Quick answer
No, not without consent first. Since 10 November 2024, Article 398 of Poland's Electronic Communications Law bans sending commercial information by email to any subscriber or end user, companies and sole traders included, unless they consented before the first message. There is no company inbox exception and no existing customer exception. This is not legal advice.
What Article 398 actually says
I plan outbound lists by country for B2B clients across the Baltics and the Nordics, and Poland is the one market on that list where I now tell a client to stop building a volume list the way they would for Lithuania or Latvia. The rule sits in Article 398 of the Prawo komunikacji elektronicznej (Electronic Communications Law of 12 July 2024, Dz.U. 2024 poz. 1221), in force since 10 November 2024. It bans using telecommunications terminal equipment and automated calling systems, email included, to send commercial information to a subscriber or end user who has not given prior consent. That single article replaced two older, narrower provisions at once: Article 10 of the old law on providing services by electronic means, and Article 172 of the old Telecommunications Law.
Nothing in Article 398 limits "subscriber or end user" to a private individual. A registered company and a sole trader on CEIDG are end users in the same sense a consumer is, so the consent requirement applies to a first email into a company inbox exactly as it would to a personal one.
Does being B2B change anything?
No, and that is the detail most outbound advice written for the rest of the EU gets wrong when it is applied to Poland without checking. The ePrivacy Directive leaves each EU country free to decide how far its consent rule reaches for business contacts, and Poland used that freedom to cover everyone rather than carve out companies. A commercial email into a named person's work inbox and the same email into a generic sales@ address face the identical rule: prior consent, not an opt-out offered after the fact.
What this means for list building. A Poland list resolved from public company data, a website contact form, or a scraped directory gives you a target, not a green light. Without a documented, prior, affirmative consent for that specific address, a first cold email into it does not clear Article 398, role inbox or named contact alike.
Why there is no existing customer exception
Germany's UWG keeps a narrow carve out for marketing similar products to your own existing customers. Poland's Article 398 does not. The provision sets one test, prior consent, and does not soften it for a buyer who already has a commercial relationship with the sender. A renewal email, an upsell to a past client, and a true first touch to a stranger all sit under the same consent requirement. If a client's Poland list depends on an existing customer exception the way their Germany or France lists might, that assumption does not carry over.
Poland next to Lithuania, Latvia and Estonia
This is the part that catches people building one Baltics playbook and applying it everywhere. Lithuania moved to an opt-out rule for company contacts on 22 April 2026, and Latvia and Estonia had already been running opt-out models for company addresses for years before that. Poland went the other direction entirely, tightening a rule that used to sit closer to its neighbors into the strictest consent requirement in the group.
| Poland | Lithuania (since Apr 2026) | Latvia | Estonia | |
|---|---|---|---|---|
| Company inbox, no name attached | Opt-in, prior consent | Opt-out | Opt-out | Opt-out |
| Named individual's work address | Opt-in, prior consent | Opt-out, name included | Opt-out | Opt-out |
| Existing customer exception | None | Not needed, opt-out covers it | Not needed | Not needed |
| Who enforces it | President of UKE | State Data Protection Inspectorate (VDAI) | PTAC / Data State Inspectorate | Andmekaitse Inspektsioon |
A list that is fully compliant for Lithuania, Latvia or Estonia the day you build it needs a separate, documented consent step before a single message goes to a Polish address. The regional playbook splits in two: three Baltic states on an opt-out default, one on strict opt-in, and Poland is the one.
What counts as valid prior consent
Consent under Article 398 has to be prior, meaning collected before the first commercial message, not gathered retroactively once someone replies. It has to be specific to the channel, so a consent captured for a newsletter does not cover a separate cold outreach sequence, and a consent captured for a phone call does not cover email. It has to be an affirmative, informed action, not a pre-ticked box or an assumption drawn from a public listing. A phone number or email address sitting in a public register or on a company's own website is not, by itself, consent to be contacted commercially at that address.
Where GDPR fits in next to Article 398
Poland is an EU member, so GDPR applies on top of Article 398, and the two answer different questions. GDPR's legitimate interest basis under Article 6(1)(f) can justify holding a role relevant business contact's details as data in several other EU markets, including the GDPR baseline covered in is B2B cold email legal in the EU. In Poland, that basis still does not substitute for Article 398's own prior consent requirement before you send. One test governs whether you may process the contact's data at all, the other governs whether you may message it, and a Poland campaign has to clear both.
What breaking the rule can cost
The President of UKE, the national telecoms regulator, can fine a violator up to 3% of the previous year's revenue or 1,000,000 PLN, whichever is higher, with the exact amount set by the nature and scope of the violation. No public decision under Article 398 specifically has surfaced yet, which tracks: the rule is not two years old. UKE's track record under the predecessor Article 172 shows it does act on unsolicited marketing contact once a complaint lands. In 2019 it fined Koksztys S.A. 80,000 PLN for over 30,000 telemarketing calls made without consent. That case predates Article 398 and concerned calls rather than email, but it is the clearest sign I found that the regulator enforces the underlying rule rather than leaving it on paper. The ceiling under the new law is far higher than what that 2019 case used.
What changed on 10 November 2024
The shift is easiest to see side by side against the rule it replaced.
| Before 10 Nov 2024 | After 10 Nov 2024 | |
|---|---|---|
| Legal basis | Art. 10 of the e-services law and Art. 172 of the Telecommunications Law, two separate provisions | Article 398 PKE, one consolidated rule |
| Consent for a company inbox | Required under the same consent standard | Still required, unchanged in substance |
| Maximum penalty | Set under the older telecoms and e-services penalty regime | Up to 3% of annual revenue or 1,000,000 PLN, whichever is higher |
| Enforcement authority | President of UKE | President of UKE, unchanged |
The practical effect for an outbound team is smaller than the new-law headlines suggest. Poland already required prior consent for a company inbox before November 2024. What changed is the ceiling on the fine and the fact that the rule now lives in one article instead of two, not the underlying consent requirement itself.
Does the rule reach a LinkedIn message too?
I have not found a Polish ruling that applies Article 398 to a LinkedIn message specifically, which puts Poland in the same position as several of its neighbors on this exact question. The article's own language covers electronic communication sent through a telecommunications network to reach a subscriber or end user, a description a direct LinkedIn message fits as naturally as an email even without a court having said so yet. Into Poland, I treat a cold LinkedIn message the same way I treat a cold email: fine once consent or a genuine prior relationship covers it, risky as a volume opener into a market with no inbox exception at all.
What actually works when you sell into Poland
Given where the line actually sits, a Poland sequence has to start further back than a Lithuania or Latvia one. The practical path I build for clients starts with a first touch that earns a reply through a channel consent rules do not cover the same way, a LinkedIn connection request with a short, specific note, or a referral into the account, and only moves to email once that contact has engaged and a documented opt-in exists. That matters even more for a vertical like recruitment and staffing, where getting clients for a recruitment agency in Poland already runs on relationship-led prospecting more than cold volume, Article 398 just makes that the only safe option rather than one of several. My own first messages, once consent is in place, still run 30 to 40 words with one concrete problem and one concrete offer, the same length I use everywhere else, length was never the part of the Poland brief that needed to change.
A checklist before you send into Poland
- Treat every Poland address as opt-in only, role inbox or named contact, there is no exception by address type.
- Record consent per channel, a newsletter opt-in does not cover a separate cold outreach sequence.
- Do not rely on an existing customer exception, Article 398 does not carry one.
- Open on LinkedIn or through a referral first, then move to email once a real relationship or documented consent exists.
- Give every message a free, working opt-out and honor it immediately, even though it is not what makes the first send legal.
- Keep consent records, the kind a complaint to UKE would require you to produce.
Not legal advice. I'm a GTM consultant, not a lawyer. Every claim above links to the law itself or the regulator's own record so you can check the primary source directly. Have a Polish lawyer review your specific list and copy before a campaign into Poland.
Key takeaways
- Article 398 requires prior consent before any commercial email, companies and sole traders included, since 10 November 2024.
- There is no company inbox exception and no existing customer exception, unlike Germany's UWG or the opt-out models in Lithuania, Latvia and Estonia.
- GDPR's legitimate interest basis applies to holding a contact's data, it does not substitute for Article 398's consent requirement to send.
- The President of UKE can fine up to 3% of revenue or 1,000,000 PLN. No public Article 398 decision has surfaced yet, the rule is under two years old.
- A Poland list built for Lithuania's or Latvia's opt-out rules is not automatically compliant, it needs its own documented consent step.
FAQ
Is cold email illegal in Poland?
Yes, without prior consent. Article 398 of the Electronic Communications Law bans sending commercial email to any subscriber or end user, companies included, unless they consented before the first message.
Can I email a company's generic inbox like info@ without consent?
No. Unlike Lithuania, Latvia and Estonia, Poland's Article 398 makes no distinction between a named contact and a generic company address. Both need prior consent.
Does GDPR's legitimate interest basis let me skip consent for a B2B contact in Poland?
No. Legitimate interest under GDPR Article 6(1)(f) can justify holding a role relevant contact's details as data, it does not substitute for the prior consent Article 398 requires before you send.
What is the maximum fine for breaking Article 398?
The President of UKE can impose a fine of up to 3% of the violator's revenue from the previous year or 1,000,000 PLN, whichever is higher.
Is a LinkedIn message into Poland treated the same as a cold email?
There is no Polish ruling on this yet, so I treat it the same way. Article 398 covers electronic communication reaching a subscriber or end user, a description a direct LinkedIn message fits as easily as an email.