Legal Cold Email and PKE: LinkedIn Invitation Acceptance

Sending a single email to a potential B2B client without appropriate legal grounds can cost the company's management more than an annual marketing budget. CEOs and marketing directors in Polish SMEs daily face a dilemma – they want to conduct email outreach to new B2B contacts, but fear that without explicit consent for commercial communication, they will violate PKE regulations. Due to this legal uncertainty, they either send nothing or send emails and live with the stress of a potential UOKiK inspection.

Why SME boards fear email outreach

The President of UOKiK imposed fines exceeding PLN 1.2 million on Asmanta Call Center and its board members for aggressive telemarketing, and the case was documented on UOKiK.gov.pl/download/27236. At the same time, the monthly cost of employing a dedicated Account Executive or SDR ranges from several to over a dozen thousand PLN before any revenue offsets the expense. When management is unsure about the compliance of prospecting channels with PKE and GDPR, every subsequent invoice for a full-time position becomes an investment burdened with the risk of personal liability. Added to this is the fear of burning the main company domain – mass mailings without warming-up, without segmentation, and without clear legal grounds lead to reduced deliverability, messages landing in spam, and potential blocking of the domain by major email services.

What the new Electronic Communications Law has changed

The repeal of Article 10 of the Electronic Services Provision Act and the transfer of regulations concerning unsolicited commercial information to the PKE – as detailed by afterlegal.pl – means the end of mass cold mailing based on presumed consent, because the regulations now require explicit, informed opt-in before sending any commercial information to an email address. Any contact without documented legal grounds can be classified as a violation with sanctions covering both the company and the managing individuals personally.

End of presumed consent in cold mailing

The new Electronic Communications Law shifted the burden of proof – instead of demonstrating that the recipient did not object, the administrator must now prove that the recipient gave informed consent before the first contact. Business addresses in the format name.surname@company.com were classified as personal data, extending the prohibition to B2B contacts. The concept of soft opt-in from the e-Privacy Directive, allowing the use of customer data for marketing similar products, ceased to function in its previous form.

A legal paradox blocking traditional prospecting

The President of UOKiK explicitly stated that merely asking for consent to present an offer is treated as direct marketing requiring prior consent. This means that classic cold mailing is structurally impossible to conduct legally without a previously built relationship – every first contact becomes a trap from which there is no escape without a prior opt-in.

LinkedIn as a channel for building legal grounds for email contact

LinkedIn simultaneously builds a professional relationship and documented legal grounds for further email contact, making it the only prospecting channel that meets both requirements at once. Accepting an invitation to a network of contacts creates a business relationship which, in light of PKE and GDPR, allows subsequent actions to be considered justified by the administrator's legitimate interest. The platform user thus expresses informed consent for communication within the professional community, and this consent translates into legitimate email contact, provided the message content remains within the boundaries of the previously established relational context.

Recital 47 of the GDPR explicitly states that processing data for direct marketing purposes may be considered a legitimate interest of the administrator. In each case, a balancing test (LIA) must be conducted to assess whether the administrator's interest does not unduly infringe upon the rights of the data subject. The LinkedIn sequence passes this test positively because the contact occurs in a professional context, the data was obtained from a public source, the recipient actively participated in the dialogue, and the email content continues the previously established relational context. The administrator must document this basis – record the date of invitation acceptance, the content of message exchange, and the context of the relationship.

Three-step sequence: from invitation to legal email

The order of steps in this sequence is not coincidental – each step builds upon the previous one, creating a documented trace of the relationship, which, in case of a UOKiK inspection, constitutes complete proof of informed opt-in.

Step 1 – Invitation as neutral professional contact

The invitation cannot contain commercial information, must refer to a common industry context, and be personalized, distinguishing it from mass spam. LinkedIn users accept terms that allow correspondence between community members, so the legality of the first contact is less controversial than in the case of unsolicited commercial information sent to an email.

Step 2 – Message exchange as documented opt-in

The recipient's active response creates a documented relationship meeting PKE requirements. This exchange should be archived as evidence in case of a supervisory authority inspection – recording the date, content, and context forms the legal basis for further contact.

Step 3 – Email as a continuation of the relationship

The email content must directly continue the topic from LinkedIn, not be a new, unrelated commercial offer. It is precisely the contextual nature of the contact that determines its legal qualification as a natural extension of an existing relationship.

How to document the legal basis for UOKiK inspection purposes

Each stage of the LinkedIn → opt-in → email sequence should be recorded in a way that allows proof to be presented to the supervisory authority. The date of invitation acceptance, the content of message exchange on the platform, and the relational context form a complete set of evidence. Such documentation eliminates the need to collect separate consent forms, as the mere acceptance of an invitation and active correspondence on LinkedIn constitute a sufficient legal basis for legal cold email according to Polish regulations. Building a B2B contact database legally in this way protects both the main company domain from anti-spam filters and board members from personal liability.

In practice, companies that have implemented this model report that conversations with factory directors and CFOs occur under full compliance conditions, and the pipeline no longer depends solely on referrals. The cost of an AE/SDR position starts to pay off faster because every email sent is based on documented legal grounds. Hard ROI data for this specific sequence depends on the industry and targeting quality.

How does your company handle the process of obtaining a legal basis for email outreach to new B2B contacts? Has your lawyer or compliance officer approved the LinkedIn sequence as sufficient opt-in – or did they require additional consent forms? Share in the comments: what worked and what proved insufficient in practice during internal controls.