Cold Email Laws in Finland: Work Emails Need Consent or a Role Match

October 27, 2026. Finland is not the opt-out B2B market that many cold email guides describe. Section 200 of the Act on Electronic Communications Services (917/2014), the law formerly called the Information Society Code, allows email marketing to natural persons only with their prior consent, and Finland's Data Protection Ombudsman treats an address like [email protected] as belonging to a natural person. The exception is what the Ombudsman calls authorisation by role: no consent is needed when the recipient's job is essentially linked to what you sell, and you must check and document that before the first send. Mail to a company's general address, such as info@, needs no consent but must honour an opt-out. Breaches can draw a GDPR administrative fine of up to 4 percent of turnover or EUR 20 million; in 2020 the Ombudsman's sanctions board fined a course provider EUR 7,000 for marketing it said was aimed at companies.

What the Finnish law says

Chapter 24 of the Act, in the English translation on Finlex (which tracks amendments to 1207/2020; the current Finnish text of these sections reads the same), sets four rules that decide a cold email program:

1. Natural persons need prior consent. Direct marketing by email, text, voice, sound or image messages, automated calling systems or fax may only be directed at natural persons who have given their prior consent (section 200(1)).
2. Existing customers are the exception. A seller that obtained a customer's contact details in connection with a sale may market its own products of the same product group, or similar ones, if the customer can refuse easily and free of charge when the details are collected and in every message (section 200(3)).
3. Legal persons are opt-out. Direct marketing to legal persons is allowed unless the recipient has specifically prohibited it, and every message must offer an easy way to refuse at no separate charge, with clear notice that the option exists (section 202).
4. Every message must be identifiable. The recipient must be able to recognise it clearly as marketing, and it is prohibited to send one that hides the sender on whose behalf it is sent or has no valid address for opt-out requests (section 203).

Why a named work email counts as personal

The question for B2B senders is which rule a named employee falls under. The Data Protection Ombudsman's direct marketing guidance answers it: an address in the format [email protected] is, as a rule, considered to belong to a natural person, so the main rule of prior consent applies. Consent is not required when the person works in a position essentially linked to the goods or services being marketed. The controller must verify the person's role before starting and be able to show afterwards that the processing was lawful, for example by documenting the assessment. Marketing sent to an organisation's general address needs no consent, and both the organisation and its employees must be able to opt out easily and free of charge.

The guidance adds three points that catch outbound teams. The opt-out does not have to be an unsubscribe link, but it must be easy and free. When the contact details came from somewhere other than the person, GDPR Article 14 requires the privacy information at the latest at the first communication; for marketing calls the Ombudsman lists the essentials as where the contact details were obtained, who the controller is and where to find out more about data protection rights. And the Ombudsman only begins to process a complaint once the person has contacted the sender first, so the first opt-out or access request is the moment to get right.

The 2020 case that tested the B2B argument

In August 2020 the Ombudsman's sanctions board fined Acc Consulting Varsinais-Suomi (Independent Consulting Oy) EUR 7,000 after eleven complaints in 2019 about marketing for courses such as hot work and asbestos removal, sent by text message. The company argued it had targeted corporations, which need no prior consent, because the phone numbers were used by the companies the recipients worked for and those companies were in its customer segment. The Deputy Data Protection Ombudsman disagreed: before marketing, the company should have determined each person's position and assessed whether the courses were significantly linked to that person's duties. Without that step the marketing counted as aimed at natural persons and needed consent. The company had also kept messaging people who replied to opt out and had not answered rights requests within one month. Section 200 treats email and text messages alike, so the same reasoning applies to cold email.

Who enforces it and what it can cost

1. The Data Protection Ombudsman supervises sections 200 and 202 to 204 (section 305). Its sanctions board, made up of the Ombudsman and two deputies, can impose GDPR administrative fines of up to 4 percent of turnover or EUR 20 million.
2. The Consumer Ombudsman can ask the Market Court for a penalty fee when a trader breaks section 200 or 203(2) to the detriment of consumers, intentionally or negligently, under sections 15, 18 and 21 of the Act on Certain Powers of the Consumer Protection Authorities (566/2020). The fee can reach 4 percent of the previous year's turnover, and the proposal must be made within five years of the breach ending.
3. The criminal route remains: direct marketing in breach of sections 200 to 203 is a data protection violation in electronic communications, punishable by a fine unless the offence is minor (section 349).

The same rule covers AI voice agents

Section 200(1) names automated calling systems alongside email. The Ombudsman's guidance says a number may be dialled automatically if a person then conducts the marketing, but a call in which a machine does the marketing needs the recipient's prior consent. In a joint release with the Finnish Competition and Consumer Authority, Data Protection Ombudsman Reijo Aarnio said a robot may pick and dial the number, but the sales conversation itself needs the person's prior consent for that purpose. An AI voice agent that pitches Finnish prospects therefore needs a consent record before it dials, much as a TCPA-compliant AI calling program records consent in the US.

What it means for operators

1. Split every Finnish list three ways before it reaches a sequence: general company addresses, named contacts whose role clearly matches the offer, and everyone else, who needs consent or should be dropped.
2. Write the role test down per contact. Job title, department and one line on why the offer relates to the person's duties. A broad match on a customer segment is what failed in 2020.
3. Identify yourself and label the email as marketing, with a working reply or opt-out address, and suppress every refusal promptly across all inboxes and tools.
4. Put the Article 14 basics in the first email: where you got the address and where to read your privacy notice. Answer access and objection requests within one month.
5. Check the list's source. A bought list rarely carries the role data the test needs; read is buying email lists legal first. Senders outside the EU also need a GDPR representative.

Run Finnish campaigns from authenticated domains on proper email infrastructure, budget the email hosting cost, and compare the rest of Europe in our cold email laws by country guide. We build these checks into every cold email campaign we run; if you are pricing outsourced outreach, see what a cold email agency costs per month. This is a summary of public documents, not legal advice.