Is it legal to cold-contact businesses in Spain? Email, phone, WhatsApp and visits

Anyone who starts selling services to local businesses ends up asking the same question sooner or later, usually staring at a spreadsheet with forty hair salons, their phone numbers and, with luck, a few email addresses: can I write to them? Some people say yes because "everyone does it", and others say no because "with data protection law you can't do anything". Neither answer is right.

The truth is that it depends on the channel. In Spain, cold contact is legal through some channels, banned through others, and in a couple of cases there's a grey area where you need to tread carefully. This guide separates them, explains what to do with the data in your list, and suggests a way of working that doesn't put you at risk.

Short answer: cold contact with a business is legal in person and, with care, by phone, but not by email, SMS, WhatsApp or direct message on social media: article 21 of the LSSI (Spain's e-commerce law) bans commercial electronic communications that the recipient hasn't asked for or authorised, and that includes companies. On top of that, if your list contains sole traders, their names and phone numbers are personal data, and the GDPR requires you to have a legal basis, to inform them and to respect their right to object. The safest approach is to visit or call, and ask permission before sending anything in writing.

One note before we go on: this is a practical guide written by the people behind Coworky, not legal advice. It summarises the general framework and points out where there are doubts. If you're planning something large, such as an automated campaign or a big database, talk to a lawyer or your accountant first.

Three laws, three different things

Much of the confusion comes from mixing up rules that cover different things. Three matter here:

• The LSSI (Law 34/2002 on information society services) regulates commercial communications by electronic means: email, but also SMS, WhatsApp and anything equivalent. Its article 21 is the one that bans sending them without permission.
• The General Telecommunications Law (Law 11/2022) regulates commercial phone calls. Its article 66 recognises the right not to receive unwanted calls for commercial purposes.
• The GDPR and the LOPDGDD (Spain's organic data protection law, 3/2018) regulate what you do with personal data: storing it, using it, telling people about it and deleting it. They apply to every channel, including an in-person visit, because they affect the list you've saved.

The fact that there are three explains something that puzzles many people: you can comply with one and break another. Having a legal basis to store a sole trader's phone number (GDPR) doesn't give you permission to email them (LSSI). They're different questions and need separate answers.

Channel by channel

Here's the summary. Each row is explained below.

Email: the clearest rule and the most ignored

Article 21 of the LSSI bans sending promotional communications by email, or by another equivalent electronic means, that the recipient hasn't requested or expressly authorised. Put plainly: if they haven't asked you to write to them, don't.

What surprises most people is that this applies between companies too. The LSSI doesn't distinguish between an individual and a company, and the Spanish Data Protection Agency (AEPD) has applied it to messages sent to companies. "It's a company email, not a person's" won't protect you.

Some ideas that go around and don't hold up:

• An email published on their website isn't permission. It's there so customers can write to the business, not to receive offers. The fact that Coworky, or any tool, picks it up from the business's site doesn't change that.
• An unsubscribe link doesn't replace consent. It lets someone who gave you permission withdraw it, but it doesn't make the first message lawful.
• Sending just one doesn't make it fine. What's banned is the unsolicited communication, not the persistence.
• The existing-customer exception isn't yours. The law allows you to write without express permission to someone who is already your customer, offering products or services similar to the ones they bought, with an easy way to object in every message. Someone you haven't sold anything to yet doesn't qualify.

As for the consequences, the LSSI itself classes these messages as a minor infringement, with fines of up to €30,000, and as a serious one when they're mass mailings or when more than three communications a year are sent to the same recipient, with fines that can reach €150,000. Penalties imposed on small businesses tend to be lower, but the fine isn't the only problem: it's the case file, the time it takes, and what it says about you when your first contact with a potential client is an infringement.

One in-between case is the contact form on their website. If you use it to slip in an offer, you're sending them a commercial message by electronic means. There's no express rule for that situation, but the prudent reading is to treat it as an email.

WhatsApp, SMS and direct messages

The law talks about "another equivalent means of electronic communication", and that covers SMS, WhatsApp, Telegram and direct messages on Instagram or Facebook. The AEPD has fined commercial messages sent over WhatsApp without consent, so this isn't a loophole you can use.

Many people think that because the WhatsApp number is the one the business publishes to deal with customers, it's fine. It isn't, for the same reason as email: that number is there for customers to use.

LinkedIn connection requests with a sales pitch attached are less clear. There's no specific doctrine, but the prudent view is that if the message is commercial and wasn't asked for, it counts like the rest.

Phone: the grey area

Here the rule is different and less clear-cut. Article 66 of the General Telecommunications Law recognises the right not to receive unwanted calls for commercial purposes, unless there is prior consent or the call can rely on another GDPR legal basis. The AEPD published its Circular 1/2023 in 2023 to clarify how it applies.

In practice, calling someone who hasn't consented is only possible if you can defend that you have a legitimate interest that doesn't weigh less than that person's right to be left alone. It's an assessment you make yourself, and it's the one that can end up being questioned if someone complains. There's no single answer, which is why it's a grey area. What does help you defend it is calling in a way that doesn't annoy and that makes sense:

• Call the number the business publishes, during business hours, not their personal mobile.
• Have a specific reason for calling that business and give it in the first sentence: "I'm calling because I noticed your website doesn't display well on a phone". A generic call to a whole industrial estate is harder to defend.
• Ask if it's a good time and, if they say they don't want calls, note that they shouldn't receive any more from you and respect it.
• If your list includes sole traders, check the Robinson List first. Article 23 of the LOPDGDD obliges you to check advertising exclusion systems before doing direct marketing, and not to process the data of anyone who has objected. Besides the Robinson List there's a second system approved by the AEPD, so look at its website for the list of systems currently in force.

In-person visit: the route almost nobody uses

None of the three rules bans walking into a business and introducing yourself. It's the only channel where no prior permission is needed, and with neighbourhood businesses it's usually the one that works best: the owner sees your face, understands in ten seconds who you are and can say yes or no there and then.

You need some tact. Pick the quietest time (mid-morning in a shop, between services in hospitality), introduce yourself in one sentence, be clear about what you're proposing and take a "not now" with a smile. If they say no, you leave and make a note. The GDPR only comes into play through what you write down afterwards.

Postal letter

It's the least-used channel and the one that raises the fewest legal problems, because the LSSI doesn't apply to paper mail. The GDPR and the exclusion systems still apply. A short, personalised letter, with something specific you've noticed about their business ("your website takes seven seconds to open on a phone") and a line letting them ask not to receive more, gets a better response than you'd expect. It does cost more and take longer than an email, which is precisely why few people use it.

What happens with the data in your list

Even if you contact someone through a permitted channel, the list you've built has its own rules. The GDPR protects only people, not companies, and that creates three cases:

• A company (SL, SA). The business's own data, such as its registered name or its general phone number, isn't personal data. The details of the specific people who work there, such as the manager's name or their corporate email, are.
• A sole trader. Their name, their phone number and their business name, which is often their own name, are personal data. Article 19 of the LOPDGDD presumes it lawful to process the contact data of sole traders when it refers to them only as professionals and in order to deal with them in that capacity. That presumption has a limited scope: it doesn't cover whatever you feel like doing with that data.
• A contact person. If you note down the name and mobile number of a restaurant's manager, that's personal data even if the restaurant is a company.

To store them on a reasonable legal basis, the usual one in commercial prospecting is legitimate interest. That requires you to be proportionate and to meet a few basic obligations that almost nobody meets:

1. Inform. If the data didn't come from the person themselves, article 14 of the GDPR requires you to tell them who you are, why you're processing it, where you got it and how to exercise their rights. This has to be done at first contact and, in any case, within a month. On a visit or a call, a single sentence and an offer to give more information if they want it is enough.
2. Keep the minimum. The business name, the phone number it publishes, the reason you're contacting it, the date and the outcome. Nothing more is needed.
3. Honour the "no". If someone objects or asks you to delete their data, do it. A practical detail: it's worth keeping a minimal list of your own of "do not contact", so you don't bother anyone again by mistake. Its purpose is precisely to respect their objection, and the logic of exclusion lists points in the same direction.
4. Delete what you no longer need. A list from three years ago with no contact since isn't kept "just in case".

Where you get the data matters. Google Maps data has its own terms of use, which prohibit storing its content outside its services (which is why Coworky keeps only the identifier of each listing). And databases bought as "with verified emails" are the riskiest case: you don't know where the data came from or whether anyone gave permission for it to be used, and the responsibility is yours, not the seller's.

How to get permission and keep a record of it

So far, what you can't do. What you can do is the most useful part: turn cold contact into authorised contact. The LSSI doesn't ban writing to someone who has told you to. What it bans is the first unrequested message.

So the sequence that works, and that's legal, has two steps. First you visit or call, and in that conversation, before you hang up or walk out the door, you ask something like this:

"I noticed a couple of things on your website that could be fixed without rebuilding it. Would you be happy for me to send them over on WhatsApp or by email so you can look at them at your leisure?"

If they say yes, you have express authorisation for that channel and for that subject. And then you can write:

"Hi Marta, it's Álvaro, who dropped by the shop this morning. As agreed, here's what I mentioned about the website. If you'd rather I didn't write again, just say so and I won't."

Two things make this actually work and keep it from being just a formula:

• Write it down. If someone ever asks you where you got their contact from, you need to be able to show they asked for it. One line in your notebook or your CRM is enough: date, the channel through which permission was given and what they agreed to receive.
• Write only about what they authorised. Being allowed to send a proposal doesn't mean you can add them to a newsletter list.

There are other ways to have the business take the first step, and they work better than you'd think when you sell local services: having your own website that explains what you do and offers something useful (a guide, a free analysis of their website (in Spanish)), looking after your Google listing, going to the local traders' association events and asking existing clients for recommendations. None of these will give you forty contacts in an afternoon, but the contacts that arrive this way come with permission included.

What changes when you prospect with Coworky

Coworky doesn't change the law, but it does make it easier to work within it. You search for a sector in a town or postcode, the tool brings you up to 20 businesses, checks the websites of the ones you choose and gives you an opportunity score and, if you want, a report with the first-call script. Three details matter here:

• It doesn't send emails or messages for you. That's a design decision: the tool tells you who to visit or call first and what to say, and the sending is up to you once there's permission.
• It collects the contacts the business publishes on its website, and we've seen that this isn't permission to write to them. Use them to call or to know who to ask for when you walk in, not for a campaign.
• Each contact comes with a specific reason, based on what has been checked on their website. That makes your call or visit make sense to that person, and a specific, proportionate, reasoned contact is far easier to defend than a call to a whole directory. It's not a legal guarantee, but it points in the right direction.

You can try it for free, with no card, with 3 searches and 10 analyses. Paid plans start at €19 a month plus VAT. The details are on the pricing page (in Spanish), and to prepare what you're going to say, the cold call script generator (in Spanish) is free.

The mistakes that come up most

Thinking that anything published is free to use. A phone number, email or profile that someone has published for their customers to use isn't an invitation to receive advertising.

Believing that an unsubscribe link fixes everything. It's required on the messages you are allowed to send, but it doesn't make the first one lawful.

Thinking a small business goes unnoticed. A single recipient complaining to the AEPD is enough for a case to be opened, and a sole trader who receives a commercial message on their business mobile has every reason to do so.

Buying a database and trusting the seller. If the seller tells you it's "GDPR compliant", it's you who answers to the AEPD when you use it.

Keeping the data forever. An old list with no recent contact is a liability, not an asset.

Trusting that "everyone does it". It may well be true, but it doesn't change what happens when someone complains.

Before your first contact

A quick check that avoids almost every problem:

1. Is it a visit, a call or a letter? If it's an email or a message, do you have that person's express permission?
2. Do you have a specific reason for contacting that business, and can you explain it in one sentence?
3. If there are sole traders on the list, have you checked the Robinson List?
4. Do you know what you'll say about who you are and where you got their contact?
5. Do you have somewhere to record the outcome and the permission, and a "do not contact" list?
6. Are you going to keep only what's necessary?

If you can answer yes to all of it, you're in a very solid position. And if what you want is a complete method for finding and contacting businesses, start with the guide to winning clients among local businesses (in Spanish) and, once you know who to talk to, take a look at how much to charge for a website (in Spanish) and how to tell if a business needs a new website (in Spanish).

Frequently asked questions

Can I send a commercial email to a company I don't know?

Not unless they have asked for it or authorised it first. Article 21 of the LSSI bans unsolicited commercial electronic communications and it applies when the recipient is a company too. The exception is when they're already your customer and you offer products or services similar to the ones they bought.

Can I write to the info@ email shown on a business's website?

If the message is commercial, no. The fact that the email is published on their website isn't consent to receive advertising: it's there so their customers can get in touch. The right approach is to ask permission first, in person or by phone.

Does an unsubscribe link let me send the first message?

No. The unsubscribe link is required in commercial messages sent with permission, but it doesn't replace consent. Without prior permission, the first message is already an infringement even if it includes the link.

Is it legal to call a sole trader to offer my services?

It's a grey area. The General Telecommunications Law requires prior consent or another GDPR legal basis for commercial calls, and the AEPD has published criteria in its Circular 1/2023. In practice, calling the number the business publishes, with a specific reason and respectfully, is defensible as legitimate interest, but it's an assessment you must be able to justify. Check the Robinson List first and don't push if they say no.

Can I send a message on LinkedIn, Instagram or WhatsApp?

The prudent reading is that they count as electronic communications equivalent to email, so if the message is commercial and wasn't requested, article 21 of the LSSI bans it. The safe route is to ask permission first in a conversation and then write only about what they've authorised.

What fine can I get for sending commercial emails without permission?

Under the LSSI, the infringement is minor and can be penalised with up to €30,000. It's serious, with fines that can reach €150,000, if the mailing is mass or if more than three communications a year are sent to the same recipient. The exact amount depends on each case.

What is the Robinson List and do I have to check it?

It's an advertising exclusion system that people sign up to if they don't want to receive marketing. Article 23 of the LOPDGDD obliges you to check these systems before doing direct marketing and not to process the data of anyone who has objected. It matters mainly if your list contains sole traders, who are natural persons. The AEPD has also approved a second system, so check its website for the list currently in force.

Can I visit a business without warning?

Yes. None of these rules bans walking into a business to introduce yourself. Choose a quiet time, introduce yourself in one sentence and accept a "no" without pushing. The GDPR only applies to the data you note down afterwards.