Cold Email Laws in the Czech Republic: Opt-In for Companies Too

October 15, 2026. In the Czech Republic, a business may send commercial email only to people who agreed to it in advance or to its own customers about similar products, and the rule makes no distinction between individuals and companies. The Office for Personal Data Protection (ÚOOÚ), which enforces it, says contact details found on the internet cannot be used, that a purchased database of business contacts is practically unusable, and that an email asking for consent is itself a commercial message. A business that sends unsolicited commercial email in bulk or repeatedly faces fines of up to CZK 10 million. We build cold email infrastructure for B2B teams, so this guide explains what Czech law allows and how a compliant campaign has to work.

The rules come from the current text of Act No. 480/2004 Coll. on certain information society services in the official e-Sbírka collection and from ÚOOÚ's frequently asked questions on the Act, both read 15 October 2026. Both are in Czech, so the summaries are our translations. Treat this as a map, not legal advice.

The rule: section 7 of Act 480/2004

• Prior consent. Section 7(2) allows electronic contact details to be used for commercial communications only for users who gave prior consent.
• Existing customers. Section 7(3) lets a business that obtained a customer's email address in connection with a sale use it to promote its own similar products or services, as long as the customer can refuse clearly, simply and free of charge when the address is collected and in every message.
• Requirements for every email. Section 7(4) prohibits commercial email that is not clearly marked as a commercial communication, that hides or conceals the identity of the sender on whose behalf it is sent, or that lacks a valid address where the recipient can ask for it to stop.

The definitions are broad. A commercial communication is any communication, including advertising and invitations to visit a website, meant to promote goods, services or the image of a business, directly or indirectly. Electronic mail covers text, voice, sound or image messages stored until the recipient collects them, which includes SMS and voicemail.

No exception for companies

Unlike some European laws, the Czech rule does not stop at private individuals. Asked whether it matters if the recipient is a natural person or a legal entity, ÚOOÚ answers: it does not, because the Act does not distinguish between types of recipient. Two more answers in its FAQ close the usual B2B shortcuts:

• Contact details freely available on the internet, such as email addresses, cannot be used to send offers, because only recipients who consented in advance, or customers, may be contacted.
• Using a purchased database of tens of thousands of business records is, in ÚOOÚ's words, practically not possible, because consent given in general to unspecified senders is not informed consent.

What counts as a commercial communication

ÚOOÚ reads the definition widely. Holiday greetings and birthday wishes count, because they promote the business's image indirectly, and so do review requests and messages asking for consent to send offers. A reply to a specific inquiry the recipient sent you does not count, provided you can show the inquiry existed and you answer it within a reasonable time.

The most important answer for outbound teams is about asking first. ÚOOÚ says you cannot request consent by email or text, because the request itself promotes your business. In practice, consent has to come through your own channels, such as sign-up forms, events or inbound inquiries, before the first commercial email.

Consent and proof

Consent must be free, specific, informed and unambiguous, given before the first message, tied to a specific sender, and provable. The law sets no required form, but the burden of proof is on the sender, and consent has to meet the GDPR standard. ÚOOÚ recommends double opt-in, where the person confirms through a link sent to the address they entered, and keeping logs of each consent. For consent given on a phone call, it recommends keeping the recording.

How every commercial email must be labeled

1. Mark it. ÚOOÚ suggests a marker such as "OS" (obchodní sdělení), newsletter, news, promotion or discount before the sender address or in the subject line, so the recipient can tell at a glance. For SMS, start the text with "OS:".
2. Identify the business. Give the company name and identifiers such as its company ID number in the message itself; a link to a website is not enough. If an agency sends for a client, say so, for example "Sent by Alfa on behalf of Beta".
3. Offer a direct opt-out. A reply or an unsubscribe link works; asking people to write by post does not. Once someone opts out, no further commercial messages may be sent.
4. Keep a suppression list. ÚOOÚ describes a Robinson list of people who have opted out, kept on the GDPR legal-obligation basis, so they are not contacted again.

Fines and who is liable

Section 11 makes it an offense to send commercial communications electronically in bulk or repeatedly without the recipient's consent. For businesses, including sole traders, it is also an offense to send them in bulk or repeatedly without the marking, while hiding the sender's identity, without a valid opt-out address, or without giving customers a way to refuse in each message. A business can be fined up to CZK 10 million, and a private individual up to CZK 100,000.

ÚOOÚ says "bulk" has no minimum in the law but means roughly a few dozen contacts, and that "repeated" means sending more than once, not necessarily to the same person. The sender and the business being promoted are both liable, and for companies the liability is strict, so hiring an agency does not move the risk.

What this means for B2B outbound

For a team used to cold sequences, the Czech rules remove email as an opening channel. On ÚOOÚ's answers, generic company addresses get no special treatment either: the Act does not distinguish between people and companies, and contact details published on the internet cannot be used. What remains is building consent before the first email: webinars and gated content with a clear sign-up for your messages, trade fairs and events where people agree to hear from you, referrals where the contact provably agrees to receive messages from you, and inbound inquiries, which you may answer.

Phone calls work differently. ÚOOÚ says the Act covers a call only when the message is stored for the recipient, like voicemail. Live sales calls fall under other laws instead: the Electronic Communications Act, the advertising and consumer protection laws, and the GDPR right to object. Check those rules before you pick up the phone.

Checklist for Czech campaigns

1. Send commercial email only to people and companies that opted in to you, or to existing customers whose address you got in a sale, about your own similar products, with an opt-out every time.
2. Do not use scraped, published or purchased addresses, and do not email to ask for consent.
3. Collect consent through your own forms with double opt-in, and keep the logs.
4. Mark every message as commercial, identify the business with its ID number, and include a direct opt-out.
5. Check every send against your suppression list.
6. Hold any agency sending for you to the same rules, because you are liable too.

Neighboring markets are similar: see our guides to cold email laws in Poland, Austria and Germany, or the cold email laws by country hub. For opt-in campaigns, we set up cold email campaigns built around these rules and the sending infrastructure behind them.