Quick answer
Yes, in most cases. Latvia's Law on Information Society Services and Estonia's Electronic Communications Act both let you email a company address without asking first, under different conditions. Estonia requires a working opt-out in every message. Latvia's statute does not name that requirement, only bans an invalid reply path and ignoring a refusal. This is not legal advice.
Is cold email legal in Latvia or Estonia?
I plan outbound lists by country for clients selling across the Baltics and the Nordics, with 2000+ meetings booked for B2B clients along the way, and Latvia and Estonia come up together constantly because people assume the three Baltic states share one rulebook. They don't, and the gap between them is bigger than most people expect. For a company's own email address, both Latvia and Estonia already let you send a first message without consent, a position Lithuania only reached on 22 April 2026 when it rewrote Article 81 of its own Law on Electronic Communications. Estonia has run an opt-out model for business contacts since at least 2012. Latvia's version is older still and, in one respect, looser than either neighbor.
None of that means anything goes. Each country still protects natural persons, still expects an honest sender identity, and still sits underneath GDPR for the separate question of whether you may hold the contact's data at all. The two national rules below answer only one narrow question: do you need the recipient's permission before the first email lands.
Latvia's rule: no consent for a company address
Latvia's Informācijas sabiedrības pakalpojumu likums (Law on Information Society Services) bans sending a commercial message by email, automated dialling or fax without the recipient's prior, free and unambiguous consent in Article 9, paragraphs 1 through 3. Paragraph 6 of that same article then does the one thing that matters for a B2B sender: it states plainly that the bans in paragraphs 1 to 3 apply to sending commercial messages to natural persons. A legal entity, a registered company, is not covered by that consent requirement at all.
What does still apply, to every recipient regardless of type, is paragraph 4: you cannot use an invalid email address or phone number that blocks the recipient from requesting you to stop, and you cannot ignore a recipient's refusal of further messages once it arrives. So the honest summary is narrower than "anything goes": Latvia drops the upfront permission requirement for a company's own address, but still makes it illegal to send from a dead-end reply path or to keep mailing someone who already told you to stop.
What this does not include. Unlike Lithuania's amended Article 81 and Estonia's Section 103, Latvia's Article 9 does not itself write in a requirement to carry a clear, free opt-out mechanism in every message to a company. I build one into every sequence anyway, since it costs nothing and removes the argument entirely if a recipient ever complains to Latvia's consumer regulator.
The law and the regulator behind it in Latvia
Two different Latvian authorities sit on this from two different angles. The Patērētāju tiesību aizsardzības centrs (PTAC, Consumer Rights Protection Centre) is the body named in the Law on Information Society Services for supervising commercial communications, the rule covered above. The Data State Inspectorate, Latvia's separate data protection authority, handles the GDPR side: whether you had a lawful basis to collect and hold the contact's data in the first place, a question Article 9 does not answer either way. A complaint about an unwanted sales email in Latvia can land with either body depending on what exactly the complaint is about, consent to send versus lawful use of the data.
Estonia's rule: opt-out was already the default
Estonia's position is closer to where Lithuania landed in April 2026 than to Latvia's lighter touch. Under Section 103 of the Electronic Communications Act, a natural person's electronic contact data can only be used for direct marketing with their prior consent. A legal person's contact data is a separate case: no prior consent is required, but the sender must give a clear and understandable way to refuse further use of the contact data, free of charge, every time the contact data is used, and that refusal has to be exercisable through the electronic communications network itself, not by phone or post only.
That opt-out duty is not a suggestion. The Estonian Data Protection Inspectorate's own guidance on this section states it directly as one of three conditions that apply to any direct marketing message regardless of recipient type: the sender must be identifiable, the message must be clearly marketing, and the recipient must be told how to refuse. For a company address specifically, meeting that bar removes the need for consent altogether.
The law and the regulator behind it in Estonia
The Andmekaitse Inspektsioon's own guidance document on using electronic contact data for direct marketing, first issued in 2012 and last updated 20 February 2015, is still the reference I checked for this piece on 23 October 2026, and it lays the rule out as a straight fork: natural persons need prior consent under Section 12 of the Personal Data Protection Act, legal persons don't, provided the opt-out condition above is met. The same guidance puts the regulator's own maximum non-compliance levy for ignoring an enforcement order at 9,600 euros, separate from whatever GDPR fine might apply if the underlying data processing itself is the problem rather than just the marketing message.
How this compares with Lithuania's 22 April 2026 rule
Lay the three side by side and the real story is that Lithuania didn't invent anything new on 22 April 2026, it closed the gap with two neighbors that had already made the same call, one of them over a decade earlier.
| Latvia | Estonia | Lithuania (since 22 Apr 2026) | |
|---|---|---|---|
| Default rule for a company email | No prior consent needed | No prior consent needed | No prior consent needed |
| Opt-out named as a requirement in the statute | Not specifically, only a ban on ignoring one already received | Yes, in every message, usable through the network itself | Yes, in every message |
| Role address (info@) | Treated as the company's, no consent needed | Treated as the company's, no consent needed | Treated as the company's, opt-out required |
| Who enforces it | PTAC for the send rule, DVI for GDPR | Andmekaitse Inspektsioon | VDAI |
The practical effect for a team running one sequence across all three markets: the legal floor is close enough to treat the region as one list operationally, as long as the message itself carries a working opt-out regardless of which specific statute does or doesn't demand one. Building to Estonia's and Lithuania's bar by default means Latvia's lighter rule is automatically satisfied too.
Which addresses actually count as a company's
Both countries draw the same first line: an address that belongs to the company rather than a named individual, think info@, sales@ or a generic company@domain, is a legal entity's contact data in either jurisdiction, no further test needed. A named personal address unrelated to any employer, firstname.lastname@gmail.com for example, is a natural person's address in both. The harder case is a named work address, firstname.lastname@company.com, and this is where Estonia's own guidance goes a step further than anything I found written into Latvia's statute or PTAC's page.
| Address or scenario | Estonia's test |
|---|---|
| info@company.ee, sales@company.ee | Company's contact data, no consent needed |
| Named address, pitch matches the person's actual buying authority | Treated as the company's contact data |
| Named address, pitch unrelated to their role (e.g. a procurement manager invited to a concert) | Treated as the individual's contact data, consent needed |
| Personal address registered in the company's own commercial register entry | Treated as the company's contact data |
I haven't found Latvia's own guidance drawing that same role-relevance line for a named work address, so until a Latvian court or PTAC publishes something more specific, I'd apply the stricter Estonian-style test to any list that touches both countries rather than assume Latvia is automatically more permissive on this particular point.
Sole traders and freelancers: still natural persons
Both laws draw their line at the legal entity, and a sole trader operating under their own name is not one. The same split that Lithuania's amended Article 81 applies to individual entrepreneurs holds in Latvia and Estonia too: if the business isn't incorporated separately from the person running it, the address belongs to a natural person in the eyes of each statute, and the stricter consent rule protects them regardless of how business-like their outreach topic is. A list that mixes incorporated companies with sole traders and freelancers needs that flag built in before any opt-out-only treatment gets applied.
Where GDPR still fits in
Article 9 and Section 103 each answer one question: may you send the message at all. Neither one answers whether you may hold and use the contact's email address as personal data in the first place, which is GDPR's separate job. For a relevant business contact, that basis is usually legitimate interest under GDPR Article 6(1)(f), which still expects a balancing test, a record of where the data came from, and an immediate stop once someone objects under Article 21. Removing the consent requirement from the national marketing statute doesn't touch that separate test, and it's the reason PTAC and the Data State Inspectorate in Latvia, or the single Andmekaitse Inspektsioon in Estonia, can both end up involved in the same complaint from different angles.
I cover this same GDPR layer across ten EU countries in is B2B cold email legal in the EU, which named all three Baltic states as a gap it left for later. Lithuania and now Latvia and Estonia close that gap.
LinkedIn and other channels
Both statutes are written around electronic communications services, specifically email, SMS, fax and similar network-based messaging, and neither one's guidance mentions LinkedIn. Estonia's own guidance even carves out phone calls by name as outside Section 103's scope, while covering SMS, MMS and email. Until a regulator or court says otherwise, a LinkedIn message into either country sits outside the specific rule this article covers, though LinkedIn's own platform policies still apply regardless. I treat a first LinkedIn touch into Latvia or Estonia with the same basic courtesy either way: short, relevant to the role, with an easy way to say no.
A checklist before you send into either market
- Confirm the subscriber is a legal entity, not a sole trader or freelancer trading under their own name, in both Latvia and Estonia.
- Treat a named work address by what the pitch actually relates to, the stricter Estonian test, rather than assuming every firstname.lastname@company address is automatically fair game.
- Put a clear, free, one-click opt-out in the message itself, in every send, even where Latvia's own statute doesn't name it as a requirement.
- Keep your reply path and sending domain valid, since Latvia's law specifically bans an address a recipient can't use to ask you to stop.
- Stop the moment a refusal arrives, and route it to suppression immediately rather than at the next list sync.
- Keep your GDPR legitimate interest basis documented separately, since neither national rule substitutes for it.
On the infrastructure side, the stack I run for clients sending across the Baltics is Mailforge and Infraforge for domains and mailboxes and Warmforge for warmup, mostly because keeping fewer moving parts in the sending layer leaves more attention for getting the list segmentation and the opt-out handling right. If the budget question matters more than the legal one for your planning, I keep a full cost model for the region in what B2B outbound costs in the Baltics.
Not legal advice. I'm a GTM consultant, not a lawyer. Every claim above links to the law itself or the regulator's own guidance so you can read the primary source directly. Have a Latvian or Estonian lawyer check your specific list and copy before a larger send, particularly where sole traders, freelancers or mixed B2B and B2C contacts sit in the same list.
Key takeaways
- Both Latvia's Article 9 and Estonia's Section 103 let you email a company's own address without prior consent, a position Lithuania only reached on 22 April 2026.
- Estonia names a clear, free, network-usable opt-out as a condition of that exception. Latvia's statute does not, it only bans an invalid reply address and ignoring a refusal already received.
- Estonia's own guidance draws a further line on named work addresses, based on whether the pitch matches the person's actual buying authority, a test I haven't found written into Latvia's rule.
- Sole traders and freelancers remain natural persons under both laws and keep the stricter consent requirement, the same split Lithuania's rule applies.
- GDPR still governs whether you may hold and use the contact's data at all, usually on legitimate interest, separately from either country's send permission.
FAQ
Is cold email legal in Latvia?
Yes, for a company address. Article 9 of Latvia's Law on Information Society Services bans sending a commercial email without prior consent, but paragraph 6 of that article limits the ban to natural persons, so a legal entity's email address is outside it.
Is cold email legal in Estonia?
Yes. Section 103 of the Electronic Communications Act lets you use a legal entity's electronic contact data for direct marketing without prior consent, as long as every message gives a clear, free and easy way to opt out, enforceable through the electronic network itself.
Do I need consent to email a named employee at a Latvian or Estonian company?
Usually not, if the address is registered to the company rather than the person, the same info@ or firstname.surname@company test both countries use for a role or work address. Estonia adds one more layer: a named address tied to someone's personal buying authority over the product being marketed can still count as a company address, while the same address for an unrelated pitch is read as a personal one.
Does Latvia or Estonia require an opt-out link the way Lithuania's new rule does?
Estonia does, explicitly, in every message. Latvia's statute does not name an opt-out mechanism for a company address the way Lithuania and Estonia do, it only bans an invalid reply address and ignoring a refusal once one arrives, which is a lower bar worth building a real opt-out into anyway.
Does GDPR still apply if consent isn't required under these laws?
Yes. Both laws only decide whether you may send the message. GDPR separately decides whether you may hold and use the contact's data at all, usually on legitimate interest under Article 6(1)(f), a test these national rules do not replace.