GDPR fines just crossed €5.88B cumulative. The EU is now proposing SME exemptions and cookie banner standardization. If you run outbound to European prospects, the rules you're playing by are about to shift under your feet. Here's what changes and what doesn't.
The enforcement machine isn't slowing down
€1.2B in fines landed in 2024 alone. That's not a rounding error. That's regulators signalling they've found their rhythm.
Most of that money came from big tech. Meta, TikTok, Amazon. But the enforcement pattern matters for you because it shows what regulators prioritise: consent mechanics, data minimisation, and transparency.
For a solo founder sending 200 cold emails a week, the risk profile is different. You're not a platform. You're not processing millions of profiles. But you are processing personal data, and the rules on how you collect and store that data are getting sharper, not looser.
The proposed SME exemptions don't change your exposure as much as the headlines suggest. The draft language targets administrative burden—things like mandatory Data Protection Officers and full-scale impact assessments—not the core obligations around lawful basis and individual rights. A founder scraping contact lists from LinkedIn or buying a lead pack without documented consent is still squarely in scope. The exemption is about paperwork, not behaviour. And the cookie banner standardisation, while welcome, cuts both ways: a uniform format makes it easier for users to say no, and regulators will expect you to honour that refusal with the same technical rigour as a multinational.
What this means operationally is that your outreach stack needs a defensible audit trail. If you're relying on legitimate interest, you need a documented balancing test—not a mental note. If you're using consent, you need proof of opt-in that isn't a checkbox buried in a footer. The enforcement pattern shows regulators are less interested in the size of the fine than in the clarity of the violation. A small processor with a clean, demonstrable process is a lower priority than a large one with systemic failures. That's your advantage: you can build compliance into your workflow now, before the SME exemptions are finalised and before the standardised banners make user intent explicit. The cost of doing that is hours, not euros. The cost of ignoring it is becoming a test case.
What the proposed SME exemptions actually say
The EU's proposed amendments target two things: reducing compliance burden for companies under 250 employees, and standardising cookie consent across the bloc. But the threshold itself is where the analysis gets interesting. The 250-employee figure is borrowed from the existing accounting directive, not from any privacy-specific logic. That means a 240-person company with a dedicated legal team and a 12-person startup with zero compliance staff are treated identically. The real differentiator isn't headcount; it's the nature and volume of processing. A small firm processing sensitive health data at scale still triggers the full weight of GDPR, because the exemption only relaxes administrative paperwork, not substantive obligations.
Here's the nuance most people miss. The SME exemption doesn't mean you're off the hook. It means you get simpler documentation requirements and lighter administrative duties—think streamlined records of processing activities and no mandatory Data Protection Officer in most cases. The core obligations stay: lawful basis, data subject rights, breach notification. What the proposal does not do is create a "safe harbor" for low-risk processing. Instead, it shifts the burden of proof onto the controller to demonstrate that their processing is genuinely low-risk. That's a subtle but critical inversion: you're presumed compliant until audited, but the moment a supervisory authority asks, you must show your work.
So if you're a 10-person sales team using a tool that scrapes LinkedIn and enriches with guesswork, the exemption doesn't save you. The legal basis for processing still has to be legitimate interest or consent, and you still have to be able to prove it. In practice, that means documenting your balancing test—why your interest in contacting a prospect outweighs their expectation of privacy. The cookie banner standardisation, meanwhile, doesn't reduce the need for granular consent; it just makes the interface uniform. You still need to capture and store proof of that consent, with timestamps and versioning, or your compliance is fiction. The proposed changes lower the cost of compliance, not the standard of it.
Cookie banner standardisation is a gift for your prospects
If you've ever tried to prospect into a German SaaS company, you know the drill. You land on their site, get hit with a 14-layer cookie banner, and spend 90 seconds clicking through before you see a pricing page. That friction isn't just an annoyance—it's a silent killer for your outreach timing. Every extra second a prospect spends navigating consent mechanics is a second they're not absorbing your value proposition. Standardised banners mean fewer clicks for your prospects. That's good for you because it removes friction from the research phase. But it also means the EU is watching how consent is collected. Dark patterns are explicitly in the crosshairs, and the proposed regulation doesn't just standardise the layout—it mandates that reject must be as easy as accept, with no pre-ticked boxes and no colour or contrast tricks that steer users toward approval. This shifts the compliance burden from the website owner to the entire vendor ecosystem.
What does that mean for your outreach? If you're using a tool that pre-ticks consent boxes or hides the reject button, that's a dark pattern. And if your prospect's compliance team is now trained to spot those, they'll spot them in your vendor stack too. The same scrutiny that applies to a B2B website's cookie layer will extend to your CRM, your enrichment tools, and your sequencing platform. For a small sales team, this is a strategic advantage: you can pre-empt the objection by auditing your own stack for dark patterns before a prospect's legal team does it for you. Moreover, standardised consent flows create a predictable baseline for behavioural data. When every site uses the same banner structure, the consent signals you collect become more comparable across accounts—meaning your lead scoring can finally weight for genuine engagement rather than penalising prospects who simply clicked through a maze. The regulation isn't just about user experience; it's about making consent a clean, auditable signal that both you and your prospect can trust.
AI processing is the new battleground
The proposed amendments don't touch the AI-specific provisions in the GDPR. And the EU AI Act, which starts enforcing in August 2026, adds another layer. If your outreach tool uses AI to score prospects or draft emails, that processing is now in scope for both regulations.
We wrote about the EU AI Act enforcement timeline and what it changes for cold email setups a few months back. The short version: if your AI tool makes decisions about people, you need to be able to explain how it works.
For most founders running outbound, this is manageable. You're not doing high-risk profiling. But if you're using AI to score leads based on behavioural data, you need to document that. And if you're using AI to generate personalised emails, you need to know what data the model was trained on.
The real friction emerges when you map the two regimes onto your existing stack. Under the GDPR, Article 22 gives data subjects the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. The AI Act's transparency obligations go further, requiring you to disclose when content is AI-generated and to maintain technical documentation of your system's logic. For a solo operator using an off-the-shelf outreach tool, that documentation burden often falls on you, not the vendor. You need to verify whether your provider offers model cards, training data summaries, or at minimum a clear data flow diagram. If they don't, you're carrying the compliance risk alone.
There's also a practical sequencing issue. The GDPR's accountability principle demands that you conduct a Data Protection Impact Assessment for high-risk processing. The AI Act's risk classification system uses different thresholds. A lead-scoring model that feels benign under the GDPR might still be classified as "limited risk" under the AI Act, triggering transparency duties you haven't planned for. The pragmatic move is to build a single inventory that maps each AI feature to both regulatory frameworks, noting the data inputs, the decision logic, and the human oversight mechanism. That document becomes your evidence trail if either regulator comes knocking.
What this means for your prospect list
Here's the practical angle. The companies most likely to care about GDPR compliance are the ones you want to sell to. They have compliance teams. They have procurement processes. They've been burned before.
That's not a barrier. That's a filter.
If you're selling to European SaaS companies, fintechs, or healthtechs, GDPR awareness is a buying signal. It means they've been through audits. It means they understand data governance. It means they'll ask you hard questions about your own stack.
If you can't answer those questions, you lose the deal. If you can, you've just differentiated yourself from 90% of the other vendors who can't.
But the proposed SME exemptions and cookie banner standardization change the calculus in a subtler way. The exemption threshold—likely tied to headcount or processing volume—means your smallest prospects may no longer have a dedicated DPO or formal DPIA process. That doesn't make them less cautious; it makes them less equipped. They'll rely on vendor assurances more heavily, not less. Meanwhile, the standardization of cookie banners signals a shift from surface-level consent theater to substantive data flow mapping. Prospects who have already invested in that internal discipline are now further ahead of their peers, and they know it. They will expect you to speak their language: data retention schedules, sub-processor lists, cross-border transfer mechanisms like SCCs or the EU-US Data Privacy Framework. If you show up with a generic privacy policy link and a "we take security seriously" line, you're not just failing a checkbox—you're signaling that you haven't tracked the regulatory evolution they live with daily. The vendors who win will treat GDPR competence as a product feature, not a legal footnote. They'll preemptively share their data processing agreements, name their hosting regions, and document their deletion workflows before being asked. That level of fluency converts a compliance conversation into a trust-building moment—and in a market where 90% of your competitors can't get past the basics, that's the difference between a reply and a silent archive.
What we'd do next
First, audit your own data processing. Know where your prospect data lives, how it was collected, and what legal basis you're relying on. Write it down. It takes an afternoon and it will save you a headache if anyone asks. But go deeper than a surface-level inventory. Map the full lifecycle: acquisition source, storage location, retention period, and every downstream tool that touches that record. The EU’s proposed SME exemptions won’t shield you if you’re processing at scale or handling special-category data, and the threshold for “small” is still being negotiated. Treat the audit as a living document, not a one-time compliance artifact. Revisit it quarterly, especially as you add new enrichment tools or change your outreach stack.
Second, update your outreach templates. If you're using language that implies consent where none exists, or if you're storing prospect data indefinitely, fix that now. The EU is standardising cookie banners, but they're also standardising enforcement expectations. That means the “legitimate interest” basis you’re relying on for cold outreach will face sharper scrutiny. Review your privacy notice and make sure it explicitly names the specific interest you’re pursuing — not a generic “marketing purposes” line. Also, build in a data retention schedule. If a prospect hasn’t engaged after 18 months, purge the record. This isn’t just about avoiding fines; it’s about reducing your attack surface. Regulators increasingly look at whether you’ve operationalised GDPR principles like data minimisation and storage limitation, not just whether you have a policy document.
Third, use this as a talking point. When you're prospecting into European companies, mention that you've aligned your stack with GDPR and the EU AI Act. It's a credibility signal that most of your competitors can't match. But make it substantive. Reference your specific retention windows, your documented legal basis, and how you handle subject access requests. Vague claims of “we’re compliant” are noise; specific process details signal that you’ve actually done the work. That’s the difference between a checkbox and a competitive advantage.
If you want to see how MiraReach handles data processing and compliance in its outreach workflows, give it a try. We built it for founders who need to move fast without tripping over regulation.
— Mira