Quick answer
Yes, mostly. Since 22 April 2026, Article 81 of Lithuania's Law on Electronic Communications lets you email a company, named work addresses included, without asking first. Every message still needs a working opt-out, you must stop the moment someone refuses, and the regulator recommends keeping a record that they did. This is not legal advice.
Is cold email legal in Lithuania now?
I run cold email and LinkedIn outreach as one sequence for B2B clients across the Baltics and the Nordics, with 2000+ meetings booked for clients along the way, and Lithuania used to be the market where I told people to slow down. Not anymore, for one specific kind of contact. On 22 April 2026, an amendment to Article 81 of the Law on Electronic Communications took effect, and Lithuania's data protection authority, VDAI, confirms it was built to simplify how businesses contact other businesses.
The amended Article 81(1) now reads, in the regulator's own quoted version: using electronic communications services for direct marketing, including sending email, is allowed only with the subscriber's prior consent, except when the subscriber is a legal entity, in which case no such consent is needed, but a clear, free and easily exercisable way to opt out of further messages has to exist. That single change flips the default for company contacts from opt-in to opt-out.
Before and after 22 April 2026
The shift is easiest to see side by side. Nothing about natural persons changed, the entire amendment is scoped to subscribers who are legal entities.
| Before 22 April 2026 | After 22 April 2026 | |
|---|---|---|
| Emailing a company contact | Needed prior consent | No prior consent needed |
| Named work address (e.g. vardas.pavarde@imone.lt) | Treated like any address needing consent | Same opt-out rule as a generic company address |
| Opt-out in the message | Good practice, not a stated requirement | Required by Article 81(1) in every send |
| Legal basis | Article 81(1), prior wording | Article 81(1), amended by the law published 21 April 2026 |
Which addresses count as a legal entity contact?
VDAI's own guidance, a question and answer document dated 19 May 2026, walks through this with examples rather than leaving it abstract. A message to a public company contact pulled from the Register of Legal Entities or a job listing, a named employee address like vardas.pavarde@imone.lt, and a generic inbox like info@imone.lt are all treated the same way: fine to email for direct marketing without prior consent, as long as the opt-out requirement is met. The test is whose line it is, the company's or the person's, not whether the address looks personal.
One boundary matters more than it looks. The exception only applies when the registered subscriber of the email or phone service is itself a legal entity. A sole proprietor trading under their own name is still, in the law's terms, a fizinis asmuo, a natural person, so the old consent requirement still protects them even though they run a business. If your list mixes incorporated companies with sole traders and freelancers, that split now decides which rule applies to each row.
For list building. A data source that resolves everyone to a named person doesn't create a new problem in Lithuania the way it does in Norway or Germany, provided the person's employer, not the person, is the account holder for that address. Build the sole-trader flag into your enrichment step so those rows keep the stricter, consent-first treatment.
What you still have to do before you send
The amendment removed one requirement, it did not remove the rest of the obligations around sending. Every message into a Lithuanian company still needs a clear, free and easily exercisable opt-out, in the message itself, not buried in a privacy policy three clicks away. VDAI's guidance is specific that this applies to every message, not just the first one in a sequence.
It also still needs the basics any compliant send already carries: an accurate sender identity, a working reply path, and content that is actually marketing rather than disguised as something else. None of that is new to the April 2026 change, it's just what remains once the consent step is gone.
Who can refuse, and how fast you must stop
VDAI's guidance names two people who can end the conversation: the company's management or its authorised representative, and separately, the specific employee the contact data belongs to, whether or not their name appears in the address. A personal phone number an employee has agreed to use for work counts the same way. Either one saying no is enough, and the law's own phrase is that you must stop "without unreasonable delay," not at the next list sync or the next campaign.
The guidance also recommends, rather than strictly mandates, keeping evidence that a refusal happened: the date, the address and the channel. In practice that's the same suppression discipline GDPR already expects you to run, just with Lithuania's own trigger for when the clock starts.
Where GDPR still fits in
Article 81 answers one question: may you send the message at all. GDPR answers a different one: do you have a lawful basis to hold and use the person's email address as personal data in the first place. For a relevant business contact, that basis is usually legitimate interest under GDPR Article 6(1)(f), which still asks you to pass a balancing test, say where the data came from, and stop when someone objects. Removing the consent requirement from Article 81 doesn't touch that test. VDAI is also Lithuania's data protection authority, so the same regulator sits on both sides of this.
I cover the GDPR side of this across ten EU countries, Lithuania not among them until now, in is B2B cold email legal in the EU, where that article names the three Baltic states as a gap it leaves for later. This closes that gap for Lithuania specifically.
The part of the law that did not change
Article 81(2) sits right next to the amended paragraph and covers a different situation entirely: a business that collects a customer's email address in the course of a sale, where that customer is a natural person, can keep marketing its own similar products to that address, as long as the customer gets a clear, free opt-out at collection and in every later message, and hasn't already objected. VDAI's guidance says this paragraph only got an editorial update to align its wording with GDPR Article 21, the substance is the same soft opt-in rule that existed before.
The two paragraphs don't overlap. 81(1) is about a cold message to a company. 81(2) is about a warm message to a person who already bought from you. If your campaign is a renewal nudge to a named individual who is an existing customer, you're still working under the older, narrower rule, not the opening this article is about.
Lithuania next to Germany and Norway
Lithuania now sits with the more permissive half of the countries I check before a campaign, closer to France, Ireland, Sweden and Finland's opt-out treatment of company contacts than to Germany's, which I cover in is cold email legal in Germany, or Norway's named-individual test, covered in is cold email legal in Norway.
| Lithuania | Germany | Norway | |
|---|---|---|---|
| Default rule for a company email | Opt-out, no prior consent | Prior consent, no company exemption | Prior consent, but only for named individuals |
| Role address (info@) | Opt-out is enough | Still needs consent | Outside the rule entirely |
| Named employee address | Opt-out is enough | Needs consent, same as any address | Needs consent, same as a private address |
| Who enforces it | VDAI | Civil claims: recipients, competitors, associations | Forbrukertilsynet, administrative fines |
The practical upshot for a team selling across the region: a single Lithuania list and a single Germany list can no longer run the same playbook. Lithuania now rewards volume to role and named addresses alike, provided the opt-out works. Germany still punishes exactly that.
A 5 step playbook for your list
If you already had a Lithuania list built under the old rule, here's the order I'd work through it in:
- Split the list by subscriber type first. Flag sole traders and freelancers separately, since they keep the old consent requirement. Everyone else incorporated moves to the new rule.
- Put a one-click opt-out inside the template itself, not just in a footer link to a global preference centre, for every sequence that reaches a .lt domain.
- Route refusals to a suppression list that actually blocks sending, not a reply folder nobody checks, since the obligation is to stop without unreasonable delay.
- Log the refusal when it happens: date, address, channel. VDAI recommends keeping this evidence, and it's the same discipline your GDPR legitimate interest file already needs.
- Leave Article 81(2) contacts alone. If the address belongs to someone who already bought from you directly, that's the older soft opt-in rule, not this one, and the conditions are different.
LinkedIn and other channels
Article 81 is written around "electronic communications services," and VDAI's own examples stop at email, SMS and phone calls, the services the Law on Electronic Communications actually regulates. Neither the amendment nor the regulator's guidance says anything about LinkedIn messaging, which doesn't run over those networks. Until that changes, I treat a LinkedIn message into Lithuania the same way I'd treat any first outreach: short, relevant to the person's role, and with an easy way to say no, whether or not a specific law requires it on that channel.
What actually works now
Easier legal access doesn't mean a lazier message does better, it just means more of your list is reachable without a consent step slowing the rollout. A few things I'd still hold onto:
- Keep the first message short and specific. My own first emails run 30 to 40 words with one concrete problem and one concrete offer, a habit that predates this law change and has nothing to do with it.
- Build the opt-out into the send, not just the unsubscribe footer. A line in the body that names what you're offering and how to decline it reads as more honest than a footer nobody scrolls to.
- Treat the bigger reachable list as a reason to segment harder, not to blast wider. More addresses you can legally email are only useful if the targeting underneath them still holds.
- Mind your sending infrastructure as volume grows. For domains, mailboxes and warmup, the stack I run for clients is Mailforge and Infraforge for the infrastructure and Warmforge for warmup, mostly because fewer moving parts means fewer things that break a sequence mid campaign. Personalization still earns the reply once the legal gate is gone, and I keep what I'd reach for in best cold email personalization tools.
If the budget question comes before the legal one in your planning, I keep a full cost model for running outbound across the region in what B2B outbound costs in the Baltics, built on Lithuania's own wage and on-cost data.
A checklist before you send
- Confirm the subscriber is a legal entity, not a sole trader or freelancer operating under their own name.
- Put a clear, free, one-click opt-out in the message itself, every time, not just on the first touch.
- Know who can refuse: company management or the named employee the address belongs to, either one ends it.
- Stop without unreasonable delay once a refusal arrives, and route it to suppression immediately.
- Keep a record of the refusal: date, address, channel.
- Keep your GDPR legitimate interest basis documented separately, Article 81 doesn't substitute for it.
Not legal advice. I'm a GTM consultant, not a lawyer. Every claim above links to the law itself or VDAI's own guidance so you can read the primary source directly. Have a Lithuanian lawyer check your specific list and copy before a larger send, particularly where sole traders or existing customers are mixed into the same list.
Key takeaways
- Since 22 April 2026, Article 81(1) of Lithuania's Law on Electronic Communications no longer requires prior consent to email a legal entity, named work addresses included.
- Every message still needs a clear, free, easy opt-out, and you must stop without unreasonable delay once the company's management or the specific employee refuses.
- Sole traders and freelancers remain natural persons under the law and still need prior consent, so split them out of any list you treat as opened up.
- Article 81(2)'s soft opt-in rule for a business's own existing natural person customers is unchanged and is a different rule from the one that moved.
- GDPR still governs whether you may hold and use the contact's data at all, usually on legitimate interest, separately from Article 81's send permission.
FAQ
Is cold email legal in Lithuania?
Yes, in most cases. Since 22 April 2026, Article 81(1) of the Law on Electronic Communications lets you email a legal entity, named work addresses included, without prior consent, as long as every message offers a clear, free and easy opt-out.
Do I need consent to email a named person at a Lithuanian company?
No, as long as the address is registered to the company rather than the individual, which covers the typical firstname.surname@company.lt work address VDAI uses as its own example. A sole trader operating under their own name is a different case and still needs consent.
What do I still have to do before sending into Lithuania?
Include a clear, free and easily exercisable opt-out in every message, stop without unreasonable delay once the company's management or the relevant employee refuses, and keep a record that the refusal happened, which VDAI's guidance recommends.
Does the April 2026 change apply to LinkedIn messages?
Not directly. Article 81 covers electronic communications services, email, SMS and phone calls, and neither the amendment nor VDAI's guidance mentions LinkedIn. I treat a LinkedIn message into Lithuania with the same courtesy regardless: an easy way to say no, honored right away.
Does GDPR still apply if consent isn't required anymore?
Yes. Article 81 only decides whether you may send the message. GDPR separately decides whether you may hold and use the person's email address, typically on legitimate interest under Article 6(1)(f), and that test didn't change on 22 April 2026.