Cold Email Laws in Portugal: Companies Opt Out, People Opt In

October 15, 2026. Portugal splits its spam rule by recipient. Under article 13-A of Law 41/2004, marketing email and SMS to a private individual need that person's prior express consent, but marketing to a company is allowed until the company objects and joins a national opt-out list kept by the Directorate-General for Consumers (DGC). Senders have to check that list, which the DGC updates monthly. Breaking the rules is an administrative offence with fines of €5,000 to €5,000,000 for a company. We build cold email infrastructure, and this guide covers what the law says, where the B2B exception ends, and how to run a Portuguese campaign that stays inside it.

The rules below come from the consolidated text of Law 41/2004 on the Diário da República, the DGC's list pages and the data protection authority's 2022 guideline on electronic marketing, all read 15 October 2026. Portuguese is the authoritative language and fines are set case by case, so treat this as a map, not legal advice.

The rule: article 13-A of Law 41/2004

Law 41/2004 is how Portugal transposed the EU ePrivacy Directive in 2004. Its article 13-A, added in 2012, covers unsolicited communications for direct marketing sent by email, SMS, MMS and similar messaging, fax, or automated calling systems that work without a human. It sets four rules:

1. Individuals opt in. Sending requires the prior express consent of a subscriber who is a natural person, or of the user.
2. Companies opt out. The consent rule does not apply to subscribers that are legal persons. Marketing to them is allowed until they refuse further messages and register on the DGC's list.
3. Existing customers. A business that collected a customer's contact details in the course of a sale can market its own similar products or services, as long as the customer can refuse, free and easily, when the details are collected and in every message.
4. No hidden senders. Marketing email may not conceal or disguise who it is sent for, must include a valid address for opt-out requests, and may not push recipients to sites that breach article 21 of Decree-Law 7/2004.

Companies: allowed until they opt out

The B2B exemption is in article 13-A(2), and article 13-B sets up the opt-out list it relies on. The DGC maintains a national list of legal persons that have expressly objected to unsolicited marketing, companies join it free of charge through a form on the DGC website, and anyone sending direct marketing must consult the list, which the DGC updates every month. The DGC publishes it on a dedicated page as separate downloads for fax numbers, mobile numbers and email addresses.

In practice that gives a monthly routine for any campaign aimed at Portuguese companies:

• Download the current email and mobile lists from the DGC page before each campaign, or at least once a month.
• Suppress every address on them, plus everyone who has replied asking you to stop.
• Keep the downloaded file and the date you used it, so you can show the check was done.

Sending to a company that is on the list breaches article 13-A(2), an offence fined under article 14(1). The exemption covers legal persons only, so a sole trader or freelancer who trades in their own name is treated as an individual and needs to have consented.

People: prior express consent, and what counts

For individuals, the data protection authority, the CNPD, set out what consent means in its Guideline 2022/1 (Diretriz 2022/1) on electronic direct marketing, approved on 25 January 2022. Its conclusions are short:

• With no prior relationship, marketing can only be sent with the person's prior and express consent.
• Consent must be informed, specific, free, unambiguous and express, which means agreeing that a specific, clearly identified company may send its own marketing.
• Consent collected through online contests to pass data on to third parties, consent for third parties who are not clearly named, and consent forced as a condition of using a website do not count.
• The burden of proving consent, and the context in which it was given, sits with the sender.

That rules out the usual shortcut of buying a list of Portuguese consumer emails "with consent": unless the consent named your company, it is not consent to hear from you.

What every marketing email must include

Article 13-A(4) bans marketing email that hides or disguises the person it is sent for, and ties that rule to article 21 of Decree-Law 7/2004, Portugal's e-commerce law. In practice every message needs three things:

• The real sender, clearly identified, so the recipient knows which company the message is for.
• A valid address or link where the recipient can ask you to stop, which you then honor.
• No links that push the reader to a site that breaks the same rules.

Article 13-B also requires you to keep an up-to-date list of the people who consented and of the customers who did not object. That record, together with your DGC checks, is what you show the CNPD if a complaint arrives.

The grey zone: a named person at a company

Cold B2B email rarely goes to a company's general inbox. It goes to a named buyer at a work address, and this is where the Portuguese text gets uncomfortable. The consent rule in article 13-A protects the subscriber who is a natural person "or the user", while the opt-out regime is written for subscribers that are legal persons. The CNPD's 2022 guideline states that it does not address the legal-person regime, so it does not settle where a named employee falls.

Two points help. A named work address is personal data, so the GDPR applies to it whatever ePrivacy route you rely on, and that means a lawful basis, a privacy notice and an easy objection. And in our reading, the lowest-risk B2B campaigns in Portugal are built on the legal-person rule as written: messages about the company's business, sent to role-based or company addresses, after a check against the DGC list. Our guide to GDPR and cold email covers the data protection side in detail.

Who enforces it and what it costs

The CNPD opens and decides cases under article 13-A and the record-keeping duties of article 13-B. Fines are set in article 14 of the law:

Negligence and attempts are punishable too, with both limits halved, so sending to a listed company because you skipped the check can still be fined. Electronic communications providers can also take violators to court. The guideline also shows how fast complaints grew: the CNPD received about four thousand complaints about unsolicited electronic communications between May 2019 and January 2022, from 528 in the last eight months of 2019 to 2,075 in 2021.

Checklist for Portuguese sends

1. Split your list into natural persons, including people trading in their own name, and legal persons such as companies, before you write a single email.
2. For individuals, send only with consent that names your company and that you can prove.
3. For companies, download the DGC email list every month and suppress every match.
4. Prefer role-based or company addresses, and keep the message about the recipient's business.
5. State who is sending, include a working opt-out in every email, and honor it at once.
6. Keep records of consent, DGC checks and opt-outs for as long as you market to the contact.
7. For existing customers, market only similar products, and offer an opt-out at sign-up and in every message.

For Portugal's neighbor, see our guide to cold email laws in Spain, and the cold email laws by country hub compares every market we have covered. When you are ready to send, we can set up cold email campaigns built around these rules and the sending infrastructure behind them, with suppression lists and opt-out handling built in.