GDPR-Compliant AI Cold Calling in DACH Markets: Germany, Austria & Switzerland

DACH Cold Calling: Three Countries, Three Rulesets

Businesses expanding AI voice agent operations across the DACH region face a common misconception: that Germany, Austria, and Switzerland share the same rules because they share a language. They do not. Each country has its own legal framework for unsolicited business communications, and the differences are not minor - they determine whether your AI cold calling operation is legal or a liability.

Germany and Austria are both EU member states subject to the GDPR (DSGVO in German), but their national implementations differ significantly. Switzerland is not in the EU and has its own data protection framework - the revised Bundesgesetz uber den Datenschutz (nDSG) - which took effect on September 1, 2023. For a broader European perspective, see our guide to AI B2B cold calling across Europe.

Germany: UWG and B2B Cold Calling

Germany's rules on cold calling are governed primarily by the Gesetz gegen den unlauteren Wettbewerb (UWG) - the Act Against Unfair Competition - specifically Section 7, which addresses unacceptable nuisance.

B2B: Mutmaßliche Einwilligung (Implied Consent)

Under UWG Section 7(2)(2), B2B cold calling by telephone is permitted when the caller can demonstrate "mutmaßliche Einwilligung" - implied consent. This means you must have a reasonable basis to believe the called business would be interested in your offer based on their business activities. This is not a blanket permission to call any business - it requires a documented, logical connection between your offering and the called business's needs.

For AI voice agents, this means:

• Document the basis: Before each call, you must be able to articulate why this specific business would plausibly be interested. "They are a business" is not sufficient. "They are a dental clinic that currently uses a human receptionist and could benefit from AI call handling" demonstrates implied interest.
• AI must disclose immediately: The AI must identify itself as an artificial system at the start of the call. GDPR Article 14 and the EU AI Act transparency requirements apply.
• Opt-out mechanism: The called business must be able to easily opt out of future calls. The AI must respect this immediately and your systems must prevent re-calling opted-out numbers.

B2C: Ausdruckliche Einwilligung (Explicit Consent)

B2C cold calling in Germany requires explicit prior consent (UWG Section 7(2)(2)). This means individual consumers must have actively agreed to receive calls before you contact them. AI cold calling to consumers in Germany without prior consent is clearly illegal.

Austria: TKG 2003 and Stricter B2B Rules

Austria is fundamentally different from Germany when it comes to cold calling. The Telekommunikationsgesetz 2003 (TKG 2003), Section 107, governs unsolicited electronic communications - and it is significantly stricter than Germany's UWG.

No Implied Consent Exception for B2B

Unlike Germany, Austria does not have a "mutmaßliche Einwilligung" exception for B2B cold calling. TKG 2003 Section 107(1) requires prior consent for all unsolicited electronic communications, including telephone calls, regardless of whether the recipient is a business or consumer. This means:

• Prior consent required: You must have explicit prior consent from the business before calling. "Implied interest" is not a valid legal basis in Austria.
• Existing business relationship: TKG 2003 Section 107(3) provides a limited exception for existing customers - you can call existing business clients about similar products or services, provided they have not opted out. But this does not extend to cold outreach to new prospects.
• RTR oversight: The Rundfunk und Telekom Regulierungs-GmbH (RTR) oversees compliance, and the Austrian courts have consistently upheld strict interpretations of Section 107.

Practical Impact for AI Cold Calling

AI cold calling to new prospects in Austria is effectively not viable without prior consent. Businesses targeting the Austrian market must use alternative lead generation methods - inbound marketing, trade shows, referrals, or email campaigns with proper consent - before initiating phone outreach. The AI voice agent can then be used for warm follow-up calls to prospects who have given consent, or for inbound reception.

Switzerland: nDSG and Non-EU Regulations

Switzerland is not an EU member state and is not subject to the GDPR, though it participates in the Schengen area and maintains close economic ties with the EU. Switzerland's data protection is governed by the revised Bundesgesetz uber den Datenschutz (nDSG), which took effect on September 1, 2023.

nDSG Key Provisions for AI Calling

The revised nDSG modernised Swiss data protection law and brought it closer to GDPR standards, but with Swiss-specific features:

• No consent requirement for B2B: Swiss law does not require consent for processing personal data in most business contexts. The nDSG operates on a "permitted unless prohibited" model rather than GDPR's "prohibited unless permitted" approach. B2B cold calling is generally allowed.
• Sternchen-Eintrag (star entry): Swiss phone directories allow individuals and businesses to mark their number with an asterisk (*), indicating they do not wish to receive unsolicited calls. Under the Federal Act against Unfair Competition (UWG), calling numbers with a star entry without consent is prohibited. AI systems must check directories before calling.
• Transparency obligation: The nDSG requires informing data subjects about data collection. For AI calls, this means disclosing the AI nature of the call and the purpose of the contact.
• FDPIC oversight: The Federal Data Protection and Information Commissioner (FDPIC) oversees compliance. The FDPIC has been increasingly active since the nDSG revision.

Cross-Border DACH Calling

When calling from one DACH country into another, the rules of the destination country apply. A German company calling Austrian businesses must comply with TKG 2003. A Swiss company calling German consumers must comply with the UWG's explicit consent requirement. AI systems must be configured to apply the correct ruleset based on the destination country of each call.

DACH Regulation Comparison

Call Recording Rules Across DACH

All three DACH countries require all-party consent for call recording, but the legal basis and criminal penalties differ:

Germany - Section 201 StGB

Recording a conversation without consent from all parties is a criminal offense under Section 201 of the German Criminal Code, punishable by up to three years in prison or a fine. The AI must inform the called party about recording and obtain verbal consent before recording begins. If consent is refused, the call must continue without recording.

Austria - Section 120 StGB

Austrian criminal law (Section 120 StGB) prohibits unauthorized interception of telecommunications. Similar to Germany, all parties must consent to recording. The penalty is up to one year imprisonment. The AI must obtain consent in the same call, before recording starts.

Switzerland - Article 179 StGB

Swiss criminal law (Article 179bis and 179ter StGB) prohibits recording private conversations without consent. Penalties include fines or imprisonment. The consent requirement applies to both audio recording and transcription of calls.

AI Disclosure Requirements

All three DACH countries require disclosure when a caller is interacting with an AI system, though the legal basis varies:

• Germany: GDPR Article 13/14 transparency obligations, plus the EU AI Act (effective 2025-2026) requires clear disclosure of AI interaction. The BfDI has published specific guidance on AI transparency.
• Austria: DSGVO transparency requirements enforced by the DSB, plus EU AI Act obligations as an EU member state.
• Switzerland: nDSG transparency obligations (Article 19-21) require informing data subjects about automated processing. While Switzerland is not subject to the EU AI Act, the nDSG's transparency provisions achieve a similar practical effect.

For AI cold calling, this means the AI must identify itself as an artificial system at the beginning of every call. The disclosure must be clear and unambiguous - not buried in fast-spoken disclaimers. For detailed guidance on AI disclosure and GDPR, see our AI voice agent GDPR compliance guide.

Compliance Checklist for AI Cold Calling

Before launching an AI cold calling campaign in any DACH market, verify each item:

Practical Strategies for DACH Markets

Given the regulatory differences, here are practical approaches for each DACH market:

Germany: Leverage Implied Consent Carefully

Germany offers the most permissive B2B cold calling environment in DACH. To maximise this legally:

• Build targeted prospect lists where implied interest is documentable - businesses in your target industry that clearly could benefit from your service.
• Train the AI to state the reason for the call and the connection to the prospect's business early in the conversation.
• Maintain a Robinsonliste (opt-out list) and cross-reference before every call.
• Keep call volumes reasonable - mass-dialing with thin implied consent documentation invites Bundesnetzagentur complaints.

Austria: Consent-First Approach

Austria's strict consent requirement means cold calling is not viable for new prospect outreach. Instead:

• Use inbound marketing, trade shows, and web forms to generate leads with calling consent.
• Deploy the AI for warm follow-up calls to prospects who have consented through other channels.
• Use the existing customer exception (TKG Section 107(3)) for similar-product upselling to current clients.
• Consider email outreach first (with proper consent) and then AI phone follow-up after email engagement.

Switzerland: Check Before Calling

Switzerland's relatively permissive B2B environment makes it attractive, but the Sternchen register check is mandatory:

• Integrate Sternchen (star entry) checking into your AI dialing system. Numbers marked with * must not be called without consent.
• The Swiss market values privacy - even where calling is legal, a respectful, transparent approach with clear AI disclosure will perform better than aggressive tactics.
• Remember that Swiss data protection fines under the nDSG are personal - they apply to the responsible individual (up to CHF 250,000), not the company. This changes the risk calculus significantly.