B2B Email Marketing: Consent, GDPR and Deliver­ability

In B2B, you may generally send promotional emails only with prior explicit consent – business addresses are not privileged. The most important exception is advertising to existing customers under Section 7(3) of the German Unfair Competition Act (UWG). If you can prove consent through double opt-in, authenticate your domain with SPF, DKIM and DMARC and maintain your lists, you will reach the inbox and can use email as a plannable channel.

In mid-sized companies in particular, B2B decisions stretch over weeks or months and involve several people: the specialist department, purchasing, management. A well-planned email sequence keeps your company present during that time – with expertise and practical examples instead of sales pressure. The list belongs to you, unlike reach on social networks. But email is also the channel where mistakes have quick consequences: cease-and-desist letters for missing consent, poor delivery when list quality is bad.

Legal framework: what is allowed in B2B

Two sets of rules interlock. Competition law (Section 7(2) no. 3 UWG) classes advertising by electronic mail without prior explicit consent as an unreasonable nuisance – regardless of whether the recipient is a consumer or a company. The GDPR additionally governs the processing of address data: consent (Art. 6(1)(a)), proof (Art. 7(1)), withdrawal (Art. 7(3)) and the right to object to direct marketing (Art. 21(2)). Data protection law does allow direct marketing to rest on a legitimate interest, but for email advertising the UWG sets the narrower limits.

The following overview shows common situations in mid-sized companies. It reflects the usual interpretation; in individual cases, a legal review decides.

Situation	Assessment	What matters
Newsletter sign-up with double opt-in	generally permitted	Clear purpose, current consent wording, complete log
Existing customer, promotion of similar own products	only under the conditions of Section 7(3) UWG	Address obtained during a sale, notice of the right to object at collection and in every email, no objection
Business card from a trade fair booth	not consent to marketing	Newsletter only after documented consent, for example via double opt-in
Inquiry via the contact form	a reply to the inquiry is not marketing	Further promotional mailings need their own consent
Purchased or rented address lists	generally not permitted	Consent must exist toward your company – hard to prove with lists
Cold outreach by email	not permitted	Alternatives: content that triggers inquiries, referrals, trade fair contacts with consent

On the existing-customer exception: it requires that you obtained the address in connection with the sale of a product or service, advertise only your own similar products, the customer has not objected and was clearly told of the right to object at collection and with every use. All four conditions must be met; a mere contact or inquiry is generally not enough.

Double opt-in: obtaining and proving consent

The sender must prove that consent exists. Double opt-in is not required by law but is the established standard because it shows that the address belongs to the person signing up. The process:

1. The person enters their address in a form with a clearly described purpose.
2. They receive a confirmation email without promotional content.
3. Only after clicking the confirmation link is the address released for marketing.
4. Sign-up and confirmation are logged.

The consent text names the sender and the content, such as newsletter and product information, points to withdrawal at any time and to the privacy policy, and discloses performance measurement if you track opens and clicks. Pre-ticked boxes are invalid. In the log, record the time, the form, the wording of the consent in its respective version and the time of confirmation; whether you also store technical data such as the IP address is something to settle with your data protection advisor.

Separate purposes: newsletters, product information and invitations to events are different content. Separate choices create transparency and reduce unsubscribes. Also avoid tying a download to newsletter consent without need – that coupling is legally disputed (Art. 7(4) GDPR).

Unsub­scribing, suppression list and sender details

• One-click unsubscribe in every email: withdrawing consent must be as easy as giving it. Also set the technical unsubscribe header (List-Unsubscribe with one-click) that large mailbox providers expect.
• Keep a suppression list: unsubscribed addresses stay on a suppression list so they do not end up back in the distribution list through a later import from the CRM or trade fair and event lists. This is a common mistake.
• Identifiable sender: the sender and the promotional nature must not be disguised in the header or subject line (Section 6 DDG, the German Digital Services Act; Section 7(2) no. 4 UWG). Link your legal notice and provide a valid address for unsubscribing.
• Involve service providers: you need a data processing agreement with the email service provider; check the hosting location and possible transfers to third countries.

Deliver­ability: authentica­tion and list hygiene

The best campaign is useless in the spam folder. Since 2024, Google and Yahoo have required bulk senders to authenticate with SPF, DKIM and DMARC, offer easy unsubscribing and keep complaint rates low; other providers are following suit. Even at smaller volumes, these requirements are a sensible benchmark.

• SPF: defines which servers may send on behalf of your domain; each domain has just one SPF record that lists all sending services.
• DKIM: signs emails cryptographically and proves they were not altered in transit; set up the key for every sending service.
• DMARC: defines how recipients handle unauthenticated emails. Start with the “none” policy and reporting enabled, then tighten to “quarantine” or “reject” once all legitimate senders are properly authenticated.
• Separate subdomain for marketing: kept apart from day-to-day business so that a poor reputation does not hit invoice and quote emails; increase the sending volume gradually.
• Bounce management: remove permanently undeliverable addresses immediately; for temporary errors, a retry is worthwhile.

As a benchmark, Google names a complaint rate below 0.1 percent; from 0.3 percent, delivery problems loom. List hygiene therefore includes asking contacts who do not respond, after a fixed period – say six to twelve months, with a reactivation email – whether they are still interested. Anyone who does not respond is removed from the active list. A smaller, active list is worth more than a large, silent one. Also keep role addresses such as info@ in mind: they are common in B2B, but consent is hard to assign to one person there.

Segmentation and automation with the CRM

“All contacts from industry” is not a segment but a catch-all category. In the same company, purchasing cares about terms and delivery times, while engineering cares about interfaces and data sheets. Segment by role, topic interest and stage in the decision process; the data comes from form fields, requested checklists or the CRM. A preference center, where recipients choose their own topics, supplies it directly. An example of a sequence connected to the CRM:

1. A contact downloads a checklist on process automation and consents to expert content via double opt-in.
2. A few days later, a practical example on the same topic follows.
3. Then he or she receives an invitation to a short consultation.
4. If the contact clicks the invitation, a task for sales is created automatically in the CRM.

Technically, this requires clean interfaces between website forms, email system and CRM. We implement them as part of API and backend development and process automation. How this grows into end-to-end lead nurturing is shown in the article on marketing automation.

Metrics that really count

Open rates have only limited value now. Apple Mail Privacy Protection preloads tracking pixels, and security gateways in companies open messages and follow links automatically – which distorts opens and clicks. Metrics with a business link matter more:

• qualified replies and follow-up questions
• booked meetings and demo requests
• contribution to the sales pipeline, evaluated in the CRM
• unsubscribe, complaint and bounce rates as an early warning system

Data protection authorities often consider the evaluation of opens and clicks permissible only with consent. So mention it in the consent text and in the privacy policy, and have the implementation reviewed. You will find more on tracking and trust in the article on GDPR-compliant tracking.

Checklist: B2B email marketing

• Consent in place before every promotional mailing, or existing-customer exception fully met
• Double opt-in with a complete log, confirmation email without advertising
• Separate consents for different purposes, no pre-ticked boxes
• One-click unsubscribe, suppression list and unsubscribe header
• Sender, legal notice and privacy policy reachable in every email
• SPF, DKIM and DMARC configured correctly, separate marketing subdomain
• Data processing agreement signed with the email service provider
• Regular cleanup of inactive contacts and bounces
• Segments by role and interest, journeys connected to the CRM, success measured by replies and pipeline

How Nano Concepts helps

Successful email marketing needs convincing content and a stable technical foundation. That is why we carry out such projects together with our partner agency LOMA DESIGN at the same location: LOMA DESIGN is responsible for strategy, copy and template design, Nano Concepts for the technical implementation – from double opt-in sequences and configuration for good deliverability to CRM integration. The legal assessment of your individual case remains a matter for your legal counsel; we provide the technical basis and documentation for it. Book a free initial consultation – we usually get back to you within 24 hours.

This article does not replace legal advice.