Cold Email Laws in Hungary: Even the Consent Request Is an Ad

Affiliate disclosure: some links in this article are partner links. If you start a paid plan through them, imisofts may earn a commission at no extra cost to you. We only recommend tools we actually use to run client campaigns.

Short answer. Hungary requires prior, clear and express consent before advertising is emailed to a natural person (section 6(1) of the Grt., Act XLVIII of 2008, in force since 1 September 2008). An email whose sole purpose is to ask for that consent also counts as an advertisement (section 14(2) of the e-commerce act), so you cannot email a private individual to ask permission. The regulator, the NMHH, says the ban covers ads sent to a private individual rather than to "a company or contact person", but it also warns against using contact details found on websites without consent unless they were published for advertising, and the GDPR still applies to named addresses. The NMHH can fine HUF 50,000 to 500,000 in a proceeding, about €137 to €1,370 at the ECB rate of 12 November 2026, and again for a repeat breach.

We earn a commission if you sign up for Kit through our links, and we sell cold email services. On 13 November 2026 we read the Hungarian acts on Jogtár's free legislation service (the official njt.hu did not load for us), the NMHH's undated English electronic advertising page, one NMHH decision and one NAIH letter. Translations from Hungarian are ours. This is general information, not legal advice.

What section 6 of the Grt. requires

Section 6 of the Grt. opens with "unless a separate law provides otherwise" (our translation). Read with the e-commerce act, it sets seven duties for emailing ads to private individuals:

• Prior, clear and express consent before the first advertising email (6(1)). The NMHH adds that "consent automatically deemed to be prior consent shall not be accepted"; on our reading, a pre-ticked box does not count.
• A consent statement with the person's name, the scope of data they agree to, and that the consent is voluntary and informed, plus place and date of birth for age-restricted ads (6(2)). An email-only box captures no name, so we would ask for one.
• A register of consents, kept by the advertiser, the advertising service provider and the publisher; its data goes to a third party only with the person's prior consent (6(5)), and the authority can ask to see it (26(3)).
• Free withdrawal at any time, with the person's data deleted from the register "without delay" (6(3), our translation).
• Withdrawal by post and by email, both, in a way that identifies the person (6(6)).
• Those contact details in every advertising email, shown "clearly and conspicuously" (6(7), our translation).
• A label and a real sender: each email must show it is an advertisement and identify the advertiser and the real sender (e-commerce act 14/A(1)).

The electronic communications act adds that even with consent, a direct marketing message whose sender cannot be identified may not be sent (section 162(3)).

Why the consent request email is itself an ad

Section 14(2) of the e-commerce act says a communication whose sole purpose is to request the Grt. 6(1) consent also counts as an electronic advertisement, and section 14(5) applies Grt. section 6 to it. The NMHH page agrees: messages sent without prior consent are illegal, "as are messages requesting permission to send advertising".

Grt. 6(8) adds that a consent request may not contain advertising beyond the business's name and designation. So collect consent where the person comes to you: a sign-up form, a checkout checkbox or an event form. Nothing we read says whether a double opt-in confirmation email counts under 14(2); on our reading it answers the person's own request, but we would keep it free of advertising beyond your business name.

Companies, contact persons and sole traders

The statute protects "a natural person as the recipient" (our translation) and does not mention companies. The NMHH's page says: "The law prohibits the unsolicited sending of electronic advertising if it is not sent to a company or contact person, but to a private individual." It says it "only carries out its supervisory procedure on the basis of applications or notifications submitted by natural persons", though the act lets it start proceedings on its own initiative too (16/C(1)), and that it cannot act against "mailings in foreign languages or aimed at non-Hungarian consumers". On our reading, that last line limits which cases the NMHH takes, not what is lawful.

On our reading of that page, an advertising email to a Hungarian company or its contact person is outside the Grt. consent rule. We could not confirm whether the NMHH or a court treats a named employee's address as a "contact person". Four limits apply either way:

• Addresses found on websites. The NMHH says contact details posted on websites "should not be used for advertising without prior consent if the contact details are not specifically published for advertising purposes", without limiting that to private individuals. We would only use an address published for receiving offers, and the page does not say even that is enough.
• An ad label and a real sender. Section 14/A(1) is not limited to natural persons, and the NMHH says advertising messages "must clearly indicate that the content is an advertisement and include information that identifies the advertiser".
• Objections. Section 162(2) of the electronic communications act bars direct marketing contact outside Grt. section 6 with a subscriber who has declared they do not want it. We did not confirm how that declaration is made, so we would treat any "no" as permanent.
• Sole traders. The NMHH page does not address sole traders (egyéni vállalkozó); in our view they are closer to a person than a company, so we would get consent first.

The GDPR still covers named business addresses

On our reading, a named address such as [email protected] is personal data, so the GDPR applies whatever the Grt. says; in Hungary the NAIH supervises it. Article 6(1)(f) allows processing necessary for legitimate interests unless the person's interests or rights override them, and Recital 47 says direct marketing "may be regarded as carried out for a legitimate interest" (see our legitimate interest assessment guide). Article 21 gives a right to object "at any time", after which "the personal data shall no longer be processed for such purposes", and that right must be "explicitly brought to the attention" of the person at the latest in your first message. Where you did not get the address from the person, Article 14(3)(b) requires your privacy information by that first communication too. For an undertaking, breaching these rights can cost up to €20 million or 4% of worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(5)).

One tension: Grt. 6(3) requires deleting a withdrawn person's data from the consent register without delay, while a sender may want a minimal suppression entry so the address is never imported again. Nothing we read settles whether that fits 6(3), so ask your lawyer; see also GDPR data retention periods.

Who is liable, and what the NMHH can do

Under section 14(6) of the e-commerce act, the advertiser, the electronic advertising service provider (for example an agency that builds and sends a campaign) and the publisher are equally liable for breaching Grt. section 6, and jointly and severally liable for damage. If you send for clients, their consent problem is yours too, and that includes agencies like ours.

The statutory fines are small. The one published decision we read, EF/1946-6/2014, fined a company HUF 75,000 (about €205 at today's rate, not 2014's) after a person received another of its advertising emails on 22 January 2014; a 2012 decision had already found it in breach of 6(3) for ignoring that person's unsubscribe. We found no NMHH spam decision from 2025 or 2026. On our reading, the proof rule matters more than the fine. Conversions use the ECB reference rate of €1 = HUF 364.98.

A compliant setup for Hungarian subscribers

For a B2C list, or any list that includes private individuals or sole traders, we would build it like this:

1. Collect consent on your own form, with a name field, an unticked checkbox naming email as the channel, and a privacy notice link (Grt. 6(1) and 6(2)).
2. Use double opt-in and keep the confirmation date with the record; on our reading, that is the kind of evidence that could meet 16/D(5).
3. Do not make a free guide or discount conditional on the newsletter. In a 2018 information letter, NAIH/2018/3581, the NAIH said a benefit cannot be made conditional on consent to direct marketing the service does not need, and non-subscribers should get the service on equal terms; only losing what is in the newsletter itself, such as exclusive content, is acceptable. The letter is guidance, not a binding decision.
4. Put a postal address and an opt-out email address in every footer next to the unsubscribe link, and act on all three (6(6) and 6(7)).
5. Mark the email as an advertisement and send it from an identifiable sender (14/A and 162(3)).
6. Delete withdrawn subscribers from the consent register without delay (6(3)).

Point 3 changes any funnel that trades a guide for a subscription: make the newsletter a separate, optional checkbox.

Where Kit fits, and where it does not

For the opt-in list this requires, we suggest Kit. It is free for up to 10,000 subscribers, with unlimited forms, landing pages and broadcasts (Kit's pricing page, 13 November 2026). Double opt-in is on when "Auto-confirm new subscribers" is unchecked, which Kit's help center (30 July 2026) "strongly" recommends. Kit's GDPR page describes an optional account-level consent page shown after a visitor subscribes, custom consent checkboxes in its form builder, an EU subscriber filter and a data processing agreement. For Hungary we would put the checkbox on the form, so consent comes before the sign-up. You can start on Kit's free plan and add the Hungarian pieces below.

Kit calls its confirmation email an "incentive email", and the NAIH letter applies to any freebie you attach: deliver it whether or not the person ticks the newsletter box. We did not check whether Kit can make a name field required or add a postal opt-out address to its footer, so test both. Unlimited sequences and visual automations come with the Creator plan: $39 a month billed monthly, or $390 a year, for 1,000 subscribers.

In our view, B2B outreach to Hungarian companies needs the checks above before any sending setup. Our email infrastructure service sets up sending domains and authentication, and our cold email team runs campaigns; sending for a client makes us an electronic advertising service provider under 14(6), so these rules bind us too. Pricing outside help? See what an email deliverability consultant costs and email hosting cost.

How Hungary compares with other EU countries

Our pages on Greece and the Czech Republic explain why both apply opt-in to companies as well as people, a stricter line than the NMHH's reading for Hungary. See also Romania, Austria, the cold email laws by country table and is buying email lists legal.

The bottom line for senders

Our view: email a private individual only after they opt in on your own form with their name on the record, and never send a "may we email you?" message first. For a company, use only an address it published for receiving offers, mark the email as an ad, identify yourself, include a GDPR notice and a working opt-out, and stop at the first objection. Keep the evidence, because your own statement cannot replace it. If you are building the opt-in list now, Kit's free plan is free for up to 10,000 subscribers.