Cold Outreach Compliance DACH: Combining TKG, UWG, DSG and BDSG

Cold Outreach Compliance DACH refers to complying with the national rules for B2B cold outreach via email, telephone and LinkedIn in Austria, Germany and Switzerland. The governing frameworks are the UWG (unreasonable harassment), the TKG (Austria) or Section 7 UWG (Germany) for email and telephone, plus the GDPR in conjunction with the DSG, BDSG and revFADP for the underlying data processing. Anyone working with AI-driven outbound workflows is thereby combining two legal regimes at once: marketing law and data protection law.

Three quick answers up front:

• Email to companies requires prior consent in AT and DE, including in B2B (Section 174 TKG 2021, Section 7 UWG). 'Presumed consent' does not apply to email. Without consent, only existing customers may be emailed, under strict conditions (Section 174(4) TKG 2021, Section 7(3) UWG). In CH, the opt-in applies to mass advertising.
• Telephone cold outreach to companies is permitted in Germany under narrow conditions with presumed consent (Section 7 UWG). In Austria it is prohibited without prior consent (Section 174 TKG 2021); in Switzerland, the asterisk opt-out in the phone directory and caller ID rules apply (UWG).
• The underlying data processing (lists, enrichment, personalization) requires its own GDPR legal basis in AT/DE. In CH it must comply with the processing principles of the revFADP. This is a second, separate assessment alongside marketing law.

Two legal regimes that apply independently of each other

The most common mistake in DACH outbound is the assumption that a single legal basis covers everything. In reality, two layers apply in parallel:

1. Marketing and harassment law governs whether and how you may make contact at all. This is the UWG/TKG layer.
2. Data protection law governs whether you may process the personal data required for it. This is the GDPR/DSG/BDSG/revFADP layer.

Both must be satisfied. An email that is permissible under marketing law remains unlawful if the data processing is not permitted under data protection law. Conversely, a sound data basis does not make an unlawful marketing email lawful. Consent-based personalization is structurally narrower in the DACH region than in the US model, which noticeably limits generative personalization use cases.

The ePrivacy foundation: one directive, two implementations and a Swiss rule of its own

Email and telecommunications marketing are rooted in EU law in Directive 2002/58/EC (the ePrivacy Directive); Article 13 covers unsolicited marketing. The European Commission withdrew the planned successor, the ePrivacy Regulation, in 2025, so the directive continues to apply in its national implementations. Switzerland is not an EU member and has its own rules. By country:

• Germany: Article 13 is implemented in Section 7(2) and (3) UWG. Section 25 TDDDG (formerly TTDSG), by contrast, governs storing and reading information on end devices, such as cookies, and is not a rule for marketing emails.
• Austria: implementation in Section 174 TKG 2021.
• Switzerland: not EU law. Marketing emails are governed by Art. 3(1)(o) UWG (consent for mass advertising, exception for existing customers), marketing calls by Art. 3(1)(u) and (v) (respect the asterisk opt-out in the phone directory, display a registered caller number).

For outbound, this means: the basic idea that 'unsolicited electronic marketing generally requires prior consent' is anchored in all three countries, but the specific provision and its design differ.

Email, telephone, LinkedIn: what agents may and may not do

Email cold outreach

In Austria and Germany, marketing emails to companies require prior consent. Section 174(3) TKG 2021 has no B2B exception, and Section 7(2) no. 2 UWG even requires prior express consent. 'Presumed consent', often used as a bridge in B2B, applies in Germany only to phone calls, not to email. The only exemption from the consent requirement is existing customers: a company that obtained the address in connection with the sale of goods or services may advertise its own similar offers. Among other conditions, the customer must have been told about the right to object when the address was collected and in every message, and must not have objected (Section 174(4) TKG 2021, Section 7(3) UWG). In Switzerland, Art. 3(1)(o) UWG requires prior consent for mass advertising, with a comparable exception for existing customers. In practice, cold emails without consent are unlawful in AT and DE, not merely risky. There is also an operational finding from practice: DACH B2B inboxes quickly recognize templated AI emails, and deliverability collapses. That damages sender reputation on top of the legal risk.

Telephone cold outreach

Telephone cold outreach to companies is permitted in Germany under Section 7(2) no. 1 UWG if there is at least presumed consent. Presumed consent requires concrete indications that the company called has a genuine interest in this specific offer (Federal Court of Justice, judgment of September 20, 2007, I ZR 88/05). A pure cold call without such a link is usually not enough. In Austria, marketing calls without prior consent are unlawful under Section 174(1) TKG 2021, including calls to businesses. In Switzerland, a marketing call is unfair if the person called has no business relationship with the caller and either has an asterisk opt-out in the phone directory or is not listed at all, or if no registered caller number is displayed (Art. 3(1)(u) and (v) UWG). Voice outbound via AI voice agents almost never works in DACH B2B, because of these call-protection rules, formal communication culture and RFP-driven procurement; voice remains a fringe channel there, at most for inbound qualification. Whether an AI voice agent that places calls autonomously counts in Germany as an 'automatic calling machine', for which Section 7(2) no. 2 UWG requires prior express consent even in B2B, has not been settled. Presumed consent is not a safe basis for such calls. Since August 2, 2026, Art. 50(1) and (5) of the EU AI Act have required AI systems that interact directly with people, such as voice agents, to be designed so that the people called learn no later than the first interaction that they are talking to an AI, unless this is obvious.

LinkedIn

LinkedIn is the dominant channel in DACH B2B, but mass automation risks account suspensions. LinkedIn prohibits bots and software that automate activity on the platform, and members who use them risk having their accounts restricted or shut down. In early March 2025, the company pages of Apollo.io and Seamless.ai disappeared from LinkedIn; LinkedIn did not publish a reason. As of October 2026, Apollo.io's page is available again. Beyond the law, then, the LinkedIn terms of use apply here as a separate, contractual constraint.

What AI agents may do and what humans must be responsible for

The well-founded recommendation is: rep-in-the-loop rather than fully autonomous. Autonomous outbound SDR agents (e.g. Artisan Ava, 11x Alice, AiSDR, Rox.com, Regie.ai; as of 2026) have a strong vendor marketing presence but very mixed results; the founder of one provider himself conceded 'extremely bad hallucinations' and 'relatively high churn' for the first generation.

In short: the agent is a research, enrichment and writing machine. The legally delicate moment, actually making contact, must be the responsibility of a human who knows the consent status, objections and transparency obligations. Before any productive autonomy step comes a compliance/legal sign-off on Section 7 UWG (DE), the TKG (AT), the revFADP/UWG (CH), plus a LinkedIn ToS review.

Comparison table: email, telephone, data basis in AT/DE/CH

Note: This is an editorial classification by subject-matter experts and does not replace legal advice. The names of statutes and the citation of articles/sections follow the available sources; the specific admissibility must always be assessed on a case-by-case basis.

A Swiss particularity of high practical relevance: the revFADP primarily punishes natural persons, with fines of up to CHF 250,000 for intentional breaches of certain obligations, such as the duty to inform (Art. 60 to 63 revFADP). A fine against the company itself, of up to CHF 50,000, is only possible as a fallback when identifying the responsible individuals would be disproportionate (Art. 64). The risk thereby rests with management and data protection officers personally.

The data protection layer in detail: Art. 6(1)(f) and the three-step test

For AT/DE, the outreach list is almost always a GDPR processing activity. The typical basis is the legitimate interest under Art. 6(1)(f) GDPR, which, according to EDPB Guidelines 1/2024, requires a documented three-step test:

1. Purpose test: the interest must be lawful, real, present and specifically named. 'Improving sales' is not enough, whereas 'qualified initial B2B contact with suitable target customers in segment X' comes closer.
2. Necessity test: can it be done with less or pseudonymized data? For enriched profiles, this means: only the fields actually required.
3. Balancing test: against the reasonable expectations of the data subjects. 'Publicly available' expressly does not mean 'freely usable'; the standard from Meta v Bundeskartellamt (C-252/21) applies.

Also relevant for outbound:

• Transparency obligations (Art. 13/14 GDPR): anyone who collects contact data not from the data subject directly but via B2B data brokers or enrichment tools is subject to Art. 14. The 'disproportionate effort' exception (Art. 14(5)(b)) is narrower than often assumed.
• Right to object (Art. 21 GDPR): the data subject can object to direct marketing at any time, without giving reasons and without any balancing of interests (Art. 21(2)). After an objection, the data may no longer be processed for direct marketing (Art. 21(3)). The objection list therefore has to be checked before every send.
• Processing on behalf (Art. 28 GDPR): every enrichment tool and every MCP/API endpoint that processes contact data needs a sound data processing agreement (DPA). This is one of the most common gaps in AI-driven outbound stacks.

Switzerland works differently. The revFADP does not require a legal basis for every processing activity: processing is permitted as long as it complies with the processing principles of Art. 6 revFADP, meaning it is lawful, in good faith, proportionate and for a purpose the data subject can recognize. A justification under Art. 31 revFADP (consent, overriding interest or law) is only needed where there is a breach of personality rights, for example processing against the data subject's express wishes (Art. 30(2)). If the person has made their business contact details generally accessible and has not expressly prohibited processing, there is usually no breach of personality rights (Art. 30(3)). For outreach lists in Switzerland, two obligations therefore matter most: keep objections and opt-out flags properly recorded, and meet the duty to inform under Art. 19 revFADP. If the data was not obtained from the person, for example from a data broker, they must be informed within one month of receipt (Art. 19(5)). Art. 20 sets out exceptions, for example where informing them would require disproportionate effort. Intentional failure to inform is punishable on complaint with a fine of up to CHF 250,000 (Art. 60(1)(b) revFADP).

Practical example: a 5,000-contact campaign, set up correctly

A Viennese B2B agency is planning an outbound campaign for a client targeting 5,000 decision-makers in AT (3,000), DE (1,500) and CH (500). Set up cleanly, the workflow looks like this (pseudocode):

```text
for each contact:
country = determine_country(contact)
# 1. Data protection gate (before everything else)
if not data_protection_ok(contact, country):
discard # AT/DE: Art. 6(1)(f) LIA | CH: Art. 6 principles, Art. 19 duty to inform, no objection
if on_objection_list(contact):
discard
# 2. Marketing-law gate per channel
if channel == "email" and not consent_or_existing_customer(contact, country):
channel = "linkedin_personalized" # no mass mailing without a basis
# 3. AI agent: research + enrichment + draft (no sending)
draft = agent.generate_personalized_draft(contact)
# 4. Human: sign-off + sending trigger
to_approval_queue(draft, responsible_human)
```

The data protection gate sits before the marketing-law gate, because in AT and DE no processing may take place without a legal basis in the first place. The agent handles research, enrichment and drafting; sending remains in a human approval queue. For CH contacts: if someone intentionally breaches certain obligations, such as the duty to inform, it is primarily the responsible individuals who face criminal penalties, in most cases only on complaint (Art. 60 to 63 revFADP). The company itself can only be fined as a fallback, up to CHF 50,000 (Art. 64 revFADP).

For agencies and B2B teams

For agencies, Cold Outreach Compliance DACH is a differentiator: anyone who delivers outbound campaigns with a documented data protection assessment per country, a clean DPA stack and a rep-in-the-loop architecture protects the client from cease-and-desist warnings, account suspensions and deliverability collapse. For B2B teams, the rule is: treat AI agents as research, enrichment and writing tools, and keep the legally relevant sending trigger in human hands. Before any autonomy step, obtain a compliance sign-off on UWG/TKG/revFADP and LinkedIn ToS. Document the legal basis, balancing test and objection logic so that they will withstand scrutiny.