B2B cold email in Spain: what the LSSI and the GDPR say

Disclaimer: this article explains what Spanish and EU law say about sending commercial emails to businesses. It is not legal advice. If you prospect by email, talk to a lawyer about how the rules apply to your specific situation.

This article is about the rules in Spain. If you sell to other businesses, sooner or later you’ll ask yourself: can I email a company that doesn’t know me to offer them what I sell? In Spain, the short answer is an uncomfortable one, and it’s worth knowing before you launch your first campaign: as a general rule, the law prohibits sending commercial emails that haven’t been requested or authorized, and that includes emails to businesses.

In this article we go through exactly what the two laws that apply say (the LSSI and the GDPR), why writing to info@ is not the same as writing to maria@, what fines the law sets out and which practices reduce your risk if you decide to prospect by email.

Two different laws that apply at the same time

The first misunderstanding is thinking there’s only one law. In reality, when you send a commercial email to a company, two laws with different purposes apply:

Complying with one doesn’t exempt you from the other. You can have a perfectly valid legal basis for storing someone’s email address (GDPR) and still breach the LSSI if you send them advertising they didn’t ask for.

What Article 21 of the LSSI says

Article 21.1 of the LSSI is the heart of the matter. It states, word for word, that sending advertising or promotional communications by email or any equivalent means of electronic communication is prohibited if they have not previously been requested or expressly authorized by their recipients.

Three important details:

• It makes no distinction between individuals and businesses. The article refers to “recipients,” without excluding legal entities. A commercial email to a company is subject to the same rule as one to a private individual.
• Authorization must be prior and express. It isn’t enough for the address to be public or listed on the company’s website: publishing a contact email is not the same as agreeing to receive advertising.
• “Commercial communication” is a broad concept. The law defines it as any form of communication aimed at promoting, directly or indirectly, the image or the goods or services of a company. An email presenting your services with the aim of selling falls squarely within it.

The exception: a prior contractual relationship

Article 21.2 sets out the main exception: the prohibition doesn’t apply when there is a prior contractual relationship, provided you obtained the recipient’s details lawfully and you send them communications about your own company’s products or services that are similar to the ones they bought. Even then, you must give them the chance to opt out in every communication.

In other words, the exception covers your customers, not prospects who aren’t customers yet.

What every commercial email must include

On top of the prohibition, the LSSI imposes two obligations on any commercial communication you send:

• Identification (Article 20). The email must be clearly identifiable as commercial, and it must be clear who is sending it.
• Simple, free unsubscribe (Article 22). Recipients can withdraw their consent at any time through a simple, free procedure, and you must give them an address or other means to do so.

Info@ vs. maria@: what changes

This is the second common source of confusion. Many people believe that writing to a generic company address (info@, hello@, contact@) is allowed while writing to a named person isn’t. The reality is more nuanced:

For the LSSI, nothing changes. Article 21 protects the recipient of the communication, whether that’s a person or a company. An unsolicited advertising email to info@clinica.es is subject to the same prohibition as one to maria@clinica.es.

For the GDPR, it does change. A generic company address usually isn’t personal data, because it doesn’t identify a natural person. A named address (maria.roig@clinica.es) is, and that brings in the data protection obligations we cover below.

In short: writing to info@ saves you some data protection obligations, but it doesn’t exempt you from the LSSI.

What the GDPR requires when the recipient is a person

When the address you use identifies a person, the GDPR asks for at least three things.

1. A legal basis for processing their data

The one usually relied on in B2B prospecting is legitimate interest (Article 6(1)(f) GDPR). Recital 47 recognizes that processing for direct marketing purposes may be regarded as carried out for a legitimate interest. In Spain, Article 19 of the LOPDGDD presumes that processing the professional contact details of people who work at a company is lawful, as long as they are used only to reach them in their professional capacity and for the purpose of maintaining relations with the company they work for.

But it bears repeating: legitimate interest justifies processing the data; it does not authorize sending electronic commercial communications that the LSSI prohibits.

2. Informing the person

If you didn’t get the data directly from them (for example, you found it on their company’s website), Article 14 of the GDPR requires you to tell them who you are, what you’re using their data for, where you got it and what rights they have. When you intend to use the data to communicate with them, that information must be provided at the latest in your first communication.

3. Respecting their objection

Article 21 of the GDPR grants the right to object at any time to processing for direct marketing purposes. If the person objects, you must stop using their data for that purpose, with no excuses and no long delays.

What fines the law sets out

The LSSI classifies infringements in Article 38 and sets the penalties in Article 39:

• Serious infringement: sending bulk commercial communications by email to recipients who haven’t requested or authorized them, or sending more than three unsolicited commercial communications to the same recipient within one year. Fine of €30,001 to €150,000.
• Minor infringement: sending commercial communications that don’t meet the requirements of Article 21 when it doesn’t amount to a serious infringement. Fine of up to €30,000.

The authority that penalizes breaches of these commercial email rules is the Spanish Data Protection Agency (AEPD). If the GDPR is breached as well, data protection penalties can be added on top.

How to reduce your risk if you prospect by email

Under this legal framework, the only zero-risk approach is to write only to people who have given you permission or are already customers. If you still decide to contact companies that don’t know you, these practices reduce your risk and, above all, the harm you might cause the person receiving the email:

1. Talk to a lawyer before you start. Your specific situation (who you write to, where from, with what content) can change the assessment.
2. Send few emails, to very few people. The law comes down especially hard on bulk sending and persistence. One relevant email to a specific company is not the same as a campaign to thousands of addresses.
3. Don’t keep chasing. The law itself treats more than three unsolicited communications a year to the same recipient as a serious infringement. If they don’t reply, stop.
4. Always identify yourself. Your name, your company and how to contact you, clearly visible.
5. Offer a real unsubscribe option in every email and honor it immediately. Keep a suppression list so you never write again to anyone who has said no.
6. If the recipient is a person, inform them in your first email where you got their data and what their rights are (Article 14 GDPR).
7. Keep records of where each contact came from and of the unsubscribes and objections you receive.
8. Prioritize consent. Forms, events, downloadable content or referrals: any channel where the company asks you for information is far safer than unsolicited email.

And in the rest of Europe

The LSSI is Spain’s transposition of Directive 2002/58/EC on privacy and electronic communications, which leaves each member state some leeway in regulating commercial email to businesses. That’s why the rules vary from country to country: some allow unsolicited B2B email under certain conditions, while others restrict it as much as Spain does. If you write to companies in other countries, check each country’s rules.

Summary

• In Spain, Article 21 of the LSSI prohibits advertising emails that haven’t been requested or authorized, including those sent to businesses.
• The main exception is a prior contractual relationship involving similar products or services.
• Writing to info@ instead of a named person doesn’t exempt you from the LSSI, although it spares you some GDPR obligations.
• Legitimate interest under the GDPR allows you to process professional contact details, but it does not authorize sending what the LSSI prohibits.
• Fines go up to €30,000 (minor) and from €30,001 to €150,000 (serious, such as bulk sending).
• If you prospect, do it with legal advice, low volume, clear identification, a real unsubscribe option and no chasing.