Cold Email Laws in Norway: Named Work Addresses Need Consent

October 15, 2026. Norway's Marketing Control Act bans sending marketing by email, text message, fax or automated calls to a natural person who has not agreed in advance. The Consumer Authority (Forbrukertilsynet) reads that rule to include a person's own work address, such as [email protected], even when the offer is aimed at the business and even if the address is listed as the company's contact in the Brønnøysund registers. Only addresses that do not belong to a specific person, such as [email protected], fall outside it. Significant or repeated breaches can bring an infringement fee. We build cold email infrastructure for B2B outreach, and this guide covers what the Norwegian rules allow and how to run a campaign that stays inside them.

The rules come from section 15 and the surrounding sections of the Marketing Control Act (markedsføringsloven) on Lovdata and from Forbrukertilsynet's guidance on marketing by email and SMS, both read 15 October 2026. The guidance is in Norwegian, so the summaries below are our translations. Treat this as a map, not legal advice.

The rule: section 15 of the Marketing Control Act

Section 15 has five parts that matter for outbound teams:

1. Consent first, for natural persons. In business, it is prohibited without the recipient's prior consent to send marketing to natural persons by electronic methods that allow individual communication, such as email, fax or an automated calling system.
2. Live phone calls are exempt from that consent rule. The prior-consent requirement does not apply when a person is contacted orally by telephone.
3. Existing customers. Email marketing to a customer is allowed without new consent if you received the address in connection with a sale, you market only your own goods or services similar to the ones bought, and the customer can opt out easily and free of charge when the address is collected and in every message.
4. Email includes texts. The act defines electronic mail as any text, voice, sound or image message stored in the network until the recipient fetches it, which covers SMS and MMS.
5. The e-commerce rules apply too. The E-commerce Act, including its section 9 on electronic marketing, applies on top.

Work addresses: the B2B catch

Because the rule protects natural persons, it is easy to read Norway as open to B2B email. Forbrukertilsynet's guidance is narrower than that. It says messages to a person's individual work address are covered, giving [email protected] as the example, regardless of whether the email contains an offer to the business, and that the ban applies even when the person's address is registered as the company's contact in the Brønnøysund Register Centre or another business register. It is permitted to send marketing to addresses that do not belong to a specific person.

So a classic cold email to a named decision maker needs that person's prior consent in Norway, and a campaign to generic company inboxes does not. Our cold email laws by country hub shows how other markets draw the same line.

What valid consent looks like

Forbrukertilsynet sets three requirements for consent:

• Voluntary. It cannot be a condition of buying something, and the person must be able to withdraw it at any time.
• Express. It must come from an active step. A pre-ticked box or a clause in a contract is not enough, and the authority recommends a separate checkbox.
• Informed. The person must understand what they are agreeing to receive.

The guidance also recommends double opt-in, where the person confirms their sign-up from a link sent to their inbox, citing an Oslo District Court judgment and the practice of the Market Council and Forbrukertilsynet. Double opt-in also gives you the proof you need if a complaint arrives.

Phone calls follow different rules

A live sales call by a person does not need prior consent under section 15, but other sections of the act govern telephone marketing:

• The opt-out register. Section 12 bans telephone marketing to consumers listed in the Reservasjonsregisteret, Norway's opt-out register, and to people who have opted out directly with the business. The exceptions are a person's express request to hear from that business and, for the register, existing customers offered the business's own similar products. Section 13 a requires businesses to check their lists against the register before the first contact and in the month the marketing takes place.
• Calling hours. Section 14 bans telephone marketing to consumers on Saturdays, Sundays and public holidays, and on weekdays before 09:00 or after 21:00. Calls to consumers must not come from a hidden number or one that is not listed in directory services.
• What the caller must say. Under section 16, the caller must say who supplied the personal data used for the call and, where relevant, mention the right to opt out. On calls to consumers, the caller must immediately present themselves and say the call is for marketing.

Automated calling systems are a different matter: section 15 lists them, in Norwegian a talemaskin or voice machine, alongside email, so an automated call to a natural person needs prior consent. We treat an AI-driven call the same way, which matters for anyone planning AI calling into Norway.

Enforcement and fines

Under section 42, an intentional or negligent breach of section 15 that is significant or repeated can lead to an infringement fee (overtredelsesgebyr), and the ministry may set rules on the amount by regulation. The act also allows prohibition orders under section 40 and coercive fines under section 41 to force compliance.

What a compliant B2B campaign looks like

The Norwegian rules push outbound teams toward a two-step model. The first message goes to a company inbox, such as post@ or a sales or purchasing inbox, and is written to the business rather than to a person: what you offer, why it fits the company, and how to reply. As good practice, that message should still identify the sender clearly and offer an easy way to stop further messages. Section 15 also points to the E-commerce Act and its section 9 on electronic marketing, so check that act too.

The second step starts only when someone answers. A reply that asks for more information lets you answer that question. For further marketing to that person, get express consent first, for example through a sign-up form that names your company and the kind of messages it will send. From then on, keep a record of when and how they agreed, and stop at once if they withdraw. The same logic applies to text messages, which the act treats as email. It is slower than a sequence to named decision makers, but it is the version that holds up under Forbrukertilsynet's reading.

Checklist for Norwegian campaigns

1. Sort every address: named person, or generic company inbox.
2. Email named people only with prior, express, informed consent, ideally confirmed by double opt-in.
3. Keep generic-inbox campaigns relevant to the business and include a working opt-out.
4. Use the existing-customer route only for similar products, with an opt-out at collection and in every message.
5. Treat SMS like email: consent first.
6. If you call consumers, screen numbers against the Reservasjonsregisteret first, call only on weekdays between 09:00 and 21:00 from a listed number, introduce yourself, state the marketing purpose and name your data source.

Neighboring markets differ: see our guides to cold email laws in Sweden and Denmark. When you are ready to send, we can set up cold email campaigns built around these rules and the sending infrastructure behind them, with suppression lists and opt-outs built in.