Click a country name to jump to its chapter below. English column: EF English Proficiency Index 2025 score and proficiency band, or native/official-language status where the EF EPI doesn't score the country.

Research aid, not legal advice - take legal counsel and treat the yellow cells especially as "check with local legal counsel before you scale," not "safe."

Why the same message is fine in one country and a fine in the next

Once you see the pattern, it stops feeling random.

Email and SMS are the strictest columns almost everywhere, because both fall squarely inside the ePrivacy Directive's definition of "electronic mail." The EU default is opt-in. Some countries carve out a softer rule for B2B (an opt-out is enough), but plenty don't - and a few, like Italy and Lithuania, are explicit that even where email gets the softer treatment, SMS doesn't.

Phone is the one channel the Directive deliberately left to national discretion, which is exactly why it's the most fragmented column in the table - and, in practice, often the most workable one. Identify yourself, call the business number, and stop immediately if someone objects, and you're on solid ground in a surprising number of markets.

LinkedIn mostly isn't "electronic mail" in the strict telecoms sense the ePrivacy rules use, so the fallback is plain GDPR legitimate interest with a balancing test - which is why LinkedIn skews greener than email across most of the EU. Two countries break that pattern. Germany's courts have applied the same "unreasonable business disruption" logic from unfair-competition law to unsolicited platform messages, not just email. And Denmark's Forbrugerombudsmanden has ruled directly, more than once, that InMails - and even a plain "saw your profile, let's connect" pitch - count as electronic mail. Same opt-in rule as email, deliberately, so LinkedIn can't become the loophole.

If you're selling into Denmark, that one's worth sitting with. Phone is genuinely open there - and worth a correction from an earlier version of this piece: it's not because of the Robinson list. That list is a consumer register under the Consumer Contracts Act; it protects private individuals, not companies, and doesn't touch a call to a registered business. Danish phone is open simply because no register applies to companies at all by default. The one place Robinson does bite in a B2B context is a sole proprietor's personal mobile - worth checking before you dial one. Email and LinkedIn, meanwhile, are both locked behind consent. That's the opposite of what most reps assume.

WhatsApp is the newest and least tested channel legally, but don't read that as a green light. Regulators would very likely treat it like SMS if it ever got tested, and WhatsApp's own Business Messaging Policy already bans marketing messages to numbers that haven't opted in - so it's a practical dead end for cold outreach even before you get to the legal analysis.

The French exception, because it's the one everyone gets half right

France is the country where people most often misquote the rule. "France allows unsolicited B2B email" is true, but only under three conditions, all at once:

• You're emailing the person's professional address - a personal Gmail used for work doesn't count, that's back to needing consent.
• The pitch is relevant to their role - a generic offer with no connection to their job doesn't qualify.
• They're told at first contact, and given a real, one-click way to opt out in every message.

The CNIL isn't shy about enforcing the edges of this. Orange, Cdiscount, Free, and Brico Privé have all been fined in recent years - not for using the exception, but for using it sloppily: no documented legal basis, or an opt-out link that didn't actually work.

What this actually means for your outreach plan

If there's one takeaway, it's this: pick your opening channel per country, not per campaign. A sequence that leads with LinkedIn works well in most of the EU, but walks straight into trouble in Denmark. A sequence that leads with email works in France and the Nordics-minus-Denmark, but needs a genuine opt-in step in Germany, Austria, Spain, and most of Central and Eastern Europe.

The countries where phone is your cleanest first move more often than people expect: Denmark, Estonia, Hungary, Ireland, Croatia, France, Sweden, and the Netherlands all allow it on an opt-out basis.

None of this is a reason to avoid a market - it's a reason to sequence it correctly. Get the channel order right per country, and the compliance question mostly takes care of itself.

Two things this isn't: purely GDPR, and purely a legal question

Worth saying plainly: most of what's blocking you above isn't GDPR at all. GDPR governs whether you have a lawful basis to hold and use a contact's data - for B2B, that's almost always legitimate interest, and it's rarely the sticking point. What actually stops a channel is a separate, often much older, body of national law: Germany's rules sit in its unfair-competition act, not its data protection act. Denmark's sit in a marketing practices law. Spain's phone rules sit in telecoms law. If someone on your team says "we're GDPR compliant, so we're fine," that's answering a different question than the one that matters.

The other thing worth flagging: whether the message lands at all is a language question as much as a legal one. We added an English-proficiency read to the matrix using the EF English Proficiency Index - and the pattern is reassuring for most of the countries you'd actually be targeting. Every Nordic country, the Netherlands, Germany, Poland, and most of Central Europe score Very High. France, Italy, and Spain sit in the Moderate band nationally - but the job-function data inside the same report shows the gap: France's IT function scores 593 and Strategy & Project Management scores 625, against a 539 national average. Your actual buyer - the IT director, the legal counsel, the ops lead - tests well above the general population almost everywhere. Treat a low national score as "double-check this specific contact," not "don't bother in English."

All that said, English isn't 1:1 interchangable with any country's national language(s). You will almost always convert better approaching any prospect in their own language. You'll find more detailed coverage about the use of English in European countries in our article on the topic.

Last thing on AI, because it's moving fast and there's a real trap in it: if any part of your stack is AI-powered, the EU AI Act now sits on top of everything above it. Since 2 August 2026, anyone deploying a chatbot or voice assistant that interacts directly with a person has to disclose, clearly, at first contact, that they're talking to AI - a flat €15M-or-3%-of-turnover-level obligation.

Here's the trap: it's tempting to assume "AI drafts it, a human reviews and sends it" gets you out of this entirely - and there's a real human-review exemption in the Act that makes that assumption feel safe. It doesn't apply to sales outreach, though. That exemption (Art. 50(4)) is scoped to AI-generated text "published with the purpose of informing the public on matters of public interest" - AI-assisted journalism, essentially, not a cold email to one named prospect. The distinction that actually matters for outbound is different: an AI that drafts a message which a human then reviews and sends is probably outside the disclosure duty altogether, because the rule targets AI systems that interact directly with a person - a one-way, human-approved message isn't a live interaction. But the moment an AI SDR tool starts handling the replies on its own - running the back-and-forth after that first message without a human in the loop - that's exactly the live interaction the rule is written for, and no amount of care spent reviewing the opening line exempts the autonomous conversation that follows it. If you're running or evaluating AI outbound tools, know which side of that line your tool sits on.

Don't let this stop you

B2B prospecting is a little like a puzzle in need of solving. You lay the puzzle using the pieces available to you and within the constraints laid out. Prospect behaviour, technological capabilities, data quality, and indeed legal frameworks all play a role. Your task in Go to Market is to figure out a way through.

Good selling!