GDPR does not forbid email scraping. GDPR also does not forbid outreach. That does not mean that every email address on the internet is free for B2B marketers to use. GDPR requires you to understand why you collect personal data, how you use it, and what rights individuals have over their information. I hope this guide helps you see where the limits lie and how to stay on the right side.
Extracting email addresses from websites is not automatically illegal under GDPR. GDPR legality depends on what data you take, how you store it, what basis you use, and how you use it in outreach. For B2B email, legitimate interests (Article 6(1)(f)) require documentation, a review of relevance, and a clear opt‑out option in every message.
What GDPR Actually Says About Email Addresses
GDPR protects EU residents’ personal information and sets rules for how businesses collect, use, and handle their data. ‘Processing’ means collecting, storing, using, or sending data. An email address becomes data when it identifies or can identify a living individual. This rule matters for all B2B marketers.
This is where B2B email scraping runs into a nuance: corporate email addresses such as (info@company.com) are usually not personal data because they point to point to a company, not a person. Named professional addresses (firstname.lastname@company.com) are personal data because they point to an individual even in a business context. I find that this distinction matters a lot when you design your outreach.
B2B outbound campaigns target named contacts. I have seen many teams focus on these because they are easier to address. That means GDPR applies. The real issue isn’t whether GDPR applies, but how you handle personal data in practice. It certainly does. But whether your specific use of that data has a valid lawful basis and meets GDPR’s core principles.
The Six GDPR Principles Applied to Email Scraping
| GDPR Principle | What It Means for Email Scraping | Compliant? |
|---|---|---|
| Lawfulness, fairness, transparency Art. 5(1)(a) |
You need a valid lawful basis and must be open about who you are and why you are contacting the person. For scraped data this includes the Article 14 notice explained below. | ⚠ Depends on basis and notice |
| Purpose limitation Art. 5(1)(b) |
Emails collected for one purpose cannot be used for another purpose unless there is a lawful basis. | ⚠ Keep purpose documented |
| Data minimisation Art. 5(1)(c) |
Only gather the data that you actually need. Avoid bulk-scraping contacts that're not relevant "just in case”. It’s not necessary and can lead to issues. | ⚠ Targeted lists only |
| Accuracy Art. 5(1)(d) |
Keep your personal information accurate and up to date. Using scraped data is risky, from a compliance standpoint and can hurt email deliverability. | ⚠ Verify and refresh regularly |
| Storage limitation Art. 5(1)(e) |
Do not store data longer than needed. Remove people who have opted out and review those who never responded to ensure your list stays clean and compliant. | ⚠ Set retention policies |
| Integrity and confidentiality Art. 5(1)(f) |
Personal data must be stored securely. CSV files left in open shared folders are a serious compliance risk. | ⚠ Secure your exports |
The Lawful Basis Question: What B2B Marketers Actually Use
GDPR requires a lawful basis for every act of personal data processing. There are six options under Article 6. For B2B email marketing using scraped contact data, only two are practically relevant:
You have a legitimate business reason to contact this person, and your need to use their data does not override their privacy rights. This is the common basis for B2B outreach when the person's job role is directly connected to your offer. To use this legal basis, you must document your assessment of whether your business interests outweigh the person’s privacy rights.
Most used for B2B cold emailGDPR states that consent must be freely given, specific, informed, and unambiguous. This rule generally doesn’t apply to contact information collected from websites. That is because these individuals never agreed to receive communication from you. They did not opt in. Because the data was collected without the person’s permission, consent generally isn’t a valid legal basis under the GDPR. An address being publicly available online does not mean the person permitted to use it.
Not applicable to scraped contactsLegitimate Interests and B2B Cold Email: How It Works in Practice
Interests and B2B cold email is the most realistic legal foundation for sending cold email to B2B contacts whose data you have extracted. Legitimate interests is not a pass or blanket permission. To comply, you must pass a three-part test. You must document that assessment before you send a single email.
The Three-Part Legitimate Interests Assessment (LIA)
Purpose test — is your interest legitimate?
You need a genuine, real-world reason to contact this person. "We want to sell to them" alone is not sufficient. Your purpose must be clear and lawful, and it must respect the individual’s rights. "Promoting our B2B SaaS tool to operations managers at mid-market logistics companies" is a defined purpose. "Emailing everyone we scrape" is not.
Necessity test — is processing necessary for that purpose?
Could you get the same result in a way that better protects the person’s privacy? If you could really get in touch with the people through a database where they have given permission or through a method that they start themselves, that makes the need for the current approach weaker. For areas or very specific jobs where there is no database coverage, the need, for the current approach is more valid.
Balancing test — do your interests override theirs?
Would the contact reasonably expect to receive this kind of message? For a named procurement manager receiving a relevant product pitch from a vendor in their space, probably yes. For a personal email address receiving unsolicited marketing, almost certainly no. Role relevance and reasonable expectations are the key factors.
GDPR Recital 47: How Legitimate Interests Apply to B2B Marketing
Recital 47 is the helpful part of GDPR for B2B marketers who uses legitimate interests. It says:
"The processing of data for direct marketing purposes may be regarded as carried out for a legitimate interest."
This suggests that direct marketing may be considered a legitimate interest. Recitals help explain the rules but do not create laws on their own. The same recital also makes it clear that this right has its limits. "At any rate the existence of an interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection about the personal data being used for this purpose." A person who is named in a role and whose details are on the company website for business purposes has a different reasonable expectation than a private person whose personal email was in a data leak. Recital 47 supports a planned role-based campaign. It does not support sending messages to everyone you can find.Publicly Available Email Addresses: The Rules Around What You Can Scrape
Just because an email address is publicly available online doesn’t mean it is no longer protected by the GDPR. Public availability is only one factor to consider; it does not, by itself, provide a lawful basis for processing the data.
The deciding question is reasonable expectation. An address published on a contact page to receive business enquiries was published for that purpose. Using it to send a relevant B2B proposal is more defensible than taking an address from a staff biography page and using it for mass marketing.
Article 14: You Must Tell People Where You Got Their Data
When you collect personal data from a website instead of directly from the person, Article 14 GDPR comes into play. This is a requirement that many scraping operations overlook. You must tell the person:
The deadline is a reasonable period and no later than one month after you obtain the data. If you use the data to contact the person, you must provide the information no later than your first message. The exemptions, such as impossible or disproportionate effort, are narrow and hard to rely on for a campaign you chose to run.
Practical Implication A single sentence at the bottom of a cold email is not enough on its own. Use a short line in the first email ("We found your address on your company's public website") that links to a full privacy notice carrying the Article 14 information. Practical ImplicationWhat the ICO (UK) Says About B2B Email Marketing
The UK's Information Commissioner's Office publishes specific guidance on B2B email marketing. Its position is:
- PECR (the Privacy and Electronic Communications Regulations) applies to electronic marketing in the UK alongside UK GDPR
- corporate subscribers (companies, LLPs, and Scottish partnerships) can be emailed for B2B marketing without consent, but you must not conceal your identity and must give a valid address for opting out
- Individual subscribers (sole traders and some partnerships, including most English, Welsh, and Northern Irish partnerships) are treated like consumers and need consent or the soft opt-in
- If you are unsure which a contact is, the ICO advises treating them as an individual subscriber
- UK GDPR still applies to named work email addresses at corporate subscribers, so you need a lawful basis, privacy information, and you must respect the absolute right to object to direct marketing
If you email a contact at a limited company (Ltd, GmbH, S.A., Inc.), the UK and many EU states treat this as B2B communication with a lighter threshold. You still need a lawful basis for named individuals and a clear opt-out. If you email a sole trader or freelancer, treat them like a consumer. Do not assume that a business address means a corporate entity
EU Email Rules Go Beyond GDPR
In the EU, whether you may send a marketing email is also governed by national laws that implement the ePrivacy Directive. These differ by country. Germany, for example, prohibits email advertising without prior express consent under Section 7(2) No. 2 of the Unfair Competition Act (UWG), including to businesses, with a narrow existing-customer exception in Section 7(3). Other member states are more permissive for business addresses. Check the rule for every country on your list, because a lawful basis under GDPR does not override a stricter national email rule.
GDPR vs. CAN-SPAM vs. CASL: The Three Frameworks B2B Teams Must Know
- Requires a lawful basis before processing
- Legitimate interests most used for B2B
- Article 14 notice required for scraped data
- Right to object to direct marketing is absolute
- Right to erasure on request
- Fines up to €20M or 4% of worldwide turnover, whichever is higher
- National email rules (such as Germany's) may require consent
- Opt-out model — no prior consent needed for most commercial email
- Must identify the message as an advertisement
- Must include a valid physical postal address
- Honour opt-outs within 10 business days
- No deceptive subject lines or headers
- Using addresses harvested by automated means from sites that prohibit transferring them for marketing, or generated by guessing, is an aggravated violation
- Civil penalties exceed $50,000 per email (adjusted annually by the FTC)
- Opt-in model — express consent required in most cases
- Implied consent in limited cases, such as an existing business relationship, and it expires
- Conspicuously published addresses can support implied consent if the message is relevant to the person's role and no "no unsolicited messages" notice appears
- Lists or copies compiled by third parties do not create that consent on their own (CRTC 2016-428)
- Must include sender identification and an unsubscribe
- Fines up to $10M CAD per violation for organisations
How Cute Web Email Extractor Fits Into a Compliant Workflow
Cute Web Email Extractor is Windows software that finds publicly available email addresses on websites, in search-engine results, in online documents such as PDFs, and in local files (PDF, Word, Excel, HTML, and TXT). It does not generate or guess email addresses, and it honours robots.txt Disallow directives when crawling websites.
No tool makes a campaign compliant. The software finds and cleans addresses. Deciding whether you may email them, and telling people where their data came from, stays with you.
- Targeted discovery: Keyword search, page-content keyword rules, and URL rules focus extraction on pages in your target niche instead of harvesting indiscriminately
- Volume control: Per-domain extraction limits and crawl-depth settings help you collect only what a campaign needs
- Geographic separation: TLD and country-code targeting (.de, .co.uk, .com) lets you separate sources by country. A TLD is not proof of where a person lives, so confirm location before applying a country's rules
- Clean-up: Removes duplicates, invalid formats, and false positives, and validates domains before export
- Export: XLSX, CSV, and TXT files for your CRM or email platform, where unsubscribe and suppression are managed
The Eight Things Every B2B Email Campaign Needs to Be GDPR-Compliant
Practical Compliance Workflow: Extract, Validate, Segment, Outreach
Define your ICP and document your lawful basis before extracting
Write down who you are targeting, why you are contacting them, how their role relates to your offer, and which lawful basis you rely on. This document is your LIA. If using legitimate interests, run the three-part test: purpose, necessity, balance. If any part fails, reconsider the campaign or the targeting before proceeding.
Extract from targeted sources with limits set
In Cute Web Email Extractor, use keyword search and page-content rules to reach sites relevant to your ICP, and set per-domain limits so you collect only what you need. Use TLD or country-code targeting to separate sources by country. Avoid one undifferentiated list that forces a single compliance standard on contacts from many jurisdictions.
Clean, verify, and check against your suppression list
Use the software's duplicate removal and domain validation, then run the export through a mailbox verification service such as ZeroBounce or NeverBounce, because domain validation does not confirm that a mailbox exists. Deduplicate against your CRM. Check every address against your suppression list. Contacts who previously opted out must not appear in any campaign.
Apply jurisdiction-appropriate rules and send the Article 14 notice
EU contacts: legitimate interests, the Article 14 notice at first contact, a functional opt-out, and a check of the national email rule (some countries require consent). UK contacts: the same, plus PECR (lighter for corporate subscribers, consent for sole traders). US contacts: CAN-SPAM, with a physical address, a working unsubscribe, and no deceptive headers. Canadian contacts: confirm that express or implied consent applies before sending.
Process opt-outs immediately and maintain your suppression list
When someone opts out, remove them from active campaigns and add them to your suppression list. Under GDPR you cannot keep using their data for direct marketing once they object. CAN-SPAM allows 10 business days, but best practice is immediate. A current suppression list is one of the most important compliance assets an outbound team can keep.
What Regulators Have Actually Penalised
Enforcement in this area tends to land on failures of process, not on the act of sending a targeted B2B email. The clearest example for scrapers is a Polish case about public data.
Failures that expose a B2B email programme to enforcement risk include:
- No documented lawful basis. If you cannot show a valid basis and a completed LIA, you cannot defend the processing, however the data was collected.
- Ignoring opt-outs. Continuing to email people who objected, or reactivating suppressed contacts, removes your legitimate interests argument and is simple for a regulator to prove.
- Unverified third-party lists. If you buy a list whose provenance the vendor cannot demonstrate, you inherit that risk.
- No transparency. Sending with no sender identification, no opt-out, and no privacy information, as in the Bisnode case.
- Excessive collection and retention. Databases far larger than any plausible campaign need, held for years with no deletion policy, conflict with the minimisation and storage limitation principles.
Build Targeted B2B Contact Lists with Cute Web Email Extractor
Publicly available emails only · Honours robots.txt Disallow rules · Keyword, page-content and TLD/country filters · Duplicate removal and domain validation · XLSX, CSV, TXT export · Windows 10/11 · Free trial available
