Quick answer
Yes, with limits. Finland's Act on Electronic Communications Services lets you email a company's own address, info@ or sales@, without consent, under an opt-out model in Section 202. A named person's work address needs prior consent under Section 200 instead, unless a real existing customer relationship covers it. GDPR applies on top. This is not legal advice.
What the Act on Electronic Communications Services says
I run cold email and LinkedIn into the Nordics and the Baltics for B2B clients, and Finland is the market where the rule actually gives more room than most briefs assume. The statute is the Act on Electronic Communications Services (Laki sähköisen viestinnän palveluista, 917/2014), still referred to in older guidance by its original name, the Information Society Code. Two sections do the actual work, and they point in opposite directions. Section 200 bans direct electronic marketing, email included, to a natural person who has not given prior consent. Section 202 flips that for legal persons: direct marketing to an organization is allowed unless that organization has specifically refused it. Source: Finlex, Act on Electronic Communications Services, 917/2014.
That one distinction, natural person versus legal person, decides almost everything else below. There's no separate B2B carve-out beyond it, and no volume threshold that makes a first message to a named person safer.
Which addresses need consent: named contacts or company inboxes?
A generic inbox like myynti@yritys.fi or info@yritys.fi belongs to the organization, not a person, so Section 202's opt-out rule covers it: you can email it until the company says stop. A personal, name-based address on the same domain, say liisa.virtanen@yritys.fi, is a different case. Legal guidance on the Act is consistent on this point: a work address tied to a named individual is still that individual's address, so Section 200's prior-consent rule applies to it the same way it would to a private one, being listed as a company contact does not strip the protection.
A named address does get one narrower opening, and it's worth not overstating it. When a message is relevant to that person's job function, data protection guidance treats that as support for a GDPR legitimate interest basis for holding and using the contact's details, not a license to skip Section 200's consent requirement for sending. The two tests stay separate: one governs whether you can send the message at all, the other governs whether you're allowed to hold the address as personal data in the first place.
What this means for list building. A Finland list built from role inboxes, sales@, info@, hallinto@, sits inside Section 202's opt-out model from the start. The moment a data provider resolves those same companies down to named executives, the list moves into Section 200's consent requirement, address by address.
The existing customer exception, condition by condition
Section 200 lets a business keep marketing to an existing customer without fresh consent, but only when every condition below holds at once:
| Condition | What it means in practice |
|---|---|
| The address was obtained in connection with a sale | A completed purchase, not a free trial signup, a webinar registration or a form fill |
| The marketing covers similar products or services to what was bought | An adjacent offering, not the full catalogue and not a partner's product |
| The customer has not objected | One opt-out closes the door for good, across every tool sending on your behalf |
| The customer was told, at collection and in every later message, that opting out is free and easy | The notice has to be there from the first message, not added retroactively |
A cold prospect never satisfies the first condition, so a true first touch to a named person always needs prior consent rather than this exception. It's built for a renewal nudge or a related-product upsell to someone who already bought, not for opening a new account.
Where GDPR fits in next to the Act
Finland is an EU member, so GDPR applies on top of the Act, and the Office of the Data Protection Ombudsman, Tietosuojavaltuutetun toimisto, enforces both. The Act answers whether you can send the message at all. GDPR answers whether you have a lawful basis to process the contact's email address as personal data in the first place, usually legitimate interest under Article 6(1)(f) for a role-relevant B2B contact. See is B2B cold email legal in the EU for how that same legitimate interest test plays out across the other markets I track there. Passing the GDPR test does not clear Section 200's consent bar for a named individual. The two run side by side, and a campaign into Finland has to clear both before it goes out.
What a compliant opt-out actually requires
Every direct marketing message, whether it reaches a natural person under the existing customer exception or a legal person under Section 202, has to offer an easy, free way to opt out, and the business has to honor that request going forward. The Office of the Data Protection Ombudsman's own guidance adds a second requirement that's easy to miss: the message should let the recipient see where their contact details came from, since that's what actually lets them object at the source rather than just unsubscribe from one list. Source: Office of the Data Protection Ombudsman, FAQ on direct marketing.
What breaking the rule has actually cost in Finland
Enforcement is rare but not theoretical. In 2020 the sanctions board of the Office of the Data Protection Ombudsman imposed a EUR 7,000 administrative fine on Acc Consulting Varsinais-Suomi for sending electronic direct marketing without prior consent and for failing to honor the rights of the people it contacted, the clearest documented case of this specific violation I found. Source: Office of the Data Protection Ombudsman, 2020 sanction decision. A single case six years old isn't a reason to treat the rule as unenforced. It's a reason to assume most non-compliant mail into Finland simply hasn't been reported yet, not that it's safe to send.
Finland next to Norway, Lithuania and the rest of the EU
For the Baltic side of this same question, is cold email legal in Latvia or Estonia covers the opt-out model that Lithuania's own rule change extended on 22 April 2026. Finland's split lands closer to that Baltic opt-out default than to Norway's stricter named-person test:
| Finland | Norway | Lithuania (since Apr 2026) | |
|---|---|---|---|
| Company inbox, no name attached | Opt-out, Section 202 | Outside the rule entirely | Opt-out |
| Named individual's work address | Opt-in, Section 200 | Opt-in, Section 15 | Opt-out, name included |
| Who enforces it | Office of the Data Protection Ombudsman | Forbrukertilsynet | State Data Protection Inspectorate (VDAI) |
That middle row is the real surprise if you've already built a process around Lithuania's new rule: a named-contact list that's fully compliant for Lithuania since April is not automatically compliant for Finland, where the named-versus-role line still decides everything.
Is a LinkedIn message into Finland treated the same as a cold email?
I haven't found a Finnish court ruling on whether a LinkedIn message counts as the kind of direct marketing the Act covers, which puts Finland in the same position as Norway rather than Germany, where appeal courts have named LinkedIn directly (see is cold email legal in Norway for that comparison). The Act's own language covers electronic communication that reaches one person directly, a description a LinkedIn message fits as easily as an email. Until a Finnish case says otherwise, I treat a sales message on LinkedIn into Finland the same way I treat a cold email: fine once there's a role-relevant reason to send it, risky as a volume opener to named people who haven't engaged first.
What actually works when you sell into Finland
Given where the line actually sits, here's what I build into a Finland sequence rather than skip the market or ignore the rule. I run email and LinkedIn as one sequence for clients, and a Finland list splits naturally along the same line the Act draws: role inboxes carry the early volume, named contacts get a slower, warmer path through a reply, a connection, or a referral first. My own first emails run 30 to 40 words with one concrete problem and one concrete offer, short enough to stay inside what GDPR calls relevant processing even before Section 200 becomes the question that decides whether you can send to a named person at all. Whether that first message should run in Finnish or English is a separate call, covered in when native language cold email is worth it. On the budget side, what B2B outbound actually costs in the Nordics breaks out Finland's own TyEL-based employer cost separately from Sweden and Denmark, since the three countries don't share one number on price any more than they share one number on consent.
A checklist before you send into Finland
- Split every Finland list into role inboxes and named contacts before you touch Section 200 or 202, they run under different rules.
- For named contacts, confirm real prior consent or a genuine existing customer relationship under all four conditions, not just one or two.
- Give every message, role or named, an easy, free opt-out and honor it the same day, not at the next list sync.
- Disclose where the contact's details came from, not just how to unsubscribe.
- Record consent evidence for every named address the way you'd document a GDPR legitimate interest assessment.
- Treat LinkedIn messages the same as email until a Finnish ruling says otherwise.
Not legal advice. I'm a GTM consultant, not a lawyer. Every claim above links to the statute itself or the regulator's own guidance so you can check the primary source directly. Have a Finnish lawyer review your specific list and copy before a campaign into Finland, particularly where named contacts are involved.
Key takeaways
- Section 200 requires prior consent to email a named individual. Section 202 allows emailing an organization's own inbox unless it has specifically refused it.
- The existing customer exception needs a real sale, similar products, no objection and an opt-out notice from the first message. It never covers a true cold send to a new contact.
- GDPR applies on top through the Office of the Data Protection Ombudsman. Legitimate interest can justify holding a contact's details, it doesn't clear Section 200's consent bar for sending.
- Finland's named-versus-role line is stricter than Lithuania's post-April-2026 opt-out rule for named work contacts, so a Lithuania-ready list isn't automatically Finland-ready.
- The one documented fine found here, EUR 7,000 in 2020, points to enforcement being rare, not to the rule being unenforced.
FAQ
Is cold email illegal in Finland?
Not automatically. Section 202 of the Act on Electronic Communications Services allows direct marketing to an organization's own address unless it has specifically refused it. The consent requirement in Section 200 only applies to a named individual's address.
Can I email a named person at a Finnish company without their consent?
Only if a genuine existing customer relationship covers it under all four conditions in Section 200, or you accept the risk of a complaint to the Office of the Data Protection Ombudsman. A named work address is still that person's address under the Act, consent rule included.
Does GDPR let me skip Finland's consent rule for B2B contacts?
No. GDPR's legitimate interest basis under Article 6(1)(f) can justify holding a role-relevant contact's email address as data, but it doesn't substitute for the prior consent Section 200 requires before you send to a named person. The two tests run side by side.
Is a LinkedIn message to someone in Finland treated the same as a cold email?
There's no Finnish ruling on this yet, so I treat it the same way. The Act covers electronic communication that reaches one person directly, and a LinkedIn message fits that description as easily as an email.
What happens if I send unsolicited cold email into Finland?
The Office of the Data Protection Ombudsman can investigate a complaint and issue an administrative fine. In the one documented case found here, a company was fined EUR 7,000 in 2020 for sending direct marketing without consent and for failing to honor recipients' rights.