Is Cold Email Legal in Denmark? What Markedsføringsloven §10 Actually Requires

What §10 actually bans

I run cold email and LinkedIn as one sequence for B2B clients, and Denmark is the one market in my patch where I tell a founder to slow down before the first send rather than after a complaint. The short answer: not without consent. Markedsføringsloven, the Marketing Practices Act, consolidated as LBK nr 866 of 15 June 2022, sets the rule in its Section 10, first paragraph: "En erhvervsdrivende må ikke rette henvendelse til nogen ved brug af elektronisk post, et automatisk opkaldssystem eller telefax med henblik på direkte markedsføring, medmindre den pågældende har givet sit forudgående samtykke hertil." In plain English: a business may not contact anyone by electronic mail, an automatic calling system or fax for direct marketing unless that person has given consent in advance.

The word doing the work is "nogen", anyone. There is no carve-out for companies, no volume threshold, and no grace period for a first message. The consent has to exist before you send, not get assumed because nobody has complained yet. Before someone gives that consent, they also have to be told they can withdraw it, and withdrawing has to be free and easy, a requirement the statute states directly rather than leaving to guidance.

Why every address counts, info@ included

Every other Nordic market I write about draws a line between a person's own address and a company's generic one. Denmark does not. The Consumer Ombudsman's own spam guidance states plainly that the ban applies to every recipient, and that it makes no difference whether a message goes to a general mailbox such as info@virksomhed.dk or to a named director's personal address. Businesses writing to other businesses need the same prior consent a consumer campaign would, with no quieter path through a role inbox.

The existing customer exception, condition by condition

Section 10's second paragraph carves out one path that does not need fresh consent, but all three conditions have to hold at the same time:

A true cold prospect never clears the first condition, since there was never a sale to collect the address from. This exception exists to let a business keep selling adjacent products to people who already bought something, not to open a new account.

What counts as electronic post: LinkedIn included

This is the part most compliance checklists skip, and it matters if a sequence runs LinkedIn next to email the way mine does. The Consumer Ombudsman's guidance treats marketing sent through private messages and notifications on social media as covered by the same Section 10 ban, while a public post in a news feed sits outside it. A cold LinkedIn pitch into a Danish inbox is, for this purpose, functionally the same unsolicited contact an email would be, and needs the same prior consent.

That is a meaningfully stricter starting point than the rest of the region. I cover Norway's lighter stance, where no ruling has settled whether a LinkedIn message counts as regulated marketing at all, in is cold email legal in Norway, and Sweden gives direct messages their own opt-out rule rather than Section 10's opt-in one, which I go through in is cold email legal in Sweden. Denmark gives LinkedIn no separate, lighter category.

You cannot email to ask for permission either

The obvious workaround, send one short email asking if it is okay to send more, does not hold up. That first email is itself direct marketing contact made without prior consent, so it is already the violation the law is written to stop. Consent under Section 10 has to come from somewhere the ban does not reach: a form on your own site that a visitor fills in, a conversation that starts at an event or through a referral, or an inbound inquiry the prospect initiates. There is no compliant version of the cold opener itself in Denmark, only compliant ways to get to the point where an opener is no longer cold.

Where GDPR and Datatilsynet fit in

Denmark is an EU member, so GDPR runs alongside the Marketing Act, enforced domestically by Datatilsynet, the Danish Data Protection Agency. The two rules answer different questions. The Marketing Act decides whether you are allowed to send the message at all. GDPR decides whether you have a lawful basis to hold and process the contact's address as personal data in the first place. Datatilsynet's own guidance on direct marketing, published June 2023, treats legitimate interest as a workable basis for this kind of processing, but only after a documented balancing test weighing the business's interest against what the contact could reasonably expect, the same kind of test I go through for the rest of the EU in is B2B cold email legal in the EU. Passing the Marketing Act's consent test does not clear the GDPR bar on its own, and the two have to be satisfied together, with processing stopped the moment someone objects regardless of what either rule separately requires.

What breaking the rule actually costs

Forbrugerombudsmanden, the Consumer Ombudsman, calculates fines for spam violations on a published model: up to 100 unlawful messages brings a flat 10,000 kroner, and anything beyond that adds 100 kroner per message, a scale confirmed in the Ombudsman's own settled cases, including one business that paid an administrative fine of 10,000 kroner for exactly that threshold.

Courts have gone well past that floor. A training company was fined 800,000 kroner for sending more than 38,500 unsolicited marketing emails between January 2014 and April 2015, a figure the court scaled down from the strict per-message calculation to avoid a disproportionate total, and it stood at the time as the largest fine a Danish court had handed a company for this. Liability does not stop at the company either: when one spam operation's business entity had already gone bankrupt, the Ombudsman pursued its former director personally and secured a 50,000 kroner fine over 369 messages.

Denmark next to Norway, Sweden and Finland

Norway's consumer marketing statute happens to share Denmark's exact name, Markedsføringsloven, which makes the contrast between the two worth stating plainly: same name, close to opposite outcome for a role inbox. Here is how the four markets line up:

The practical read: Norway, Sweden and Finland all leave a role-address-first list strategy workable while the named-contact question gets resolved separately. Denmark removes that option entirely, consent gates every address and every channel from the first message, which is why I treat it as the strictest of the four rather than a variation on the same theme. I keep the cost side of this same regional comparison, wages and employer costs rather than legal exposure, in what B2B outbound actually costs in the Nordics.

What actually works when you sell into Denmark

Given where the line actually sits, here is what I build into a Danish plan instead of a cold send:

• Collect consent through a channel the ban does not reach. A form on your own site, a gated resource, a webinar sign-up, anything the prospect initiates themselves clears the consent requirement cleanly.
• Use warm introductions and referrals as the real opener. A second-degree connection or a customer referral is not Section 10 marketing contact at all, since nobody is sending an unsolicited message.
• Post in the feed, do not message cold. Public LinkedIn content builds the kind of awareness that gets a prospect to message you first, which flips who initiated the contact.
• Lean on events and partners for the first real conversation. A business card exchanged in person or an intro from a partner both happen outside electronic marketing entirely.
• Once consent exists, run the account like any other. My own first emails still run 30 to 40 words with one concrete problem and one concrete offer, the same discipline I bring to every market. Into Denmark, that discipline just starts one step earlier: the message cannot exist until the consent does, so the real work happens before the first word is written, not in how that word is phrased.

A checklist before you send into Denmark

1. Confirm documented, affirmative consent exists before the first email or LinkedIn message, not just an absence of a refusal.
2. Treat info@, sales@ and named addresses identically. None of them are exempt here.
3. Never send a message just to ask for consent. Collect it through a form, referral or event instead.
4. If relying on the existing customer exception, check all three conditions at once: your own prior sale, a similar product, and a standing opt-out offer.
5. Document the GDPR legitimate-interest balancing test Datatilsynet's guidance expects, as a separate step from the Marketing Act question.
6. Log consent, objections and opt-outs for every address, since Danish enforcement counts messages sent, not intentions.

FAQ