GDPR consent rules for B2B cold email, and where legitimate interest ends

Legitimate interest is a basis, not a loophole

Under GDPR, sending unsolicited commercial email to an individual generally requires consent - except where a recipient's role is clearly relevant to your product and you can show a genuine business relationship or interest that outweighs their right to privacy. This is the "legitimate interest" basis, and it is the one most B2B cold email programs rely on, often without documenting it properly.

Relying on legitimate interest is not automatic. It requires a three-part balancing test: a legitimate purpose, necessity (you could not reasonably achieve the purpose another way), and balance (the recipient's interests do not override yours). You are expected to be able to show this reasoning if asked, not just assert it.

What the basis actually requires in practice

• The recipient's role must be genuinely relevant to what you are selling - a generic list of "marketing manager" titles scraped without regard to company fit does not meet the bar.
• You must give a clear, working opt-out in every message, and honour it immediately, not at the next list sync.
• You must be able to document why you believed legitimate interest applied for that specific list or campaign, not just for your company in general.
• Purchased or scraped lists with no record of where the data came from make the balancing test very hard to defend, because you cannot show the data was collected fairly in the first place.

Where this intersects with deliverability

A list built on a weak legitimate-interest basis tends to fail on deliverability for the same underlying reason it fails on compliance: the recipients did not expect your email and do not want it. That shows up as spam complaints, low open and reply rates, and a thin or non-existent engagement signal - all of which feed directly into how Gmail and Outlook score your sending reputation.

Data retention and cross-border transfer, briefly

GDPR's storage limitation principle means you should not keep contact records indefinitely "just in case" - define a retention period tied to actual business need and delete or anonymise after it lapses. If you transfer EU contact data to a processor outside the EEA (a CRM or sending platform hosted elsewhere), that transfer needs its own legal mechanism, typically Standard Contractual Clauses, which is a contractual matter with your vendor, not something a sending tool handles for you.

What to actually record for a legitimate interest assessment

Regulators expect you to be able to show your reasoning, not just assert that you did it. A simple, honest record for each list or campaign relying on legitimate interest should cover: why the recipient's role is relevant to what you're offering, what alternative you considered and why it wasn't sufficient, and what you concluded about the balance between your interest and theirs. This doesn't need to be a lengthy legal document - a short, dated note per campaign or list segment, kept alongside your sending records, is enough to show the assessment happened and wasn't skipped.

Keep this record from the point you build the list, not retroactively after a complaint or inquiry arrives. A retroactively constructed justification is far weaker evidence than a contemporaneous one, and the habit of writing the assessment down before sending tends to catch weak legitimate-interest cases before they go out, which helps both compliance and deliverability at once. Review these records periodically, not just at the point of first building a list - a role or company context that justified legitimate interest a year ago may no longer apply if the contact's position or your product has changed meaningfully since.

What not to do

Do not treat "we're B2B so GDPR doesn't apply" as true - GDPR applies to any personal data about an identifiable individual in the EU/EEA, regardless of whether the email address is a corporate one. Do not rely on legitimate interest for a list you bought without provenance records. Do not bury the opt-out in a footer link that takes multiple clicks to actually unsubscribe - both your legal exposure and your complaint rate go up together.

MailPilot does not manage consent or legal basis - that is a sending-practice and legal decision - but it does track the complaint and bounce signals that a weak list produces, per mailbox and per domain, so a compliance gap shows up as a reputation problem before it becomes a regulatory one.