--- title: "Emailing LinkedIn Post Engagers: GDPR and Consent | traxy" description: "Can you email people who liked or commented on a LinkedIn post? Why engagement isn't consent, lawful basis, UK, French and German rules, and a checklist." canonical: "https://traxy.ai/blog/gdpr-emailing-linkedin-post-engagers" last_updated: "2026-11-11" --- # Emailing LinkedIn Post Engagers: GDPR and Consent | traxy > Can you email people who liked or commented on a LinkedIn post? Why engagement isn't consent, lawful basis, UK, French and German rules, and a checklist. [Home](https://traxy.ai/) [Blog](https://traxy.ai/blog) [Prospecting & Outreach](https://traxy.ai/blog/topics/prospecting-and-outreach) Outbound # Emailing people who liked or commented on a LinkedIn post: GDPR, consent and what to check first Can you email people who liked or commented on a LinkedIn post? Why engagement isn't consent, lawful basis, UK, French and German rules, and a checklist. By the traxy teamPublished Nov 11, 202625 min read ![Emailing people who liked or commented on a LinkedIn post: GDPR, consent and what to check first — traxy blog](https://traxy.ai/assets/blog-covers/gdpr-emailing-linkedin-post-engagers.jpg) **In this article**[Can you email people who liked or commented on your LinkedIn post?](https://traxy.ai/blog/gdpr-emailing-linkedin-post-engagers#can-you-email-people-who-liked-or-commented-on-your-linkedin-post) [Why is a like or a comment not consent?](https://traxy.ai/blog/gdpr-emailing-linkedin-post-engagers#why-is-a-like-or-a-comment-not-consent) [Which lawful basis covers emailing post engagers?](https://traxy.ai/blog/gdpr-emailing-linkedin-post-engagers#which-lawful-basis-covers-emailing-post-engagers) [How do you run a legitimate interests assessment for engager emails?](https://traxy.ai/blog/gdpr-emailing-linkedin-post-engagers#how-do-you-run-a-legitimate-interests-assessment-for-engager-emails) [What do you have to tell people about where you got their data?](https://traxy.ai/blog/gdpr-emailing-linkedin-post-engagers#what-do-you-have-to-tell-people-about-where-you-got-their-data) [How should you handle objections and opt-outs?](https://traxy.ai/blog/gdpr-emailing-linkedin-post-engagers#how-should-you-handle-objections-and-opt-outs) [How do UK, French and German rules differ for B2B email?](https://traxy.ai/blog/gdpr-emailing-linkedin-post-engagers#how-do-uk-french-and-german-rules-differ-for-b2b-email) [Do the same rules apply to LinkedIn messages?](https://traxy.ai/blog/gdpr-emailing-linkedin-post-engagers#do-the-same-rules-apply-to-linkedin-messages) [What does traxy do here, and what stays with your team?](https://traxy.ai/blog/gdpr-emailing-linkedin-post-engagers#what-does-traxy-do-here-and-what-stays-with-your-team) [How Vamo emailed the engagers of posts it had already published](https://traxy.ai/blog/gdpr-emailing-linkedin-post-engagers#how-vamo-emailed-the-engagers-of-posts-it-had-already-published) [Checklist before your first send](https://traxy.ai/blog/gdpr-emailing-linkedin-post-engagers#checklist-before-your-first-send) [FAQ](https://traxy.ai/blog/gdpr-emailing-linkedin-post-engagers#faq) [Sources](https://traxy.ai/blog/gdpr-emailing-linkedin-post-engagers#sources) [Next step](https://traxy.ai/blog/gdpr-emailing-linkedin-post-engagers#next-step) [Open product docs](https://docs.traxy.ai/) **TL;DR: A like or a comment on a LinkedIn post is not consent to email marketing. Before your team emails people who engaged with a post, check four things: a lawful basis (for most B2B email, a written legitimate interests assessment), the email rules in each recipient's country, a first email that says where you found the person, and a suppression list that every tool you use respects.** The country rules differ most. In the UK, PECR doesn't require consent to email staff at incorporated companies, but the UK GDPR still applies. In France, the CNIL accepts legitimate interest for B2B email when the message relates to the person's job. In Germany, section 7 of the UWG treats advertising email sent without the addressee's prior express consent as an unacceptable nuisance, and that covers business addresses too. _This is general information, not legal advice. Laws and guidance change, and how they apply depends on your facts, so check your plan with your data protection officer (DPO) or counsel. traxy, which publishes this guide, finds people who engage with LinkedIn posts and runs LinkedIn and email outreach to them. The section on traxy below says what it does here and what stays with your team. Every regulator page linked in this guide was checked on November 11, 2026._ ## Can you email people who liked or commented on your LinkedIn post? Often you can, in the UK and France, if you meet the conditions below. In Germany you generally can't without prior express consent. In every case the engagement gives you a reason to write and something to say. It does not give you permission. Two sets of rules apply at the same time, and you have to pass both: 1. **The e-marketing rules** decide whether you may send an unsolicited marketing email at all. In the UK that's PECR. In the EU each country has its own law based on the ePrivacy Directive, such as article L34-5 of France's postal and electronic communications code and section 7 of Germany's UWG. 2. **Data protection law** (the GDPR, or the UK GDPR) decides whether you may use the person's data for that purpose: their name, job, company, the engagement you saw and the email address you found. The European Data Protection Board (EDPB) puts it this way: before processing personal data for direct marketing, "controllers should consider specific European, as well as national, legislation which may require consent for certain operations in the context of direct marketing, or prohibit some kinds of direct marketing" ([EDPB Guidelines 1/2024](https://www.edpb.europa.eu/public-consultations/guidelines-12024-on-processing-of-personal-data-based-on-article-61f-gdpr_en) , paragraph 113). Here is the short version for the UK, France and Germany. Each row is explained further down. Question United Kingdom France Germany Consent needed to send B2B marketing email to a named work address? Not under PECR for staff of companies, LLPs and other corporate bodies. Yes for sole traders and some partnerships. No, when the message relates to the person's job. They must be informed and able to object. Yes. Prior express consent of the addressee, with a narrow exception for your own customers. Data protection law UK GDPR GDPR GDPR Likely lawful basis Legitimate interests, after the three-part test Legitimate interest Consent, because the email rule requires it Generic addresses like info@ Not personal data when no person is named (ICO) Not covered by these rules (CNIL) No exemption: section 7's email rule refers to any addressee Regulator source [ICO: business-to-business marketing](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing) [CNIL: prospection par courrier électronique](https://www.cnil.fr/fr/la-prospection-commerciale-par-courrier-electronique) [UWG section 7](https://www.gesetze-im-internet.de/uwg_2004/__7.html) ## Why is a like or a comment not consent? Because GDPR consent has a strict definition, and a like doesn't meet it. Article 4(11) of the [GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) defines consent as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her." A like is a clear action, but it is about the post. It says nothing about you, your product or email. The person wasn't told you would collect their details, so it isn't informed, and it isn't agreement to anything you plan to do. A comment is the same, even a comment like "great point, we struggle with this too." Regulators say the same about public data in general. The ICO says "you cannot assume that simply because an individual's personal data is in the public domain they are agreeing to it being used for direct marketing purposes" ([ICO B2B marketing guidance](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing) ). The CNIL says valid consent needs a positive and specific action from the person, such as a dedicated box that isn't pre-ticked, and that accepting general terms of use isn't enough ([CNIL](https://www.cnil.fr/fr/la-prospection-commerciale-par-courrier-electronique) , our translation). So what is engagement good for? Two things: - **Relevance.** It shows the topic matters to the person, which helps when you assess whether they would reasonably expect to hear from you about it. That is part of the legitimate interests test below. - **An honest reason to write.** You can name the post in your first line. Keep the claim to what the action shows: a like means the topic caught their eye, not that they want to buy. Our guide to [messaging LinkedIn post engagers without sounding creepy](https://traxy.ai/blog/how-to-message-linkedin-post-engagers) has openers that stay inside the evidence. Also skip posts whose engagement could reveal sensitive facts about a person. Article 9(1) of the GDPR prohibits processing data "revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership", health data and data about sex life or sexual orientation, unless an exception applies. A like on a post about a health condition or a union campaign is a poor lead source for marketing. ## Which lawful basis covers emailing post engagers? For most B2B email it is legitimate interests. Where the country's email rule requires consent, it is consent. The ICO says "the two lawful bases most relevant in the B2B marketing context are consent and legitimate interests" ([ICO](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing) ). The GDPR names direct marketing as a possible legitimate interest. Recital 47 ends: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." Note the "may". The EDPB says this "does not mean that direct marketing always constitutes a legitimate interest, and that it is automatically possible to rely on Article 6(1)(f) GDPR to engage in all kinds of direct marketing activities" (Guidelines 1/2024, paragraph 110). Two limits matter for engager outreach: - **The email rule comes first.** The ICO says legitimate interests "can apply for direct marketing but only where the Privacy and Electronic Communication Regulations (PECR) don't require consent" ([ICO: legitimate interests](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/legitimate-interests/) ). The EDPB makes the same point for the EU: where the e-marketing rule requires consent, the processing for that marketing can't rest on legitimate interests (paragraph 114), and if national law doesn't permit the messages at all, "there would be no legitimate interest that the controller could invoke in order to justify the collection of personal data for sending such messages" (footnote 143). - **You must pass a test, and write it down.** Legitimate interests is not a box you tick. The next section shows how to run it for engager emails. In the UK, since the Data (Use and Access) Act, the UK GDPR lists seven lawful bases. The ICO says the new "recognised legitimate interest" basis is different from legitimate interests and "only applies if you want to use personal information for specific purposes", while direct marketing is named as a potential legitimate interest. Several ICO pages used here carry a notice that they are under review because of that Act, so recheck them before you rely on them. ## How do you run a legitimate interests assessment for engager emails? You answer three questions, in order, before you send anything, and keep the record. The EDPB states the test as three cumulative conditions: > "First, the pursuit of a legitimate interest by the controller or by a third party; Second, the need to process personal data for the purposes of the legitimate interest(s) pursued; and Third, the interests or fundamental freedoms and rights of the concerned data subjects do not take precedence over the legitimate interest(s) of the controller or of a third party." The EDPB adds that the assessment "should be done before carrying out the relevant processing operations" and made with the DPO's involvement if you have one. The ICO calls the written record a legitimate interests assessment (LIA), says there's no standard format and offers a sample template on its [legitimate interests page](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/legitimate-interests/) . Here is what an LIA for engager emails might cover. Step The question What to write for engager emails 1\. Purpose What interest are you pursuing, and is it lawful and specific? Offering your product to people whose job it fits, who publicly engaged with posts about the problem it solves. Name the offer, the roles and the topics. The EDPB wants an interest that is lawful, "clearly and precisely articulated" and real, not speculative. 2\. Necessity Do you need this data, and is there a less intrusive way? List the fields you use: name, role, company, the post or comment, a work email. Drop anything else. The ICO says that if you can reasonably achieve the same result in another less intrusive way, "legitimate interests doesn't apply." 3\. Balancing Would the person reasonably expect this, and what is the impact? Business capacity, a public engagement, and a topic tied to their job point one way. The ICO's warning about professional networking sites (below) points the other. Impact: a short sequence, easy to stop. Safeguards: name the source, put an opt-out in every email, honor objections everywhere, cap follow-ups, skip sensitive topics. 4\. Outcome Do you go ahead, and when do you review? Record the decision and the date. The ICO says to refresh it "if there's a significant change in the purpose, nature or context". A new offer, new countries or a new kind of signal counts. For the balancing step, the EDPB lists factors for direct marketing: "whether the person receiving the direct marketing is an existing customer, the nature of the products and services the controller wishes to market, and whether it is likely that the data subject would expect to receive direct marketing about such products and services" (paragraph 121). Strangers who liked a post score lower on the first factor than customers do, which is why the safeguards carry more weight. Two more points for engager emails: - **One LIA per audience and offer.** "Engagers with our CEO's posts about hiring, offered our recruiting product" is a different balance from "anyone who liked a competitor's post, offered anything." - **Tracking pixels are their own question.** The ICO says PECR's rules on cookies and similar technologies apply if you use tracking pixels in marketing emails and the pixel stores or reads information on the reader's device. Check that before you switch on open tracking for these sends. ## What do you have to tell people about where you got their data? You have to tell them where it came from, and the first email is usually the place. When you didn't get the data from the person, Article 14 of the [GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) requires you to give them a set of information, including "from which source the personal data originate, and if applicable, whether it came from publicly accessible sources" (Article 14(2)(f)). On timing, Article 14(3) says to inform people within a reasonable period and "at the latest within one month", and "if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject." The ICO's B2B guidance gives the outer limit as "no later than one month from the date of collection." The practical reading: send the first email, with the notice, soon after the lead arrives, and don't stockpile leads you won't contact. Ask counsel how the one-month limit applies to leads you keep but haven't emailed. The [ICO's right to be informed checklist](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-be-informed/) lists what the notice covers when data comes from another source: - your organisation's name and contact details, and your DPO's if you have one - the purpose and the lawful basis, and the legitimate interests you rely on - the categories of data (for example name, job, company, the engagement and a work email) - recipients, any transfers outside the UK or EU, and how long you keep the data - the person's rights, including the right to object and to complain to the regulator - the source of the data The ICO adds that this applies to publicly accessible sources too. If you think informing people would be impossible or a disproportionate effort, it says you must carry out a data protection impact assessment (DPIA). With engager emails you are writing to the person anyway, so that exception rarely fits. Article 21(4) adds that, at the latest at the first communication, the right to object "shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information." Give the opt-out its own line. Don't bury it inside the privacy link. ### What the CNIL's LinkedIn contact-data case shows On December 5, 2024 the CNIL fined a company 240,000 euros. The company sold a Chrome extension that showed users the work contact details of people whose LinkedIn profiles they visited ([CNIL sanction notice](https://www.cnil.fr/fr/aspiration-de-donnees-sanction-de-240-000-euros-lencontre-de-la-societe-kaspr) ). Among its findings, in our translation: - Collecting contact details that LinkedIn users had chosen to limit went beyond what people who join a professional social network could reasonably expect, so that data was collected unlawfully. - Keeping contact details for five years, restarted at every profile update, was a disproportionate retention period. - People weren't told about the collection until 2022, and then only by an email in English, which the CNIL said wasn't transparent and understandable information. - When people asked where their data came from, the company only told them it came from publicly accessible sources ([CNIL closure notice, March 2026](https://www.cnil.fr/fr/cloture-de-linjonction-prononcee-lencontre-de-la-societe-kaspr) ). The CNIL ordered it to give people all the information it had on the sources. For engager outreach, that means "we found you on LinkedIn" or "from public sources" won't do as a source. Name the post, write the notice in a language the person understands, and set a retention period that doesn't renew itself. ### How the source post on each traxy lead helps Every traxy lead shows the post, comment, like or repost that put the person on your list, and the lead's Signals tab shows the source and date. traxy's docs tell you to "check the source and date of recorded evidence before referencing it in outreach" ([review qualified leads](https://docs.traxy.ai/leads/overview) ). So your first line can name the exact post, and if someone asks where you got their details, you can point to the post and the date instead of "public sources". The email address is a second source. If it came from an email lookup, your notice should say so. A first email that does this job might read: > "You commented last week on a post about ramping new SDRs, and mentioned that onboarding takes your team two months. We help sales teams shorten that. Worth a 15-minute look?" > > Footer: who you are, your company address, and one line: "We found your comment on LinkedIn and your work email through an email lookup service. How we use your data: link to your privacy notice." > > Then, on its own line: "You can object to us using your data for marketing at any time. Reply 'stop' and we won't contact you again." In traxy, sequence and one-off emails include the sender's email signature when one is set ([sender accounts](https://docs.traxy.ai/outreach/senders) ), so the identity, notice link and opt-out line can live there and go out with every email. LinkedIn messages don't use the email signature, so on LinkedIn steps put the source in the message itself. ## How should you handle objections and opt-outs? Stop at once, on every channel, and keep a record so the person doesn't come back in a later list. Under Article 21(3) of the GDPR, "where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes." The EDPB calls this right "unconditional": the person doesn't need a reason, there's no balancing, and "it is enough that the data subject puts forth an objection for the objection to be successful" (paragraph 122). The ICO says that after an objection, opt-out or withdrawal of consent you should add the details to your "do not contact" or suppression list "instead of simply deleting all record of them", so you can screen new lists against it. Its example is a recruitment firm that emails an HR director at a limited company. The director asks it to stop, and the firm adds the address to its do not contact list ([ICO](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing) ). The CNIL calls this a "liste repoussoir" ([CNIL suppression list guidance](https://www.cnil.fr/fr/comment-utiliser-une-liste-repoussoir-pour-respecter-lopposition-la-prospection) ). In our translation, it says: - The list exists so you don't add people who already objected back into a new list by mistake, for example a list bought from a data broker. - It may be used only to manage objections, and should hold only the data needed. - The CNIL recommends keeping the information needed to honor an objection for at least three years. - You can store a hash of the email address instead of the address itself. Hashes are still personal data and must be secured. With engager outreach, the same person can enter your list again from a new post next month, so an objection given once has to hold across every campaign, channel and rep. Treat any "stop" as an objection, whether it comes as an unsubscribe click, an email reply, a LinkedIn message or a phone call. In traxy: - **Do not contact** (Settings > Do not contact) suppresses outreach to a person. Add an email address or a LinkedIn profile, or upload a CSV with `kind,value` columns using `EMAIL` or `LINKEDIN` ([do not contact docs](https://docs.traxy.ai/outreach/do-not-contact) ). Add both when someone objects, so an email opt-out also stops LinkedIn steps. - **Stop rules.** Replies, unsubscribe requests and hard bounces stop the sequence, and people on your do not contact list aren't messaged. - **Blocklist** (Settings > Blocklist) keeps company domains, and specific people, out of future lead discovery ([blocklist docs](https://docs.traxy.ai/workspace/blocklist) ). Use it for existing customers, and when a company asks you to stop contacting its staff. Blocklist works on discovery, so add the people you already hold to Do not contact too. - **Done and Snooze aren't suppression.** They organize your work. The docs say "Removing a suppression is not approval to resend an earlier message." Opt-outs collected elsewhere, in your CRM or email platform, need to reach the same list. A weekly CSV upload to Do not contact is the simplest habit. Our guide to [keeping customers, competitors and opt-outs out of your prospect list](https://traxy.ai/blog/exclude-customers-competitors-from-prospecting) covers the setup. ## How do UK, French and German rules differ for B2B email? The UK and France allow B2B email without consent under conditions. Germany requires prior express consent. The data protection side (lawful basis, notice, objections) works the same way in all three. ### United Kingdom The ICO's [electronic mail marketing guidance](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/) and [B2B guidance](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing) say: - **Corporate subscribers.** PECR's email rule "does not apply to corporate subscribers", meaning companies, LLPs, Scottish partnerships and some government bodies. "You do not need their consent under PECR to send such messages." An employee's work email at a corporate body counts as a corporate subscriber, because the subscriber is the employer. - **Individual subscribers.** Sole traders and some partnerships are treated as individuals, so you can email them only with specific consent or under the soft opt-in for your own customers. If you can't tell which kind of subscriber an address belongs to, the ICO says to treat it as an individual subscriber. - **Every message.** You must not disguise or conceal your identity, and you must give a valid address for opt-outs. The ICO says you should comply with a company's opt-out request, and keep a "do not email or text" list. - **UK GDPR still applies.** A named work address like a first-name and surname address is personal data. You need a lawful basis, privacy information, and you must honor "their absolute right to stop their data being used for direct marketing purposes." On LinkedIn specifically, the ICO writes that people on professional networking sites "are unlikely to be on the sites exclusively in their business capacity", and "if an individual is using such a platform in their personal, albeit professional, capacity then sending them direct marketing messages is not considered B2B marketing." Factor that into your balancing test, and see the section on LinkedIn messages below. ### France The CNIL's page on [electronic prospecting](https://www.cnil.fr/fr/la-prospection-commerciale-par-courrier-electronique) (dated June 10, 2026) sets out the B2B rule. In our translation: - **Basis.** Prospecting professionals "can be based on the organisation's legitimate interest when the subject of the message relates to the profession of the person contacted (for example, a call presenting the merits of software to a company's IT director)." - **Two rules.** The person is informed (for example when their address is collected), and they can object simply and free of charge. - **Data from third parties.** When the data was acquired from third parties, you must make sure the person was informed that their email address could be used for prospecting and is able to object. - **Every message** must show who is sending it and give a simple way to refuse further messages. - **Generic addresses** of companies, like info@ or contact@, are not subject to these rules. For engager emails to French contacts, document the job-relevance test: the engagement was on a topic tied to the person's role, and the offer is tied to that role. After the CNIL case above, also inform people in French if that is the language they understand. ### Germany Section 7 of the Act against Unfair Competition ([UWG](https://www.gesetze-im-internet.de/uwg_2004/__7.html) ) is stricter. In the [English translation](https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html) on the German government's law portal, section 7(2) says an unacceptable nuisance is always assumed in the case of "advertising using an automated calling machine, a fax machine or electronic mail without the addressee's prior express consent." Two details matter for B2B teams: - **Email is stricter than phone.** For phone calls, the same subsection allows calls to a business ("another market participant") with "at least the latter's presumed consent." The email rule has no such carve-out. It refers to the addressee, whether a consumer or a business. - **The only exception is your own customers.** Section 7(3) allows email without consent when you got the address from the customer in connection with a sale, you advertise your own similar goods or services, the customer hasn't objected, and you told them clearly, at collection and in every message, that they can object at any time. A like or comment on a LinkedIn post is not prior express consent, so German engagers need their own plan before they enter an email sequence: get counsel's view, ask for consent first, or keep them out of email steps. In traxy, people criteria in [Lead criteria](https://docs.traxy.ai/discovery/lead-criteria) include locations, and the launch review shows who will join a campaign before you approve it, so you can check the audience before anything sends. ### Other EU countries Each EU country implements the ePrivacy Directive in its own law, and the details differ. The EDPB says controllers "should also assess the scope of application of the national rules implementing the ePrivacy Directive at Member State level, which may occasionally impose consent requirements that go beyond those laid down in that Directive (e.g., with respect to direct marketing towards professionals)" (paragraph 117). Check every country on your list, not only where your company sits. ## Do the same rules apply to LinkedIn messages? In the UK, yes. The ICO says "if you are marketing using direct messaging via social media, the electronic mail marketing rules apply" ([ICO](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/) ). Read that with its point that messaging someone who uses a networking site in a "personal, albeit professional, capacity" isn't B2B marketing, and UK LinkedIn campaigns deserve the same legal review as email. The CNIL and UWG pages cited here don't address LinkedIn messages directly, so ask counsel for France and Germany too. LinkedIn's own rules on automation apply on top of the law. Our guide to [ethical LinkedIn outreach](https://traxy.ai/blog/ethical-linkedin-outreach) quotes LinkedIn's policy and covers suppression and stop rules for the LinkedIn side. ## What does traxy do here, and what stays with your team? traxy runs your entire LinkedIn GTM end to end, from finding high intent leads from social intent to enriching and researching each one, to running relevant, personalized LinkedIn and email outreach to them on autopilot. Autopilot here means the campaign sends on its own only after you test it on sample leads, with nothing sent, and approve the launch. Or you approve every message in a review queue. Social intent means what people post, comment on and like on LinkedIn, who views your profile, and who engages with the competitors, creators and company pages you track. Only people with a 50% or higher ICP match become leads. Each campaign researches every lead, groups leads by signal and prepares a personalized message for each group, and outreach goes from the LinkedIn accounts and mailboxes you connect as senders. You can run many campaigns at once on different signals, by hand in the app, through trax (the traxy agent) or through the traxy MCP from Claude or ChatGPT, where the AI asks for your yes before anything sends. The [LinkedIn outbound page](https://traxy.ai/linkedin-outbound) covers the sending side in full. Here is how that lines up with the rules in this guide: What the rules ask What traxy gives you What your team owns A reason tied to the person's job A 50%+ ICP match on every lead, plus the post or comment behind it Deciding that your offer fits their role, and writing it in the LIA Telling people the source The source post, comment or like and its date on each lead's Signals tab The privacy notice, the first line and the email-source sentence Your identity and an opt-out in every email The sender's email signature goes out with every sequence and one-off email Writing the signature: company, address, notice link, opt-out line Honoring objections Do not contact, Blocklist, and sequences that stop on replies, unsubscribes and hard bounces Logging objections from other channels and uploading them Checking before anything sends A test on sample leads with nothing sent, a launch review of who joins and who is skipped, and an optional approval queue ([review and launch](https://docs.traxy.ai/campaigns/review-and-launch) ) Checking each audience against country rules before you approve A lawful basis and an LIA Nothing. A tool can't decide this. Your DPO or counsel traxy is not a compliance product, and using it doesn't make outreach lawful. The lawful basis, the assessment, the privacy notice and the country rules are your decisions. What traxy gives you is the source, the fit check, the suppression lists and the review steps that make those decisions easier to carry out. ## How Vamo emailed the engagers of posts it had already published Vamo, which finds engineers on GitHub for recruiters, staffing firms and founders, ran 64 posts it had already published through traxy. traxy flagged the engagers who fit Vamo's ICP, the team exported the matched leads to a CSV and ran email sequences off that list. The result was 14 replies from those 64 posts and 11 meetings from the first set of leads ([Vamo case study](https://traxy.ai/case-studies/vamo) ). The case study doesn't describe Vamo's compliance process, so read it as the workflow, not as a legal template. If you run the same play for UK or EU contacts, here is where each check from this guide goes: 1. **Choosing the posts:** skip posts on sensitive topics, and note the topics in your LIA. 2. **Qualifying the engagers:** keep only people whose job fits the offer. That fit is your relevance argument. 3. **Exporting or enrolling:** screen against Do not contact and your CRM opt-outs first, and split out countries that need consent, such as Germany. 4. **Writing the sequence:** name the post in line one, and put your identity, notice link and a separate opt-out line in every email. 5. **After sending:** add every "stop" to the suppression list on both channels, and delete leads you won't contact. ## Checklist before your first send Use this as a review list with your DPO or counsel. It follows the ICO, CNIL and EDPB pages linked above. ### Before you collect 1. Write down which countries your engagers are in, and which e-marketing rule applies to each. 2. Pick the lawful basis per country: legitimate interests where the email rule allows it, consent where it doesn't. 3. Write one LIA per audience and offer, dated, with your DPO involved if you have one. 4. List the data fields you need and drop the rest. 5. Exclude posts whose engagement could reveal sensitive data. 6. Ask each vendor you evaluate how it collects LinkedIn data and contact details, how long it keeps them, which subprocessors it uses and whether it signs a data processing agreement. Get the answers in writing. Our [checklist for evaluating LinkedIn engagement tools](https://traxy.ai/blog/how-to-evaluate-linkedin-engagement-intelligence-tools-b2b-checklist-2026) covers the rest of the buying questions. ### Before you send 1. Update your privacy notice to cover engager outreach: purpose, legitimate interest, data categories, the LinkedIn source, the email lookup source, retention and rights. 2. Screen every audience against your suppression list, including opt-outs from your CRM and email tools. 3. Treat sole traders and addresses you can't classify as individuals in the UK. 4. Keep German contacts out of email steps unless you have prior express consent or counsel has cleared another route. 5. Decide whether you use open-tracking pixels, and check the cookie rules first if you do. 6. Test the campaign on sample leads and read the drafts against what each lead's signal shows. ### In every email 1. A first line that names the post or comment you saw. 2. An offer that relates to the person's job. 3. Your company name and contact address, with nothing disguised. 4. A link to the privacy notice and a sentence on where you found them. 5. A separate, clear opt-out line, in the person's language. ### After you send 1. Act on every objection at once, on every channel, and add it to the suppression list instead of deleting the record. 2. Keep the information needed to honor objections (the CNIL recommends at least three years), and nothing more. 3. Answer access requests with the specific source, not "public sources". 4. Delete leads you won't contact, and review the LIA when the offer, the countries or the signals change. For the contact data itself, our guide to [contact enrichment](https://traxy.ai/blog/what-is-contact-enrichment) explains how email lookup works for leads found on LinkedIn and what a lookup can't promise. ## FAQ ### Is a LinkedIn like or comment consent to email marketing? No. GDPR consent must be a freely given, specific, informed and unambiguous indication that the person agrees to the processing. A like or comment is about the post. It doesn't mention you or email, and the person wasn't told you would use their data. ### Can we email UK post engagers at their work address without consent? Under PECR, yes for staff of companies, LLPs and other corporate bodies. Not for sole traders and some partnerships, who need consent or the soft opt-in. The UK GDPR still applies, so you need a lawful basis (usually legitimate interests, after the three-part test), privacy information, and you must stop if they object. ### Do we need consent to email B2B contacts in Germany? Generally yes. Section 7(2) of the UWG treats advertising by email without the addressee's prior express consent as an unacceptable nuisance, and the rule isn't limited to consumers. The narrow exception in section 7(3) covers your own customers and similar products. ### Do we have to tell people we found them through a LinkedIn post? Yes. Article 14 of the GDPR requires you to tell people the source of their data when you didn't get it from them, at the latest in your first message if you contact them. Name the specific post. The CNIL faulted a company that only told people their data came from publicly accessible sources. ### How long should someone stay on our suppression list? The CNIL recommends keeping the information needed to honor an objection for at least three years, using only the data you need, and it allows storing a hash of the address instead of the address. The ICO says to keep objections on a suppression list rather than deleting all record of the person. ### Are generic addresses like info@ treated differently? In the UK, an address that names no one isn't personal data, so the UK GDPR doesn't apply to it. PECR's rules on stating who you are and giving a valid opt-out address still do. The CNIL says generic company addresses aren't subject to its prospecting rules. In Germany, section 7 of the UWG still applies, since it covers any addressee. ### Does traxy make our outreach GDPR compliant? No tool can. traxy shows the source post on every lead, keeps people on Do not contact and the Blocklist out of your outreach and discovery, stops sequences on replies, unsubscribes and hard bounces, and lets you test and approve before anything sends. Your lawful basis, assessment, privacy notice and country rules are yours to decide with counsel. ## Sources All checked November 11, 2026. Quotes from French pages are our translations. - ICO: [Business-to-business marketing](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing) (under review after the Data (Use and Access) Act) - ICO: [Electronic mail marketing](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/) (under review) - ICO: [Legitimate interests](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/legitimate-interests/) (updated March 23, 2026) - ICO: [Right to be informed](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-be-informed/) (under review) - CNIL: [La prospection commerciale par courrier électronique, SMS-MMS et automate d'appel](https://www.cnil.fr/fr/la-prospection-commerciale-par-courrier-electronique) (June 10, 2026) - CNIL: [Comment utiliser une liste repoussoir pour respecter l'opposition à la prospection ?](https://www.cnil.fr/fr/comment-utiliser-une-liste-repoussoir-pour-respecter-lopposition-la-prospection) - CNIL: [sanction notice, December 2024](https://www.cnil.fr/fr/aspiration-de-donnees-sanction-de-240-000-euros-lencontre-de-la-societe-kaspr) , and [closure of the injunction, March 2026](https://www.cnil.fr/fr/cloture-de-linjonction-prononcee-lencontre-de-la-societe-kaspr) - Germany: [UWG section 7](https://www.gesetze-im-internet.de/uwg_2004/__7.html) and its [English translation](https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html) - EDPB: [Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR](https://www.edpb.europa.eu/public-consultations/guidelines-12024-on-processing-of-personal-data-based-on-article-61f-gdpr_en) , version 1.0, adopted for public consultation on October 8, 2024 - EU: [General Data Protection Regulation (EU) 2016/679](https://eur-lex.europa.eu/eli/reg/2016/679/oj) , Recital 47 and Articles 4(11), 9, 14 and 21 ## Next step Pick one post your team already published, open its qualified leads in [traxy](https://traxy.ai/) , and write the LIA and the first email for that audience before you build anything bigger. When the checks above pass, run the campaign with a test on sample leads first. [Back to all articles](https://traxy.ai/blog) ## Keep reading [All Prospecting & Outreach guides](https://traxy.ai/blog/topics/prospecting-and-outreach) [Lead generation12 min read ## LinkedIn Prospecting (2026): How to Prospect on LinkedIn Step by Step, With Message Examples & Signals That Tell You Who to Contact First How to prospect on LinkedIn step by step: profile, ICP, list building, message examples, signals, niche markets, tools and every outreach guide we publish. Updated Nov 12, 2026Read article](https://traxy.ai/blog/linkedin-prospecting) [Outbound12 min read ## Sales Prospecting Statistics (2026): Follow-Ups, Response Time and Reply Rates Sales prospecting statistics for 2026 on follow-ups, lead response time, cold email and cold call reply rates and SDR metrics, each linked to its source. Nov 12, 2026Read article](https://traxy.ai/blog/sales-prospecting-statistics) [Tools & comparisons14 min read ## Best Clay Alternatives (2026): 7 Tools for Signal-Based Prospecting Compare the best Clay alternatives in 2026 for signal-based prospecting: traxy, Apollo, Persana, Common Room, Unify, Sales Navigator, and ZoomInfo. Updated Nov 12, 2026Read article](https://traxy.ai/blog/best-clay-alternatives-2026) The right people are already out there. ## Find your warmest leads. _Send them personalized messages._ From relevant interest to personalized outreach. Put traxy to work. [Start your free trial](https://app.traxy.ai/signup) [Book a demo](https://calendly.com/d/cvj3-p2p-cpv/traxy-demo?utm_source=website&utm_medium=cta&utm_campaign=book-demo&utm_content=footer) 7-day free trial [traxy](https://traxy.ai/) Get the most qualified leads on LinkedIn, in real time. **Product**[Social Intent Search](https://traxy.ai/social-intent-search) [LinkedIn Social Listening](https://traxy.ai/linkedin-social-listening) [Signal-Based Outbound](https://traxy.ai/signal-based-outbound) [MCP Access](https://traxy.ai/linkedin-mcp) [Case Studies](https://traxy.ai/case-studies) [Pricing](https://traxy.ai/pricing) [DFY Outbound](https://traxy.ai/managed) **Resources**[Scoreboard](https://traxy.ai/scoreboard) [FAQ](https://traxy.ai/faq) [Guides](https://traxy.ai/guides) [Docs](https://docs.traxy.ai/) [Blog](https://traxy.ai/blog) [News](https://traxy.ai/news) [Affiliate ProgramNew](https://traxy.ai/affiliates) [Agency Partners](https://traxy.ai/agency) [Creators](https://traxy.ai/creators) [About traxy](https://traxy.ai/about) [Contact](https://traxy.ai/contact) **Legal**[Privacy Policy](https://traxy.ai/privacy-policy) [Terms of Service](https://traxy.ai/terms-of-service) [Cookie Policy](https://traxy.ai/cookie-policy) © 2026 traxy, inc. All rights reserved.