September 5, 2026. Belgium appears on most "B2B cold email is fine here" lists because its law contains a genuine exception for emailing companies. The exception is real. It is also narrower than the lists say, the regulator has declined to apply it in the one recent case that looked like ordinary B2B prospecting, and since February 1, 2026 the criminal fine attached to the underlying ban is multiplied by ten. This is what the Code of Economic Law, the 2003 Royal Decree and the Data Protection Authority actually say.
The rule: Article XII.13 of the Code of Economic Law
Article XII.13, section 1, of the Code de droit économique prohibits the use of electronic mail for advertising without the recipient's prior, free, specific and informed consent. Section 4 puts the burden of proving that the advertising was solicited on the sender. Section 2 requires every email to state the right to object for the future and to provide an effective electronic way to exercise it. Section 3 bans using a third party's address or identity and masking the origin of the message. Article XII.12 adds that the message must be recognisable as advertising on receipt and must identify the person on whose behalf it is sent. The Belgian DPA's January 2026 opinion quotes section 1 in the same words as the 2013 text, so the article is unchanged.
The two exceptions, and the sentence nobody quotes
The Royal Decree of 4 April 2003 creates the exceptions the Code allows the King to make.
- Existing customers. Article 1, 1°: natural or legal persons whose details were obtained directly in the context of a sale, used only for the sender's own similar products or services, with a free and simple objection offered at collection. All three conditions must hold.
- Legal persons, impersonal addresses only. Article 1, 2°: a company may be emailed without consent if the electronic contact details used are impersonal. The Report to the King that accompanies the decree explains what the decree itself leaves open: info@, contact@ and sales@ style addresses qualify; [email protected] addresses are the addresses of natural persons whatever they are used for, and need prior consent.
- The sender must prove the exemption applies and must assess it with caution; the offer must genuinely target legal persons.
- Group companies are third parties. A parent, sister or subsidiary company does not inherit the relationship.
- Objections must be honoured. Article 2: any recipient can object free of charge without giving reasons; the sender sends an acknowledgement, acts within a reasonable time and keeps an up-to-date suppression list.
What the DPA did with a textbook B2B sequence
On January 24, 2025 the Litigation Chamber of the Belgian Data Protection Authority issued Decision 15/2025. A company had sent two prospecting emails, on June 6 and June 13, 2024, to a [email protected] address. It argued legitimate interest, pointed to a working opt-out, said its lead tool had been judged compliant by the French CNIL, and cited advice from the Enterprise Europe Network that B2B prospects need no consent. The Chamber held that the address is personal data, treated Article 13 of the ePrivacy Directive as the governing rule, and categorically rejected the claim that B2B prospects can be emailed without consent. It also faulted the sender for holding no proof that its data tool was compliant. The outcome was a warning, not a fine, but the Royal Decree exception was never even discussed, because a named address is not impersonal.
The DPA's other positions close the remaining doors. Recommendation 01/2020 says a professional address on a business card is personal data and that where you have never had a relationship with the person, legitimate interest cannot be invoked. The 2025 draft recommendation goes further: even info@ or dpo@ can be personal data when one identifiable person runs the mailbox, so senders must be careful with functional addresses. Decision 25/2020 against the dating site Twoo, a 50,000 euro fine, held that emailing people to ask for their consent is itself unlawful marketing.
The fines, before and after February 2026
Sending advertising email in breach of Article XII.13 is a level 3 offence under Article XV.120. Since the Law of 8 May 2022, a level 3 criminal fine runs from 26 to 25,000 euro, or 6 percent of the previous year's turnover if higher; bad faith breaches are level 4, up to 50,000 euro or 6 percent; and where no turnover data is available the ceiling is 2,000,000 euro. Belgian criminal fines are then multiplied by "additional decimes". That multiplier was eight from 2017. The Law of 19 December 2025 raised it to ten for offences committed from February 1, 2026, so the printed range of 26 to 25,000 euro is now 260 to 250,000 euro in practice. Separately, the DPA fines under GDPR Article 83: Infobel, a data broker, was fined 40,000 euro in November 2025 for reselling data obtained from a telecom operator, with the Chamber rejecting "the data is public anyway" as mitigation; Black Tiger Belgium, formerly Bisnode, paid 174,640 euro in January 2024 and had its B2B data service suspended until individuals were proactively informed.
What it means for operators
The Belgian exception is an exception for mailboxes, not for markets. If your list is generic company addresses and your offer is aimed at the business, Article 1, 2° of the Royal Decree covers you, provided every message identifies you, is recognisable as advertising, carries an objection route and you keep the suppression list the decree requires. The moment the list is named people, which is what every enrichment tool produces, you are in Article XII.13 section 1 territory and the regulator has said, in writing, that legitimate interest does not rescue you.
Second, the burden of proof runs against you twice: section 4 of XII.13 for consent, and the Royal Decree's own text for the exemption. A lead vendor's compliance claim is not evidence; Decision 15/2025 punished exactly that reliance.
Third, price the risk correctly. Belgium's enforcement so far has been warnings and five-figure fines, but the multiplier change means the statutory range for a single level 3 case now tops out at a quarter of a million euro before turnover-based percentages, and the DPA can act under GDPR at the same time.
How to run Belgian outreach
- Split the list by address type. Impersonal addresses go into the Royal Decree channel; named addresses need consent or an existing-customer relationship with the sender itself.
- Label and identify. Recognisable as advertising, sender identified, objection route in every email.
- Keep the suppression list the decree demands, with acknowledgements of objections.
- Do not email to ask for consent. Twoo lost on precisely that.
- Hold your own evidence for consent and for the exemption, not the vendor's.
Belgium's neighbours run different rules: the Netherlands and France each treat B2B differently, and the EU layer is summarised in our GDPR cold email guide. Building a list that respects the impersonal-address line is a data job before it is a copy job, which is why our lead generation work starts with address classification, and why the sends themselves run through our cold email service with suppression shared across every domain.
Frequently Asked Questions
Only to impersonal addresses. The Royal Decree of 4 April 2003, Article 1, 2°, exempts emails to legal persons from the consent rule when the contact details used are impersonal, such as info@ or contact@. The Report to the King states that [email protected] addresses are addresses of natural persons and need prior consent. Every message must still be recognisable as advertising, identify the sender and carry an objection route.
The Belgian DPA says no for email. In Decision 15/2025 of January 24, 2025 the Litigation Chamber rejected legitimate interest for two prospecting emails to a [email protected] address and said B2B prospects cannot be emailed without consent. Recommendation 01/2020 states that where you have never had a relationship with the person, legitimate interest cannot be invoked.
A breach of Article XII.13 is a level 3 offence: a criminal fine of 26 to 25,000 euro or 6 percent of annual turnover if higher, 50,000 euro for bad faith, and up to 2,000,000 euro where no turnover data exists. Belgian criminal fines are multiplied by additional decimes, raised from eight to ten for offences from February 1, 2026, so 26 to 25,000 euro means 260 to 250,000 euro. The DPA can also fine under GDPR.
The sender. Article XII.13, section 4, of the Code of Economic Law places the burden of proving that advertising was solicited on the service provider, and the Royal Decree's Report to the King says it is for the advertiser to prove that an exemption applies. A vendor's compliance statement does not discharge that burden.
No. In Decision 25/2020 the Belgian DPA fined the dating platform Twoo 50,000 euro for invitation emails to non-users and stated that the GDPR does not allow emailing people in order to ask for their consent. Consent has to be collected through a channel you are already entitled to use.
No. The Report to the King on the 2003 Royal Decree treats parent, sister and subsidiary companies as third parties. The exception applies only where the sender itself obtained the details in the context of a sale, markets only its own similar products or services, and offered a free and simple objection at collection.