The rules for B2B outreach

Writing to a company you want to work with is ordinary business. Writing to a thousand of them is a campaign, and a campaign falls under rules that differ by country and by channel. A named address at a company is personal data in most places, and email, calls and LinkedIn each follow their own rules.

This is an overview of where those rules stand, for a company that sells to other companies. It is not legal advice.

Switzerland

In Switzerland the act against unfair competition sets the rules for advertising, and the FDPIC summarises them. Advertising by email is possible when people have explicitly given their consent, and accepting general terms is not enough. There is one exception: a company that has sold something to a customer may write to them about its own similar products, as long as the customer can refuse. Every message must name the sender and offer a free and simple way to stop.

Calls and letters follow a different logic. They are generally allowed if a person has made the number or address public and has not excluded advertising. Advertising calls to numbers marked with an asterisk in the directory, or not listed at all, are prohibited unless there is an existing business relationship. Clear breaches count as unfair competition, with civil or criminal consequences, and complaints go to SECO.

Data protection adds a duty that matters for bought lists: anyone can ask a company where it got their data. The FDPIC's guidance draws no separate line for business recipients, so a careful company applies it to them too.

The EU and its member states

In the EU two sets of rules apply together. The GDPR governs the personal data, and the ePrivacy Directive governs the channel.

The GDPR says direct marketing may be a legitimate interest. The European Data Protection Board warns in its 2024 guidelines that this is not automatic. The interest must be legitimate, the processing necessary, and the person's rights must not take precedence, which fails when people cannot reasonably expect to be contacted. The right to object to direct marketing is unconditional: nobody has to give a reason, and an objection succeeds as soon as it is made.

For the channel, the Board reads the ePrivacy Directive strictly. Unsolicited marketing emails to individuals need their prior consent, with the same exception for a company's own customers and similar products. Marketing to companies as legal persons falls under the ePrivacy rules alone, and this is where the member states part ways.

France is relatively open. The CNIL allows prospecting of professionals on the basis of legitimate interest when the message relates to the person's job, they have been informed, and they can object simply and free of charge. Generic addresses such as info@ fall outside these rules.

Germany is strict. Under section 7 of its act against unfair competition, advertising by email without the prior express consent of the addressee is always an unreasonable nuisance, and the law makes no general exception for businesses. Advertising calls to consumers need their prior express consent, and calls to other businesses at least their presumed consent.

The UK and the US

The UK is more open towards companies. The ICO says you can email or text any corporate body, while sole traders and some partnerships count as individuals and need consent. You must not hide who you are, you must give a valid contact address, and the ICO calls a do not email list good practice. Data protection still applies to named employees, and the guidance is under review after the Data (Use and Access) Act.

The US relies on opt out. The CAN-SPAM Act makes no exception for business email. Messages must not use false headers or deceptive subject lines, must identify themselves as advertising, include a postal address and explain how to opt out, and an opt out must be honoured within 10 business days. Hiring someone to send does not move the responsibility, and each email in breach can cost up to 53'088 dollars.

Calls are stricter. In February 2024 the FCC ruled unanimously that AI generated voices are artificial voices under the Telephone Consumer Protection Act. A call with a cloned or synthetic voice therefore needs the prior express consent of the person called, telemarketing robocalls need written consent, and the act lets individuals sue.

Europe and Switzerland approach AI voices through transparency. Since 2 August 2026 the EU AI Act requires that people are told when they are interacting with a machine, and the FDPIC says people have a right to know whether they are speaking with one.

LinkedIn has its own rules

LinkedIn is a private platform with rules of its own. Its user agreement, in force since 3 November 2025, forbids bots and other unauthorised automated methods, including automation that adds contacts or sends messages, and it forbids scraping. Its help pages say that members who use such tools risk having their accounts restricted or shut down.

The platform leaves plenty of room for what works anyway: a real profile, posts worth reading and messages written to one person. Automation that pretends to be a person is the quickest way to lose the account that carries a company's name.

What a careful company does

Know where each recipient sits, apply that country's rules, and choose the stricter one when in doubt.

Write to people about their work, with a reason that fits their role, and say who you are.

Record where every address came from, and be ready to say so when asked.

Keep one suppression list across every channel, and honour an opt out on the first reply, wherever it arrives.

Use AI voices only with consent, and say that it is a machine.

Keep LinkedIn personal, and have a person read and approve what goes out.

Machines can find the companies, research the people and draft the first line, faster and better every month. The judgement about whom to approach, and the conversation that follows, stay human, and they are what a buyer remembers.

How Lookout handles it

Lookout is built on these rules. It respects Swiss and EU rules, and an opt out is honoured on the first reply. Clients approve the story, the messages and the first batches before anything goes out, every lead is followed up and every no is respected. Mail goes out from the client's own domains, with SPF, DKIM and DMARC set up. Where a call uses a cloned voice, our voice product Timbre clones a voice only with consent.

Outreach that respects a no is not slower. It keeps the domain clean, the brand intact and the next conversation possible.