In B2B, you will usually find an email address in one of three ways: through the company’s public sources (legal notice, team and contact page), through the company pattern you derive from a known address, or through an email finder that automates both steps. Technically, that is rarely the problem. The difficult part comes afterwards: in Germany, having found an address does not mean you are allowed to use it for advertising.
This text shows you how to verify an address and what Section 7 of the UWG and the GDPR say about it. Last updated: 19 September 2026. Not legal advice – have the legal basis for specific campaigns reviewed.
Method 1: Check publicly available sources first
Before you guess, look it up. In Germany, the yield is high here because commercial websites are required to provide legal notice information – and the legal notice will usually include an email address.
- Legal notice: gives you at least one central address and often the structure (info@,contact@).
- Team, press and contact pages: these list personal addresses, often following the company pattern.
- Trade articles, conference programmes, job postings: contact persons are often listed there with their full address.
- LinkedIn contact info: Some members make their address visible on their profile. The chances are highest with first-degree connections – but you can only see what the person has chosen to share.
What you find here is reliable – and you can document where it came from. This will matter for the information obligation below.
Method 2: Derive the company’s email pattern
Companies almost never assign addresses at random. If you know one real address, you know the pattern for everyone else. The common patterns are limited:
- firstname.lastname@company.com – most common among mid-sized companies and larger organisations
- first@company.com – typical for small teams and agencies
- f.last@company.com or flast@company.com
- last@company.com
Two common pitfalls in German-speaking markets: umlauts are almost always transliterated (Müller becomes mueller or muller, ß becomes ss), and double surnames may appear with a hyphen or written as one word. If your first derivation fails, this is usually why – not the pattern.
Method 3: Verify a found address
A derived address is a hypothesis. Contacting it without checking affects deliverability: bounces from non-existent inboxes damage your sender domain’s reputation. Verification has three stages:
- Syntax: Is the address formally valid at all? This filters out typos, nothing more.
- Domain and MX record: Does the domain exist, and does the DNS contain a mail server (MX record)? If not, the domain cannot receive emails at all – the address is dead, no matter how plausible it looks.
- Mailbox check at SMTP level: Query the responsible mail server to see whether it would accept mail for this inbox, without sending an email. The result is less precise than it sounds: many servers respond positively to every address (catch-all) or refuse to provide this information. A “valid” result is an indication, not proof.
Email Finder: What this tool category does – and what it does not do
An Email Finder combines the three steps above: it maintains a database of collected addresses and company patterns, derives a likely address from a name and domain, and checks it technically. Providers in this category include Hunter, Apollo, Dropcontact and Lusha – mentioned as examples, not recommendations; check their websites for features and data coverage.
There are three things you should know beforehand:
- An Email Finder does not find anything, it calculates. The result is a likely address with a confidence score – which will be low for small companies with no public trace.
- The database contains personal data. When you import it, you become responsible for it. Check the data processing agreement, server location and third-country transfers beforehand.
- Legality is not a product feature. No tool can provide you with the legal basis. You need to have that yourself.
This does not include scraping addresses in bulk from third-party websites or networks – this regularly violates the platform’s terms of use.
The crucial question: Are you allowed to write to this address?
You may have obtained an address entirely legitimately from public sources and still not be allowed to send advertising emails to it.
Section 7 UWG: Email advertising requires prior consent
Section 7 (2) no. 2 UWG classifies the following as an unreasonable nuisance: advertising “using an automated calling machine, a fax machine or electronic mail without the recipient’s prior express consent”. The key words are prior it and enter it express. At this point, the provision does not distinguish between consumers and businesses – the common assumption that cold email is already permitted in B2B is not stated in the law. Source: gesetze-im-internet.de – Section 7 UWG, accessed on 19 September 2026.
The only exception named in the law is Section 7 (3) UWG. It applies only if all four conditions are met: you obtained the address when selling goods or services from the customer themselves, you advertise your own similar services, the customer has not objected, and you clearly inform them of their right to object when collecting the address and every time you use it. With a researched address, the first condition alone is not met.
GDPR: Legal basis and the information obligation when collecting data from third parties
A business email address with a name is personal data. Collecting and storing it requires a legal basis under Article 6 (1) GDPR – in practice, consent (point a) or a legitimate interest (point f) that must not be overridden by “the interests or fundamental rights and freedoms of the data subject”. This balancing test may support the research, but it does not replace the consent additionally required by Section 7 UWG for sending advertising. Source: dsgvo-gesetz.de – Art. 6 GDPR, accessed on 19 September 2026.
There is also an obligation that is almost always overlooked: Art. 14 GDPR applies when data was “not obtained from the data subject” – which is exactly the case with researched and purchased addresses. You must then inform the person which data you process, for what purpose, on what legal basis and from which source it originates. Deadline under Art. 14(3)(a) GDPR: “within a reasonable period after obtaining the personal data, but at the latest within one month”. Source: dsgvo-gesetz.de – Art. 14 GDPR, accessed on 19 September 2026.
In practice, this means: If you create a list of researched addresses, from that moment on you have an obligation to provide information to every person on it – regardless of whether you ever send an email. What you do not collect, you do not need to document, disclose or delete.
LinkedIn instead of cold email: the obvious alternative
For a traditional cold email to a researched contact, there is no legally sound way in Germany without prior consent. Two options remain: collect consent instead of working around it – through newsletters with double opt-in, webinar registration or a Lead Magnet – or switch channels for the initial cold contact.
On LinkedIn, the initial contact is part of the product: A connection request is an invitation that the other person can accept or ignore – the decision lies with them, not with you. You do not need to research an address or guess email patterns.
The request itself then determines everything that follows. Whether you should include a note is covered in Connecting on LinkedIn: with or without a message; the article on outreach channels explains which channels work for your target audience.
Frequently asked questions about finding email addresses
How do I find an email address using a name?
First, look for any real email address from the company – in the legal notice, on the contact page or team page. This lets you identify the pattern, usually firstname.lastname@company.com, and insert the name you are looking for. Watch out for umlauts (ue instead of ü) and double-barrelled names, then check the address technically.
What is an email finder?
A service that calculates and technically verifies a likely email address from a name and company domain, based on a database of collected addresses and company patterns. The result is a probability, not a guarantee – and it says nothing about whether you are allowed to email the address.
Is it legal to search for and email addresses?
Researching public sources requires a legal basis under Art. 6(1) GDPR and triggers the obligation to provide information under Art. 14 GDPR. Contacting someone for advertising purposes must be assessed separately: Section 7(2) No. 2 UWG requires prior explicit consent. Having an address does not give you the right to use it for advertising. This is not legal advice.
Is there an exception for cold emails in B2B?
The wording of Section 7(2) No. 2 UWG does not distinguish between consumers and businesses. The only statutory exception is Section 7(3) UWG for existing customers: the address must have been obtained from the customer when making a sale, for similar products or services of your own, with no objection, and with notice of the right to object each time it is used. A researched address does not meet these requirements.
How do I check whether an email address exists?
In three stages: syntax, then the domain’s MX record in DNS, followed by a mailbox query to the responsible mail server. The final stage is not definitive because many servers respond positively to every address (catch-all). Verification reduces the bounce rate, but does not prove active use.
