Is cold email legal in Italy? What GDPR and the Codice Privacy say about B2B outreach

Foreign companies planning to enter the Italian marketusually ask this question in the second meeting, after the compliance team at headquarters has seen the word "cold". The honest answer has two layers: a European one, which most people know, and an Italian one, which most guides skip. This page walks through both and ends with the practices that lower risk. It is written by a company that runs outreach in Italy every day, so read it as an operator's summary and have Italian counsel review your own setup before you send anything.

What does GDPR say about B2B cold email?

GDPR applies to any email address that identifies a person, which includes name.surname@company.it. The regulation does not ban direct marketing without consent: Recital 47 states that processing for direct marketing purposes may be regarded as carried out for a legitimate interest. That basis, art. 6(1)(f), comes with three conditions. You must run and document a balancing test between your interest and the recipient's reasonable expectations, you must be transparent about who you are and where the data came from, and you must offer an objection that is easy to exercise and honoured without discussion. For data not collected from the person, art. 14 requires a notice, typically published online and linked from the message. This is the European floor. Italy adds a layer on top.

What is art. 130 of the Italian Codice Privacy and why does it matter?

Italy implemented the ePrivacy Directive through art. 130 of Legislative Decree 196/2003, the Codice Privacy. The article requires prior consent for the use of automated systems, including email, to send advertising or direct sales material. Paragraph 4 allows what Italian practitioners call soft spam: emails to existing customers about products or services similar to those already bought, with an opt out in every message. Several Italian commentators read art. 130 as having no general B2B exemption, and argue that a GDPR legitimate interest assessment does not by itself replace this channel specific consent rule for promotional email.

Source: Overloop, B2B cold email in Italia, GDPR e Garante

Other readings are less strict. The Garante, the Italian data protection authority, has accepted legitimate interest as a basis for soft marketing to business contacts where a relationship already exists, while rejecting it for consumer telemarketing without consent. Addresses that refer only to a legal person, such as info@ or a generic department mailbox, fall outside the Garante complaint procedure under art. 140 bis, although civil remedies remain available. And messages that are transactional or pre contractual, such as a reply to a quote request or a service notice, are not marketing under art. 130 and need no consent.

Sources: Legiscope on legitimate interest and the Garante · Agenda Digitale on legal person addresses and art. 140 bis · Cybersecurity360 on legal bases for marketing email

Where is the grey area, in practice?

The debate is really about two different things that share the word "email". On one side sits mass promotional email: the same creative sent to thousands of addresses harvested or bought, with a newsletter look and a tracking pixel. Italian law treats that as advertising by automated means, and consent is the rule. On the other side sits individual business correspondence: one person writing to one decision maker, in their professional role, about one concrete reason that concerns their company, with a clear identity, a published notice and an objection honoured at once. That is the space in which legitimate interest is argued, and it is the space where the Garante's enforcement record has been about abuse rather than about contact itself. The sanctions that make the news concern scraping and volume: the Garante has fined companies that harvested PEC addresses, the certified legal mailboxes listed in public registers, to push promotional campaigns.

Source: money.it on PEC addresses and Garante sanctions

Nobody can promise you that a given campaign is lawful in Italy; anyone who does is selling you something. What an operator can do is stay on the defensible side of that line, document why, and make objection effortless. The next section shows what that looks like.

Which practices lower the risk of B2B outreach in Italy?

The table below separates what we consider defensible from what we would not do. It reflects how Clientium's own operation is designed, and it is the checklist we would hand to any foreign company's compliance officer before a launch in Italy.

Two of these items also decide whether a campaign works at all. Italian decision makers reply to a message that names their company's situation and arrives from a real person; they ignore the newsletter format. The practices that lower legal risk are the same ones that lift reply rates, which is why our open dataset shows vertical campaigns tied to a concrete reason at 5-6% replies against 1.1% for generic multi sector sends. The numbers are on theItalian cold email statistics page, and theItaly vs DACH comparison shows how the same method performs under German rules.

How does Italy compare with Germany, France, the UK and the US?

Foreign companies tend to copy the playbook that worked at home. That is the first mistake, because the five markets below treat B2B email differently. Italy sits in the middle: stricter on paper than France or the UK, less strict than Germany.

Sources: Leto, prospection BtoB et RGPD · ICO, business to business marketing · Legalmondo on Italian commercial law · German §7 UWG note on our internationalization page (in Italian)

The lesson for a company entering Italy from the UK or the US is that the opt out habit is not enough here. The lesson for a company coming from Germany is the opposite: Italy is more open than home, provided the contact is individual and documented. Either way, the tactic that travels is the same: write less, write better, write to the right person.

How does Clientium handle this for foreign clients?

Our outreach in Italy was designed around the rules above rather than around them. Company data comes from the Registro Imprese and public sources, and thebusiness register guideexplains what those records contain. We write to the role that the offer concerns, which is why knowing who decides in an Italian companymatters as much for compliance as for results. Each message is written one to one in Italian by a native business developer, in plain text, without tracking pixels, from a real sender with a real address. Our art. 14 notice is published atclientium.it/gdpr/ (in Italian) and reachable from every email; the stated basis is legitimate interest for the first contact, which becomes pre contractual measures under art. 6(1)(b) once the recipient replies and a dialogue starts. Objections are honoured immediately and go into a suppression list shared across campaigns. We never use PEC addresses. None of this is a guarantee of lawfulness, which no provider can give; it is a documented position that a compliance officer can read, challenge and approve. In 127+ client engagements, with 6,000+ appointments booked, that documentation has been part of the setup, not an afterthought.

What should a foreign company do before the first email to Italy?

Five steps, in order. First, have Italian counsel review your legitimate interest assessment and your art. 14 notice, and ask whether you need an EU representative under art. 27 if you have no establishment in the Union. Second, decide the list source and write it into the notice: official registers, not purchased files. Third, define the roles you will contact per offer, so that relevance is a rule and not a hope. Fourth, set the opt out process: who receives objections, how fast they are applied, where the suppression list lives. Fifth, choose the format: individual, plain text, one reason per message. Done this way, the compliance review becomes a one page document, and the campaign that passes it is also the one Italian owners actually answer.