Quick answer
Not freely. Section 15 of the Marketing Control Act (markedsføringsloven) bans unsolicited electronic marketing to a named individual without prior consent, the same rule Norway applies to consumers. But the section only protects a "fysisk person", a natural person, so an email to a role address with no name attached, like post@firma.no, sits outside it. A named work address does not get that pass. There is a narrow existing customer exception, GDPR applies on top through the Norwegian Personal Data Act, and the reservation register most guides mention does not cover email at all. This is not legal advice.
What Section 15 says
I run cold email and LinkedIn outreach for B2B clients across the Nordics, and Norway is the market where the first question I get is usually wrong: "is Norway on the reservation register, so can we skip it." That question comes before the budget question most teams actually plan around, what running outbound into the Nordics costs month to month, and it mixes up two different rules. The one that actually governs email is Section 15 of the Marketing Control Act. In plain terms, a business cannot send marketing by email, text message or an automated calling system to a natural person without that person's prior consent, given in advance. There's a narrow exception for an existing customer relationship, covered below, and nothing else.
That single sentence is the whole rule for email. There's no separate B2B carve-out, no volume threshold and no grace period for a first message. The consent has to exist before you send, not get collected afterward because nobody complained.
Why the law protects people, not companies
The word that changes everything in Section 15 is "fysisk person", a natural person. Forbrukertilsynet's own guidance on email and SMS marketing says plainly that it's fine to send marketing to an address that doesn't belong to a specific individual, its own example is post@firmaX.no. A company's generic sales or info inbox is not a natural person, so Section 15 doesn't reach it.
The same guidance also closes the gap some teams hope for: even when a named individual's address sits inside a company's domain, firstname.lastname@company.no, it's still that person's address under the law. Being listed in a business register as a contact for a company doesn't strip the protection. So the practical line isn't B2B versus B2C, it's named versus unnamed. A list of role inboxes is a different, much safer list than a list of named executives, even if both sit at the same companies.
What this means for list building. If your Norway list is built from a data provider that resolves every contact down to a named person with a direct email, you're in the regime that needs prior consent. If it's built from public role addresses, you're largely outside it, but you've also traded away the personalization that makes a first email work.
The existing customer exception, condition by condition
Section 15's third paragraph lets a business keep emailing a customer without fresh consent, but only when every condition below holds at once:
| Condition | What it means in practice |
|---|---|
| The business got the address from the customer in connection with a sale | A real purchase, not a demo booking, a webinar sign-up or a LinkedIn connection |
| The marketing covers the business's own, comparable goods or services | Adjacent products to what they bought, not the full catalogue and not a partner's offer |
| The customer has not objected | One opt-out ends it for good, across every tool sending on your behalf |
| The customer was told, at collection and at every later message, that they can opt out simply and at no cost | The notice has to be there from the first message, it can't be added retroactively |
A cold prospect never satisfies the first condition, so this exception never rescues a true cold send. It's built for a renewal upsell or a related-product nudge to someone who already bought from you, not for a first outreach into a new account.
Where GDPR fits in next to Section 15
Norway isn't an EU member, but it is in the European Economic Area, and the GDPR applies in Norway through the Norwegian Personal Data Act, enforced by Datatilsynet rather than an EU body. The two laws answer different questions. Section 15 asks whether you're allowed to send the message at all. GDPR asks whether you have a lawful basis to process the person's email address as personal data in the first place, usually legitimate interest under Article 6(1)(f) for a relevant B2B contact.
Where the two overlap, Datatilsynet's own guidance is direct: the ePrivacy-style consent rule in the Marketing Control Act takes precedence over the general GDPR consent framework for marketing messages. In practice that means passing the GDPR legitimate interest test doesn't get you past Section 15's consent requirement for a named individual, the two bars sit side by side and you need to clear both. Legitimate interest can justify holding the contact's email address on file and sending them something relevant to their role; it does not substitute for the prior consent Section 15 asks for when no customer relationship exists.
What the reservation register actually covers
The most common mistake I see in briefs for Norway is treating the national reservation register, Reservasjonsregisteret at Brønnøysundregistrene, as the full answer. It isn't, and Forbrukertilsynet's own guidance says so explicitly: the register covers telephone marketing and addressed advertising mail, and it does not apply to the Section 15 restrictions on email marketing. Over 2.3 million people have registered against phone and post, but checking a contact against that register tells you nothing about whether you can email them. The consent question for email sits entirely inside Section 15, register or no register.
LinkedIn and other channels into Norway
I haven't found a Norwegian court decision on whether a LinkedIn message counts as the kind of electronic marketing Section 15 covers, which is a different situation from Germany, where appeal courts have named LinkedIn and XING directly (see is cold email legal in Germany for that case law). Section 15's own wording covers "elektronisk post, telefaks eller automatiske oppringingssystemer", methods that reach an individual directly and store the message until they retrieve it, a description a LinkedIn message fits as easily as an email. Until a Norwegian case says otherwise, I treat a sales message on LinkedIn into Norway with the same caution as a cold email: fine to send once there's a reason the person would want it, risky as a volume opener to named individuals who haven't engaged first.
What breaking the rule actually costs
Forbrukertilsynet, the Norwegian Consumer Authority, enforces Section 15 and doesn't need a court to act first. Its own description of its powers sets out three tools: a prohibition order telling a business to stop, a coercive fine (tvangsmulkt) that runs until the business complies, set high enough that non-compliance isn't worth it, and for an intentional or repeated breach, a violation fee (overtredelsesgebyr) capped at the higher of 4% of the business's annual turnover or 25 million kroner. A business can appeal any of these to Markedsrådet, the Market Council, before it reaches an ordinary court. None of this requires the recipient to sue first, a complaint to Forbrukertilsynet is enough to start a case.
Norway next to Germany and the rest of the EU
Norway's natural person test puts it closer to the lighter end of the countries I check before a campaign, not the stricter end. For the full country by country picture across 10 EU markets, I keep that in is B2B cold email legal in the EU, and Germany is the clearest contrast case:
| Norway | Germany | |
|---|---|---|
| Who the consent rule protects | Named individuals only (fysisk person) | Any addressee, company inboxes included |
| Role address, no name attached | Outside the rule | Still covered, UWG §7 doesn't exempt it |
| Existing customer exception | Four conditions, Section 15(3) | Four conditions, UWG §7(3), similar shape |
| Who enforces it | Forbrukertilsynet, administrative fines | Civil claims: recipients, competitors, associations |
| LinkedIn messages | No ruling found either way | Named directly by an appeal court in Hamm (2023) |
The practical upshot: a list of generic Norwegian role addresses is workable without consent in a way the same list into Germany is not, since Germany's rule doesn't carve out company inboxes at all. The moment the list resolves to named people, both countries land in roughly the same place: you need consent or a real existing customer relationship, full stop.
What actually works when you sell into Norway
Given where the line actually sits, here's what I build into a Norway sequence rather than skip the market or ignore the rule:
- Start from role addresses where the target function has one. Procurement, support, sales and info inboxes exist at most mid-size and larger Norwegian companies, and a relevant first message to one of those sits outside Section 15 entirely.
- Earn the named contact before you email it directly. A LinkedIn connection, a comment, or a reply from the role inbox that names the right person is a reason to continue the conversation with that person, not a new blanket permission to add them to a sequence.
- Keep the first message short and specific to the role. My own first emails run 30 to 40 words with one concrete problem and one concrete offer, which keeps the message inside what GDPR calls relevant processing even before Section 15 becomes the question that decides whether you can send it at all. Whether that first message should run in Norwegian or English is a separate call, covered in when native language cold email is worth it.
- Build consent into other channels. A gated guide, a webinar sign-up or a free audit with a clear checkbox gives you consent you can point to, which then clears Section 15 for a named person, not just the data-protection question.
- Stop the moment someone objects, on any channel, and treat that as final across your whole list, the same way the existing customer exception requires.
A checklist before you send into Norway
- Check whether each address is a role inbox or a named person. Treat them as two different lists with two different rules.
- For named contacts, confirm consent or a genuine existing customer relationship under all four Section 15(3) conditions, not just one or two.
- Don't rely on the reservation register to clear a contact for email, it only covers phone and addressed mail.
- Record where and when consent was given for every named address, the same proof GDPR asks you to keep for your legitimate interest or consent basis.
- Give a working, immediate opt-out in every message and honor it the same day, not at the next list sync.
- Treat LinkedIn messages the same as email until a Norwegian ruling says otherwise.
Not legal advice. I'm a GTM consultant, not a lawyer. Every claim above links to the statute, the regulator's own guidance or the data protection authority so you can read the primary source yourself. Have a Norwegian lawyer check your specific list and copy before a campaign into Norway, particularly where named contacts are involved.
Key takeaways
- Section 15 of the Marketing Control Act bans unsolicited electronic marketing to a named individual without prior consent, but a role address with no name attached falls outside it.
- The existing customer exception needs a real sale, comparable products, no objection and an opt-out notice from the first message. It never covers a true cold send.
- GDPR applies through the Norwegian Personal Data Act and sits next to Section 15, not instead of it. Legitimate interest can justify holding the data, it doesn't clear the consent bar for sending to a named person.
- The reservation register at Brønnøysundregistrene covers phone and addressed mail only, not email.
- Forbrukertilsynet can act without a lawsuit: prohibition orders, coercive fines, and violation fees up to 4% of turnover or 25 million kroner for intentional or repeated breaches.
FAQ
Is cold email illegal in Norway?
Not automatically. Section 15 of the Marketing Control Act bans unsolicited electronic marketing to a fysisk person, a named individual, without prior consent. Email sent to a role address such as post@firma.no, with no named person attached, falls outside that rule.
Can I email a named person at a Norwegian company without their consent?
Only if an existing customer relationship covers it, or you accept the risk of a complaint to Forbrukertilsynet. A named work address still counts as a natural person's address under Section 15, so the same consent rule and the same four-condition customer exception apply as for a private address.
Does the Norwegian reservation register block B2B cold email?
No. Forbrukertilsynet's own guidance says the reservation register at Brønnøysundregistrene covers telephone marketing and addressed advertising mail, not email or SMS. Checking a prospect against it tells you nothing about whether you can email them.
Is a LinkedIn message to someone in Norway treated the same as a cold email?
There is no Norwegian ruling on this yet, so I treat it the same way. Markedsføringsloven covers electronic communication methods that reach one person directly, and a LinkedIn message fits that description as easily as an email.
What happens if I send unsolicited cold email into Norway?
Forbrukertilsynet can issue a prohibition order backed by a coercive fine, and for intentional or repeated breaches a violation fee of up to 4% of annual turnover or 25 million kroner, whichever is higher. Decisions can be appealed to Markedsrådet.