Cold Email in Poland: What Is Allowed in 2026

Cold email is legal in Poland. This is not a grey zone or an area where the law says nothing. There is, however, a set of conditions that have to hold at the same time: a legal basis for processing data under GDPR, recipient consent required by the Electronic Communications Law (PKE), correct identification of the sender inside the message. Neglect one element and the whole campaign is out of compliance.

The most common mistake looks like this: a company checks one act, finds a provision that seems to fit, and considers the matter closed. Then it turns out the second act says something completely different. Spam filters, by the way, still have an opinion of their own.

We write from the perspective of an operator running its own fleet of sending servers. We see the effects of bad lists not only in letters from lawyers. We see them first on the technical side: in complaints, bounces and domain reputation. Below you will find the legal basis, the B2B question, the required elements of a message, the authentication layer and the practice of getting out of blocks.

What regulates cold email: GDPR plus PKE article 398

Two layers have to be separated. GDPR covers the processing of personal data: where you got the address, on what basis you keep it, what the recipient knows about it. The Electronic Communications Law regulates something else – the very act of sending a marketing message to a specific contact channel.

PKE article 398 replaced the former article 10 of the Act on Providing Services by Electronic Means and article 172 of the Telecommunications Law. Earlier you had to read two provisions at once and work out which one covered which channel. Now a single provision covers email, telephone and the remaining means of electronic communication. Simpler overall.

Consent has four features. It must be prior, meaning given before you send the first message. Freely given – the recipient cannot be forced into it as a condition of access to something else. Specific, so referring to a defined purpose. And demonstrable, which means you have to be able to reproduce it. A pre-ticked checkbox meets none of these conditions. None.

Legitimate interest of the controller can be a correct basis for processing under GDPR. It just does not replace consent under PKE. These are two independent requirements and both have to check out. We covered it in detail in the piece on why marketing consent applies in B2B as well. The information obligation towards the recipient also applies when the address comes from a public source – public availability does not remove the need to say who is processing the data and why.

B2B is not an exception, though many companies assume it is

The belief that sending to companies follows looser rules is widespread. And wrong. Consent applies in B2B too. The recipient’s status as a business does not remove the PKE requirement.

It is worth distinguishing address types. jan.kowalski@firma.pl identifies a specific person, so it constitutes personal data within the meaning of GDPR. A generic address such as kontakt@ or biuro@ has a different status in terms of data protection, but it still falls under PKE if you send a marketing message to it. Same channel, same provision.

An address from the KRS company register, CEIDG or a website footer is publicly available. Publicly available for contact in the matters it was published for – not for marketing. This distinction costs companies the most nerves, because intuition suggests exactly the opposite.

Then comes the idea: let us first send an email asking for consent. The problem is that such a message is itself often classified as a marketing message, especially when it contains a description of the company or the offer. A risky route.

What works instead:

• a signup form with a clear description of what the recipient agrees to and how often they will get a message,
• a lead magnet, meaning material of real value exchanged for an address together with consent,
• contact on LinkedIn or by phone before the first email, with a request for consent given in another channel,
• a contact form on the website, where the other side takes the initiative.

What has to be in the message and in the consent record

A single message has to carry the full set of information about the sender. Full legal name of the entity, registered address, tax number (NIP) or KRS number, a clearly stated purpose of contact and a working opt-out mechanism. The absence of any of these elements is trivially easy for the recipient to demonstrate and damned hard to explain.

Opt-out is a separate topic. It has to be free, done in one click, without logging in and without asking for a reason. A survey shown before the unsubscribe irritates the recipient, and irritation ends with a click on the spam report button. That in turn hits the reputation of the whole domain. The List-Unsubscribe header together with the One-Click version is a technical standard expected by large mailbox providers, not an ornament.

On the system side you have to store evidence. The wording of the consent as the recipient saw it. Date and time. IP address or another description of the acquisition channel. And the form version, because clauses change, and consent from two years ago referred to a different text. Separately it is worth keeping a record of unsubscribes so you do not send twice to someone who refused.

Split consents by purpose. Newsletter, commercial offer and profiling are three different things. One blanket clause for everything is weaker as evidence than three separate ones.

Tip: keep the consent record in the sending system, not in a spreadsheet on the accountant’s drive. In an inspection what counts is the ability to demonstrate a specific consent for a specific address, not a declaration that you collected it somewhere. If signup forms and the CRM work separately, arrange a connection between the sending system and the rest of your tools, so that consent and its date travel together with the address.

A technical matter from the same shelf: the address in the From field and the Return-Path address should belong to a domain you actually control. Sending with someone else’s domain in the sender field is a legal and a deliverability problem at once.

The technical layer: without SPF, DKIM and DMARC compliance gets you nothing

You can have flawlessly collected consents and still not reach the recipient. Bulk sending without authentication lands in spam regardless of the quality of the content and the legality of the list. The filter does not read your privacy policy.

Three mechanisms work together:

1. SPF – a DNS record that points to the servers authorised to send from your domain.
2. DKIM – a cryptographic signature of the message, letting the recipient check that the content was not changed on the way.
3. DMARC – ties the two together and tells the filter what to do on a mismatch: pass, move to quarantine or reject.

The most frequently misconfigured element is alignment. The domain in the From field has to match the domain in Return-Path (for SPF) and the domain of the DKIM signature. And this is where the classic situation comes from: SPF passes, DKIM passes, and DMARC fails anyway. Almost always it is alignment.

On the infrastructure side the rest of the basics count: a PTR record for the sending server’s IP address, a correct HELO matching the host name, TLS encryption on the connection. We run our own servers and I check these three things on every new address before anything goes out of it.

DMARC reports show two things at once: who is spoofing your domain and which of your own sending streams are non-compliant. Usually you find the second one first. A forgotten invoicing system or a form on the website.

Tip: start with the p=none policy and collect reports for a few weeks. Only when you can see the full set of your streams, switch to quarantine, and then to reject. The reverse order can block your own transactional mail.

Practice from our own fleet: warmup, bounces and getting out of blocks

A new domain and a new IP address have no history. And for a filter, no history is a reason for caution. Warmup means building that history gradually: a small send at the start, a slow increase in volume, at first exclusively to the most engaged recipients. Opens and replies from the first sends set the reputation for the weeks that follow.

Handle bounces separately. Hard ones, meaning the address does not exist, remove immediately after the first occurrence. No mercy. Soft ones, resulting from a full mailbox or temporary server unavailability, watch and retire after a series of failed attempts.

Large mailbox providers react to two signals exceptionally sharply: recipient complaints and sending to inactive addresses. A block can be sudden and cover the whole IP address, not a single campaign. Getting out of it always looks the same – stop sending, clean the list, submit the provider’s request form, be patient. There are no shortcuts here and nobody will sell you one.

We do not promise getting around spam filters. Promises like that cannot be kept, and attempts end with a loss of trust on both sides. We work on sender reputation, because only that works long term. Segmentation by engagement saves reputation more effectively than another rewrite of the subject line. Tested.

If you want authentication, warmup and the consent record in one place, we described it in the email marketing platform with its own sending servers. Details are in the overview of the platform’s capabilities, together with what is ready and what is still being built.

The risk and who carries it

Liability runs on three parallel tracks. Administrative, meaning proceedings by the supervisory authority. Civil – claims from a specific recipient who felt their rights were infringed. And reputational, the hardest to price and the longest felt.

Buying a ready-made address database transfers nothing to the seller. You remain the data controller and the obligation to demonstrate consent for every address rests on you. The seller can assure you everything was collected correctly. An assurance is not evidence.

With the provider of the sending tool a data processing agreement is required. Understand its scope: the provider is responsible for the security of processing, meaning that the data does not leak and is processed in line with your instructions. It is not responsible for the legality of your list.

Before signing the agreement ask two questions: where the servers physically stand and whether the data goes outside the European Economic Area. An evasive answer is also an answer.

That leaves the purely technical cost, which few people think about when buying a database. A bad list lowers domain reputation. And domain reputation does not split into marketing and everything else – the drop hits transactional mail, order confirmations and ordinary business correspondence too. The campaign ends after a week, the consequences stay for months.

Summary: compliance as part of the configuration, not as a document

Legal cold email in Poland comes down to three things at once: a basis for processing under GDPR, the consent required by PKE article 398, and correct sending technique. Dropping any element breaks the rest.

The order of implementation matters:

1. an audit of address sources – where every record on the list actually comes from,
2. a consent record with the wording, the date and the acquisition channel,
3. configuration of SPF, DKIM and DMARC together with domain alignment,
4. warmup of the domain and the IP addresses,
5. and only at the end, scaling the volume.

Compliance pays off technically as well. A list built on consent has higher opens and fewer complaints, and those two signals build sender reputation faster than any content optimisation. The law and deliverability pull in the same direction.

We do not have everything ready. Some of the elements we describe as an industry standard are on our roadmap, not in the panel. We say it plainly instead of adding features to marketing materials.

Before you send the next campaign, check your own DNS configuration. SPF records, DKIM selectors, the DMARC policy and the reports from the last month – fifteen minutes of work that saves weeks of getting out of a block.