Our insights
GDPR & E-mail Compliance 2026 in B2B Outbound
Mario Sinz
Chief Growth at Leadtree
Published on
Email outbound will remain a central component of B2B sales in 2026 - at the same time, the legal situation is more complex than ever. This article shows why B2B companies should not hope for „B2B special rules“ when it comes to GDPR, UWG and TTDSG, which new developments (e.g. ECJ judgement, tracking pixels, failed ePrivacy Regulation) are relevant for your email setup and why professional done-for-you partners in the DACH region are becoming a real risk buffer.
Note: This article does not replace legal advice. You should always involve your legal department or a specialised law firm to assess your specific setup.
The key takeaways at a glance
- Consent remains the standard – even in B2B: According to Section 7 UWG, advertising by email without prior express, verifiable consent is generally not permitted - regardless of whether you are writing to private individuals or companies. The same applies to other „electronic mail“ such as LinkedIn messages. (ihk.de)
- Existing-customer advertising is strictly limited: You may only send emails without consent to existing customers if, among other things, the address was collected in connection with a sale, you are only advertising similar services of your own, and you clearly indicate the possibility of objecting. Even formal errors lead to the risk of a warning.ohn.haendlerbund.de)
- ECJ 2025 relaxes, but does not simplify: The CJEU has ruled that a free registration on a platform may, under certain circumstances, be considered a „sale“ in the sense of existing customer advertising – an actual purchase is no longer necessarily required. However, whether and how German courts will apply this in practice has not yet been conclusively clarified.ohn.haendlerbund.de)
- Illegal emails quickly become expensive: In the case of a travel company, a few promotional emails without a clear opt-in and only a hidden note in the privacy policy were enough for a warning letter and €600 in costs – and this expressly in a B2B context.ohn.haendlerbund.de)
- Tracking pixels are in the focus of supervisory authorities: National data protection authorities are increasingly treating tracking pixels in emails like cookies. Recommendations, such as those from the French CNIL, require separate, explicit consent for email tracking – in addition to consent for marketing emails themselves.getmailbird.com)
- The ePrivacy Regulation is not coming for the time being: The EU Commission withdrew the draft ePrivacy Regulation on 11 February 2025. This means that a patchwork of GDPR, the ePrivacy Directive, and national laws (UWG, TTDSG) will remain in place. For B2B outbound, compliance will therefore become more complex rather than simpler.getmailbird.com)
Do you want to understand more about the perfect symbiosis of social selling via LinkedIn and email outbound?
1. B2B is not a loophole: How GDPR, UWG & TTDSG will shape outbound email in 2026
1.1 Understanding the legal framework instead of hoping for „B2B exceptions“
Many B2B tech companies implicitly assume that cold emails are less strictly regulated in B2B than in B2C. This is a dangerous misconception for Germany.
Key points of the legal framework (Germany, as of early 2026):
- Law Against Unfair Competition (UWG)
- § 7 UWG regulates when advertising constitutes „unreasonable annoyance“.
- For advertising via e-mail or other electronic mail (including LinkedIn messages), it is generally presumed to be an unreasonable nuisance without prior express consent – no matter whether B2C or B2B. (ihk.de)
- GDPR
- Regulates the lawfulness of data processing (e.g. Art. 6(1)(a) consent, (f) legitimate interest).
- For email marketing without consent, a blanket „legitimate interest“ is rarely sufficient in practice because the UWG must be complied with in parallel. (ohn.haendlerbund.de)
- TTDSG
- The ePrivacy Directive is being concretised in Germany regarding the „storage and access of information on the end device,“ which includes cookies and tracking pixels in emails.
- Anyone using email tracking (opens, clicks, heatmaps) is processing additional information that requires consent.evalanche.com)
Existing customer acquisition as a narrow exception
Section 7(3) of the Unfair Competition Act permits advertising by email without consent under four conditions: the address was obtained in connection with a sale, only similar own services are advertised, no objection has been raised, and there is clear information about the right to object upon collection and each use.ohn.haendlerbund.de)
The ECJ ruled in 2025 that even free registration on a platform can be considered a „sale“ if the user is given access to content or services. (ohn.haendlerbund.deThis theoretically makes it easier to advertise to existing customers, for example, for SaaS freemium models, but the limits are not yet uniformly clarified by the courts in Germany.
1.2 What does this mean specifically for your B2B sales process?
For your outbound email setup, this means:
- Classic cold emails to „purchased“ B2B lists are highly risky.
Without express consent or a narrow exception for existing customers, there is a risk of warnings, injunctive relief and costs. Cases such as the Paderborn Regional Court show that courts make clear decisions here - even in the case of emails between companies. (ohn.haendlerbund.de) - B2B outbound must make a clear distinction between contact types:
- Prospects without a previous relationship: Email only is legally tricky; social selling and LinkedIn outreach are often the better first touchpoint here.
- Leads with double opt-in (e.g. white paper, webinar): Such contacts can be emailed within the scope of consent – ideal for lead nurturing, lead scoring and sales enablement.
- Existing customers Here you can advertise additional, similar services by e-mail if you design them correctly at the checkout or contract conclusion.
- Legally, LinkedIn also belongs at the table.
According to case law, e-mail rules apply to all types of messages that can be stored in the end device - including direct messages via LinkedIn, Xing, etc. (ihk.de)
For social selling, this means: mass and automation have their limits; a personal, psychologically optimised approach with a clear connection to the business context is not only more sensible from a sales perspective, but also legally. - Documentation is mandatory - not optional.
For every legally compliant appointment arrangement via email or LinkedIn, you demonstrably need: source of contact, legal basis (consent / existing customer / contract), timestamp, texts used. Modern email and CRM systems can provide this – if they are configured correctly.
It is precisely here that data-driven providers like Leadtree have an advantage: Transparent dashboards, KPI reporting, and an extensive tech stack not only ensure performance control but also provide clean traceability of lead origins and contact journeys.
2. Lead Tracking, KPI Reporting & E-Mail Tracking: What will still be permissible in 2026
2.1 Tracking pixels and KPIs under the TTDSG and GDPR
Many B2B sales teams manage their outbound activities using metrics such as open rates, clicks, scroll depth, and heatmaps. Technically, this is often based on tracking pixels that load when an email is opened.
Legally, that's tricky:
- The TTDSG transposes the requirements of the ePrivacy Directive and relevant judgements of the ECJ and BGH into German law. It covers all telemedia services - including email marketing and tracking. (evalanche.com)
- National supervisory authorities such as the French CNIL now treat tracking pixels in the same way as cookies. Previous, informed and express Consent. In some cases, even a separate Consent for email tracking requested – in addition to consent for the newsletter itself.getmailbird.com)
For your lead tracking and KPI reporting, this means:
- Open and click tracking are legally questionable without consent.
- Pure delivery and bounce information (technical necessity) are rather uncritical, but should nevertheless be properly documented.
- Lead scoring on the basis of tracking data requires a valid legal basis and transparency in your privacy policy.
At the same time, you need KPIs to optimise your sales funnel:
- How many contacts does your outbound automation go through?
- How high is the conversion from initial contact to qualified appointment?
- Which sequences work best in terms of appointment booking, pipeline value, and closing rate?
The lever is in, Selecting and collecting KPIs in a way that is data protection compliant and still relevant for steering.
2.2 Practical recommendations for GDPR-compliant lead tracking
- Decouple e-mail tracking and make it clearly consent-based.
- In forms (lead magnet, demo request, newsletter) you should - where tracking is necessary - include a separate checkbox to provide for email tracking, with a clear explanation of what data you collect and for what purpose.getmailbird.com)
- Standard: Opt-in for e-mails without Tracking; opt-in+ for e-mails with Tracking.
- Focus KPIs at funnel level instead of on microdataFor B2B outbound in tech start-ups, the following metrics are often sufficient:
- Number of new, GDPR-compliant leads per month (double opt-in or valid existing customer base)
- Number of target accounts contacted and return rates
- Number of qualified first/discovery calls
- Conversion rate per funnel stage (e.g. from LinkedIn outreach or email reply to appointment, from appointment to offer, from offer to conclusion)
- Pipeline value and realised revenue per campaign
Leadtree already works with clear deadline targets in social selling projects (e.g. an average of 13 qualified appointments per month) and transparent ROI reporting – this exact logic can also be applied to compliant email outbound.
- Aligning toolstacks and processes with compliance
- Opt for an integrated setup of CRM, marketing automation, and outbound automation where opt-in status, objections (opt-outs), and legal bases are managed centrally.
- Make sure that your lead scoring is not based on data for which you do not have consent (e.g. hidden open tracking without consent).
- Assign clear roles: Sales is responsible for the sales process, the Data Protection Officer / Legal defines guardrails, and a central body monitors KPI reporting and data quality.
Agencies like Leadn offer a tested tech stack with over 18 tools, including reporting and automation infrastructure. This allows for the setup of outbound automation, lead nurturing, and lead scoring in a way that enables clean data segregation and reporting structures – without you having to integrate everything yourself.
Do you want to understand how we connect social selling on LinkedIn with email outbound?
3. fragmented legal situation & operational effort: why done-for-you outbound is gaining in importance
3.1 More regulation, less clarity - especially in the DACH region
With the withdrawal of the ePrivacy Regulation, the legal situation in the EU remains largely determined at a national level. The consequence: Different priorities and enforcement practices in the Member States, for example in the assessment of tracking pixels or „legitimate interest“ in marketing. (getmailbird.com)
For B2B lead generation in the DACH region (Germany, Austria, Switzerland):
- Different data protection laws and competition rules
- Different expectations regarding address and tonality
- Different meanings and uses of channels such as LinkedIn, email and events
Leadtree has shown in a market analysis that the DACH region in particular, with a GDP of over EUR 5.4 trillion and a population of more than 100 million, offers enormous B2B potential; B2B e-commerce turnover in Germany alone was over EUR 104 billion in 2023 - an environment in which compliance is not a „nice-to-have“.
At the same time, markets in the DACH region follow „their own rules“ regarding data protection, compliance, and communication style – an aspect that specialised social selling agencies explicitly include in their playbooks.
3.2 What tech start-ups can hardly afford internally
If you run a B2B tech start-up with 5-50 employees, the following tasks compete for the same resources:
- Go-to-market plan, positioning, content strategy
- Development of a scalable B2B sales process incl. sales funnel optimisation
- Outbound automation via LinkedIn and email, including AI-supported personalisation
- Clean implementation of GDPR, Unfair Competition Act, TTDSG, including documentation, processes, training
Practically, this means:
- You would have your own Messaging playbooks develop, continuously test and adapt to case law & platform T&Cs.
- You need a Tech stack from >10 tools (Prospecting, Data Enrichment, Sequences, CRM, Tracking, Reporting), which you will be responsible for not only technically but also from a data protection perspective.
- You need Ongoing training your sales teams, so that cold emails, follow-ups and LinkedIn outreach don't inadvertently become compliance risks.
3.3 How a specialised social selling and outbound agency takes the pressure off
Specialised providers like Leadtree combine three layers that are crucial for legally compliant, high-performance outbound:
- Market and compliance understanding for DACH
Leadtree works with a focused approach on B2B tech start-ups and scale-ups in the DACH region and is familiar with the requirements of GDPR, compliance, and local communication styles from its day-to-day business.
This reduces the risk of colliding with German jurisdiction, even if you are running international campaigns, for example. - Data-driven sales with clear KPIs and delivery guarantees
- Measurable key figures such as cost per lead, conversion rate, pipeline value, and booked appointments can be transparently tracked via dashboards.
- The Delivery or performance guarantee ensures that budget and risk remain calculable - an important factor when you have to invest in data protection, tools and personnel at the same time.
- Comprehensive operational takeover – with clear separation of responsibilities
- In the social selling package, Leadtree takes over the complete LinkedIn sales process up to appointment booking, including communication and follow-ups – if required, in conjunction with email outbound.
- The agency provides data-driven lead tracking and KPI reports, while you, as the person responsible, continue to define legal bases and, with your legal counsel, properly set up consent texts, privacy policies, and records of processing activities.
This creates a division of labour that makes sense for growth-oriented founders:
You are responsible for strategy, offering and legal framework – the agency ensures scalable, measurable and operationally sound outbound via LinkedIn and (where legally permissible) email.
Conclusion & Next Steps: How to Make Your B2B Outbound GDPR-Compliant in 2026
The legal position for outbound email in B2B will have become clearer, but not simpler, by 2026:
Consent remains the standard, advertising to existing customers is narrowly defined, tracking pixels are increasingly coming under the scrutiny of supervisory authorities, and national deviations are on the rise.
Concrete next steps for your business:
- Carry out outbound audit
- List of all email campaigns and sequences (incl. sales outbox, marketing automation, tools).
- Assign a clear legal basis to each channel (consent, contract, existing customer).
- Check where you use email tracking and whether consent has been documented.
- Standardise consent and opt-out processes
- Implement double opt-in for all marketing emails.
- Ensure opt-out opportunities are clearly communicated in every email.
- Synchronise opt-outs across all systems (CRM, newsletter tool, sales sequencer).
- Rethinking the KPI set
- Shift your control from pure opening tracking to funnel KPIs: appointments, pipeline, revenue, lead quality.
- Set up campaign-level reporting that visualises both performance (ROI) and compliance (opt-in rates, opt-outs).
- Decide build vs. buy
- If your team lacks the time or experience to set up complex LinkedIn and email outbound processes in a GDPR-compliant manner, it's worth talking to a specialised social selling agency.
- When making your selection, pay attention to DACH expertise, transparent KPI reports, delivery and performance guarantees, and a clear stance on data protection and compliance.
- Schedule regular reviews
- Review your processes at least annually – or preferably semi-annually – against new rulings, authority guidelines, and tool updates.
- Involve data protection, sales and, if applicable, your agency together.
This is how GDPR compliance becomes not a brake on growth, but a structured foundation for scalable, predictable B2B sales via LinkedIn and email.
Do you want to understand how we connect social selling on LinkedIn with email outbound?
Frequently asked questions (FAQ) about GDPR & email outbound 2026 in B2B
1. Can I send B2B cold emails without consent?
In Germany, advertising by email is generally not permitted without prior express consent - regardless of whether you are writing to private individuals or companies. (ihk.de)
The only relevant exception is advertising to existing customers in accordance with Section 7 (3) UWG: You must have received the address in connection with a sale, advertise your own similar services, clearly point out the right to object at the time of collection and in every email and may not ignore any existing objection. (ohn.haendlerbund.de)
For genuine cold emails to unknown companies without a prior relationship, the legal situation is therefore very critical.
2. what does the ECJ judgement 2025 on existing customer advertising mean for my SaaS freemium model?
The ECJ has ruled that a „sale“ for the purposes of the existing customer rule can also exist if users register for free and gain access to content or services.ohn.haendlerbund.de)
For freemium SaaS models, this can mean that you are allowed to send existing customer advertising to registered free users too – but only if:
- you inform them transparently about the advertising use of their email address and their right to object during sign-up and
- you only advertise your own, similar services (e.g. paid plans, add-ons).
As not all German courts have yet applied this interpretation in detail, you should work particularly closely with your legal counsel here and, in case of doubt, rely on consents.
3. tracking pixels and open rates in emails?
Tracking pixels are increasingly considered to require consent, similar to cookies. Some national authorities require a Separate consent for email tracking, in addition to consent for marketing emails. (getmailbird.com)
Recommendation in practice:
- Avoid blanket, hidden tracking wherever possible.
- If you require tracking, obtain clear, separate consent and document it (time, wording, version).
- Manage your B2B sales preferably via funnel KPIs (appointments, pipeline, deals), not via microscopic open rates.
4. How does a social selling/outbound agency like Leadtree contribute to GDPR compliance?
An agency does not replace legal advice, but it can Operative cover a lot of what is internally difficult to manage:
- Structured, segmented development of target customer lists (target account selling) in line with your ICP.
- Psychologically optimised, personalised outreach sequences on LinkedIn that consider frequency, relevance, and tonality, thereby reducing the risk of „harassing“ engagement.
- Clearly defined lead tracking and KPI reporting via dashboards, allowing you to understand at any time where leads originate from and how they entered your sales funnel.
- Flexible, monthly cancellable cooperation without setup fee and with performance guarantee, so you can test pragmatically without taking long-term risks.
You retain control over legal bases, consent texts and data protection organisation – the agency ensures that your sales system is set up in a high-performing and structured manner in everyday operations.
If you want to know what a GDPR-compliant social selling and outbound process could look like for your specific B2B tech setup, structured sparring is worthwhile: Which leads do you really want to win, which legal bases are realistic, and what do corresponding, measurable campaigns on LinkedIn and via email look like?
Do you want to understand how we connect social selling on LinkedIn with email outbound?
Do you want to understand how we connect social selling on LinkedIn with email outbound?