When Every Cold Call Was a Breach
Until 1 July 2026, sending any electronic marketing communication – an mail, a text message, a phone call – to a business contact in Lithuania required that person’s prior, explicit consent. This was not a technicality interpreted narrowly by courts. The Lithuanian State Data Protection Inspectorate applied the rule in full: even the very first call to a company, made solely to ask whether they would welcome marketing material, was itself treated as direct marketing. You needed consent to seek consent. The legal trap was perfect.
The breadth of this regime owed much to the definition of direct marketing under Lithuania’s Law on Personal Data Protection, which captured any activity aimed at offering goods or services – or merely inquiring about opinions regarding them – by post, telephone, or other direct means. Even a single exploratory call to gauge whether a company might be interested in a product qualified. Cold outreach was, for practical purposes, banned.
What Changes from 1 July 2026
The amendment to Article 81(1) of the Law on Electronic Communications introduces a targeted but decisive change. The general rule – that prior subscriber consent is required to use electronic communications services, including email, for direct marketing – remains. However, a new express exception now applies where the subscriber or registered user of public electronic communications services is a legal person:
- For legal persons (companies and other corporate entities): prior consent is no longer required. The marketer must instead ensure a clear, free, and easily implementable mechanism for the recipient to opt out of further direct marketing communications.
- For natural persons (individuals): the prior consent (opt-in) requirement remains fully intact. Nothing changes.
In short: B2B electronic direct marketing moves from an opt-in to an opt-out model. B2C remains opt-in only.
How Lithuania’s Old Rules Compared to Its European Peers
Lithuania’s pre-July position was an outlier by European standards. Across the EU and beyond, most jurisdictions had long-established workable B2B outreach frameworks without requiring prior consent:
- United Kingdom – opt-out for corporate subscribers since 2003. Under Regulation 22 of the Privacy and Electronic Communications Regulations (PECR), corporate subscribers – companies, LLPs, government bodies – may receive direct marketing emails and texts without any prior consent. The Information Commissioner’s Office is explicit: “You do not need their consent under PECR to send such messages.” The sender must identify itself and include a valid opt-out in every message. For live telephone calls, businesses may be contacted without consent, subject only to screening against the Corporate Telephone Preference Service (CTPS) blacklist.
- Germany – B2B cold calling on “presumed consent.” Under §7(2) No. 2 of the Gesetz gegen den unlauteren Wettbewerb (UWG – Act Against Unfair Competition), B2B telephone outreach is permitted where the caller can demonstrate “presumed consent” (mutmaßliche Einwilligung) – meaning documented, specific reasons to believe the business would be interested in the product or service being offered. No prior consent is required; the caller must be able to justify the outreach if challenged.
- France – B2B prospecting remains lawful on legitimate interest. B2B telephone prospecting is legal without prior consent under GDPR Article 6(1)(f) (legitimate interest). The sweeping 2025 reform to France’s telemarketing rules – which, by August 2026, will require full prior opt-in for consumer calls – targets B2C only. The B2B framework was left untouched precisely because it was considered proportionate and workable.
Against this backdrop, Lithuania’s blanket opt-in requirement – which treated a polite first call to a company’s sales department identically to unsolicited marketing sent to a private individual at home – was an anomaly without commensurate privacy justification. The amendment corrects that.
One Question the Law Does Not Yet Answer
The new exception applies where the subscriber is a “legal person.” But a named employee email address – firstname.lastname@company.lt – remains personal data of a natural person under GDPR, regardless of the corporate domain. The amended law does not specify how to determine whether a given contact qualifies as a legal or natural person subscriber, and regulatory guidance from the State Data Protection Inspectorate has yet to be issued. One practical approach is domain ownership verification; but that is a heuristic, not a legal answer.
What Has Not Changed: The B2C Direct Marketing Regime
For natural persons – consumers – Lithuania’s rules remain among the most demanding in the region. There are two lawful routes for B2C electronic direct marketing:
- Route 1: Explicit prior consent (opt-in). A clear, specific, active, and freely given consent from the individual before any marketing communication is sent.
- Route 2: The soft opt-in exception for existing clients under Article 81(2). This route is available only when all of the following conditions are satisfied simultaneously:
a) the contact data was obtained during a commercial transaction (sale of goods or provision of services) with a natural person (individual) who is the marketer’s client;
b) the marketing is only for the marketer’s own goods or services;
c) the marketed goods or services are similar to those already purchased by that client;
d) at the moment of data collection, the client was given a clear, free, and easily exercisable opportunity to refuse the use of their data for marketing purposes;
e) at every subsequent marketing communication, the client is again given the same clear opt-out opportunity; and
f) contact is made only through email – the channel via which the contact data was originally provided by the client.
These conditions are not alternatives. They are cumulative. Missing even one – failing to offer an opt-out at the moment of data collection, marketing products outside the category already purchased, or using a channel other than email – puts the entire communication outside the exemption. All six conditions must be satisfied, at all times, without exception.
Conclusion: A Step Forward, Half a Door Open
The 1 July 2026 amendment is a meaningful and long-overdue correction: businesses now have a workable legal basis for B2B electronic outreach that their counterparts in the UK, Germany, France, and most of the EU have enjoyed for years. The grey area around named employee email addresses will need regulatory clarification. For B2C, however, Lithuania remains firmly in a consent-first, conditions-heavy world. Until those rules are also modernised, the door has been opened – but only halfway.
Article provided by INPLP member: Migle Dewsbury (Sorainen, Lithuania)
Discover more about the INPLP and the INPLP-Members
Dr. Tobias Höllwarth (Managing Director INPLP)
