is true, and it is a real cost for teams with big pipeline targets.
Rules and enforcement also differ. In Germany, the risk comes mostly from competitor letters, not regulators, per Overloop. In other markets, regulators lead.
And this atlas has limits. Several sources are law-firm summaries. Canadian and Korean penalty amounts are not verified. We say so on each card. Have a local lawyer read your consent wording before a launch in a strict market.
What do marketers ask most about B2B email compliance?
What is B2B email compliance?
B2B email compliance means following the consent, sender-identification and opt-out rules that apply when you email business contacts. The rules differ by country. Some markets allow you to send first with an opt-out, while others need prior consent even for business addresses, so your policy must match each market.
Is B2B cold email legal?
It depends on the country. The US and France allow B2B cold email if you meet set conditions, such as an opt-out. Canada, Australia, Germany, Japan and South Korea lean on consent first. The UK splits by recipient type. Check the country card in the atlas before you send.
Does GDPR apply to B2B emails?
Yes, when the address identifies a person, such as jane.smith@company.com. The UK regulator, the ICO, notes that emailing staff at corporate bodies can raise data protection duties. GDPR also gives people the right to object to direct marketing at any time, and you must then stop.
Can you send B2B cold email to info@ addresses in Germany?
Generally no. Per Overloop, Germany's UWG §7 asks for prior express consent for commercial email, with no general B2B exemption, and the rule covers generic inboxes such as info@. The only exception is the existing-customer rule, which has four cumulative conditions. Check with German counsel.
What are the maximum GDPR fines?
Under GDPR Article 83, the lower tier is up to €10 million or 2% of worldwide annual turnover. The higher tier is up to €20 million or 4%, whichever is higher in each case. The higher tier covers the most serious breaches, including breaches of data subjects' rights.
Is the B2B Email Compliance Atlas free to download?
Yes. The B2B Email Compliance Atlas 2026 from ARS B2B Social Bridge is a free 16-page PDF. It covers ten countries, with a pre-send checklist, sample consent wording and ten questions for data vendors. Use the download button on this page. It is general information, not legal advice.
What should you do next about B2B email compliance?
Download the atlas, pick your three biggest markets and read those cards first. Then tag contacts by country and recipient type, store consent proof, and ask your data vendors the ten questions on page 13. Finally, have local counsel check any strict market.
B2B email compliance rewards boring discipline. Say who you are, make opting out easy and keep proof. Do that, and most of the ten markets get much easier to work in.
For wider business and marketing analysis, read The Business Perspective. For technology and automation coverage that touches outreach tooling, see IoT Mail Bridge and IoT Insights Hub. ARS B2B Social Bridge publishes more research at arsb2bsocialbridge.com.
Get the free B2B Email Compliance Atlas 2026 from ARS B2B Social Bridge. Sixteen pages, ten countries, no placeholders.
Download the free PDF