B2B cold email and the law in Poland: when you can email an offer to a company (as of November 2026)

What changed in November 2024

Until November 2024, the ban on sending unsolicited commercial information by email sat mainly in Article 10 of the Polish Act on Providing Services by Electronic Means (some related rules were also in the Telecommunications Law), and it protected recipients who were “natural persons”. That left a gray area around emails to companies and generic business addresses, which many people read as permission for B2B cold emailing.

That provision has been repealed. Since November 10, 2024, the matter has been governed by Article 398 of the Electronic Communications Law (Prawo komunikacji elektronicznej, PKE). In its answer to a parliamentary question dated September 30, 2025, Poland's Ministry of Digital Affairs states plainly that protection now covers all natural persons, including sole traders, and legal persons such as limited companies, foundations and universities. Since then, a recipient gets the same level of protection whether it is a consumer or a business.

The definition of commercial information matters too. It means any information intended, directly or indirectly, to promote goods, services or the image of a business. So it covers not only an offer with a price list, but also an email that introduces your company and invites the recipient to work with you.

What Article 398 actually says

The rule bans the use of automated calling systems and telecommunications terminal equipment, in particular as part of interpersonal communication services, to send commercial information, including direct marketing, to a subscriber or end user, unless they have consented in advance. Terminal equipment means computers and phones, so the rule covers email, text messages, phone calls and messaging apps.

Consent must be given before you send anything. Article 400 PKE refers to data protection law, so consent has to meet the GDPR standard: freely given, specific, informed and unambiguous. The law also accepts consent given by sharing an email address for the purpose of receiving commercial information. The Ministry stresses that consent is channel-specific: agreeing to phone contact is not agreeing to email.

Based on the wording of the law and the Ministry's position, you should not treat the following as consent:

• the mere fact that an email address is published on the company's website, in a business register or in a directory; a general contact address is not the same as an address shared in order to receive offers,
• consent to a different channel, for example phone contact, when you are sending an email,
• the absence of an objection; Poland chose an opt-in model, not a do-not-contact list,
• consent collected by someone else, such as the seller of a database, if it does not cover your company and your channel.

The burden of proof is on the sender. Your company has to show it had consent; the recipient does not have to prove they never gave it.

Can you send a first email asking for consent?

This is the most common question, and the answer is inconvenient. In the same answer to the parliamentary question, the Ministry of Digital Affairs says it is not allowed to phone someone in order to get consent to present an offer, and that this has been confirmed by decisions of the President of UKE (the electronic communications regulator) and the President of UOKiK (the competition and consumer protection authority). When UOKiK fined a company for telemarketing in September 2026, it summed it up briefly: consent first, then the call, never the other way around.

The law has no separate exception for email. A message along the lines of “Hello, I run company X, we do Y, may I send you our offer?” usually already promotes the sender's services or image, so it fits the definition of commercial information. It is safer to assume that asking an unrelated company for consent requires consent as well.

You can, however, reply with an offer when a company has asked for one: through the form on your website, in a request for quotation, in a listing that asks for offers to a given address, or in a conversation at a trade fair. In that last case, it is worth confirming the request in writing, because in a dispute it is you who has to prove it.

GDPR: named and generic addresses

The Electronic Communications Law applies independently of the GDPR. Even if an address is not personal data, the Article 398 consent is still required. The GDPR adds a second layer when the address identifies a person.

An address such as jan.kowalski@company.pl is personal data. A company's generic address, for example office@company.pl, usually is not, but for a sole trader even a generic address often points to a specific person. When personal data is involved, you need a legal basis. Recital 47 of the GDPR says direct marketing may be a legitimate interest of the controller, but that interest does not replace the consent the PKE requires for the sending itself.

If an address comes from a database, a directory or a website rather than from the person directly, Article 14 GDPR requires you to tell them, among other things, who you are, why you process their data and where you got it, at the latest at the first communication. Under Article 21 GDPR, anyone can object to direct marketing, and you must then stop. If you buy a database, find out where the addresses come from, because you are responsible for how you use them.

Fines and regulators

Sending without consent can create liability in several places at once. As of November 2026:

• the President of UKE (Office of Electronic Communications) can impose a fine of up to 3% of the previous year's revenue or up to PLN 1,000,000, whichever is higher (Article 446(5) PKE); the lower caps for low-revenue businesses that the PKE provides for other breaches do not apply here,
• sending commercial information without consent is also a petty offense punishable by a fine, prosecuted at the request of the injured party (Article 448 PKE),
• a breach of Article 398 is an act of unfair competition, which opens the way to claims under the Polish Act on Combating Unfair Competition,
• the President of UODO (Personal Data Protection Office) handles cases where the address is personal data; GDPR fines go up to EUR 20 million or 4% of worldwide turnover,
• the President of UOKiK steps in when marketing harms the collective interests of consumers; in September 2026 it fined a company PLN 308,728 for telemarketing without consent, and the person who was CEO at the time an additional PLN 100,000; the decision is not final,
• according to the Ministry, complaints can be filed with UKE, UODO or UOKiK through an online form on each office's website.

What Brevo, Mailchimp and Gmail do about it

Even if nobody files a complaint, a campaign to a bought or scraped list often gets stopped by the tool itself. Brevo's anti-spam policy prohibits lists that have been bought, acquired from third parties or scraped from the internet, requires active consent (the checkbox cannot be pre-ticked) and proof of opt-in for every contact. A breach can lead to immediate suspension or restriction of the account.

Mailchimp's Acceptable Use Policy prohibits sending to purchased, rented or third-party lists and to lists built from publicly available data. It counts even a single one-to-one commercial email as spam, and it requires you to point to an opt-in form or other evidence of consent. Accounts can be suspended or terminated.

Then there are the recipients' inboxes. Since February 1, 2024, Gmail has required all senders to, among other things, authenticate their domain (SPF or DKIM) and keep the reported spam rate below 0.3%. A handful of complaints from annoyed recipients can damage your domain's reputation to the point where emails to your regular clients start landing in spam.

Safe ways to win B2B clients

The goal is simple: get the potential client to leave their address or write to you first. Proven methods that do not involve sending without consent:

• a sign-up form on your website with an unticked consent box and email confirmation (double opt-in), which gives you the proof of consent that Brevo and Mailchimp require,
• a lead magnet, such as a guide, checklist or calculator in exchange for an email address; consent to a newsletter is best collected with a separate, optional checkbox,
• visibility where clients search on their own: a Google Business Profile, industry directories, SEO and helpful articles,
• Meta, Google or LinkedIn ads targeted at businesses; they are not messages sent to a specific person, but ad pixels on your website require cookie consent,
• phone calls only to people who agreed to phone contact; according to the Ministry, a cold call asking for consent is not allowed either,
• LinkedIn: publishing content and joining conversations in comments; be careful with offer messages to strangers, because the rule also covers interpersonal communication services,
• responding to requests for quotation, tenders and listings in which a company itself asks for offers,
• a traditional letter: Article 398 covers electronic means, but the GDPR still applies when the letter is addressed to a named person,
• trade fairs, industry events and referrals from happy clients.

When I set up email campaigns for clients, I start with the sign-up form, a record of consent and an automated welcome email, and only then do we write the next messages. A list built this way grows more slowly than a bought database, but it does not put you at risk of fines or a blocked account. If you would like a funnel like this on your website, write to me through the contact form.

Frequently asked questions