Should You Buy an Email List? The Honest Answer
The pitch never changes: fifty thousand verified contacts in your industry, delivered tomorrow, a few hundred dollars. It looks like a shortcut past the slowest part of email marketing — finding people who want to hear from you. This is what the law actually says where you are, what your email platform will do about it, and what happens to the list you already worked hard to build.
The short answer
In the United States, buying a list is not automatically illegal. Almost everywhere else, it effectively is. And in every jurisdiction, the thing that stops you is not a regulator — it is your own email platform, which will suspend the account before anyone else notices.
Is buying an email list legal?
United States — legal, with conditions
CAN-SPAM is an opt-out law, not an opt-in one. The FTC's compliance guide requires accurate header information, a subject line that reflects the message, clear disclosure that the message is an advertisement, a valid physical postal address, a working opt-out mechanism, and that opt-outs are honoured within ten business days. Nothing in it requires you to have permission before the first message. So in the US, the purchase itself is not the violation.
European Union and the United Kingdom — effectively no
Under the GDPR you need a lawful basis to process someone's data. Consent a seller collected for their own purposes does not transfer to you, and legitimate interest is a hard argument to win for unsolicited marketing to people who have never heard of you. There is also a disclosure duty: when you obtain personal data from a third party rather than from the person, you generally have to tell them — normally within a month. Doing that properly means emailing your purchased list to announce that you bought their data. Read our GDPR and email marketing guide for the detail.
Canada — no
CASL requires express or implied consent before a commercial electronic message is sent. A purchased list has neither, and the CRTC can levy penalties of up to CAD $1 million per violation for an individual and CAD $10 million for a corporation.
The practical answer
Legality is the low bar, and clearing it in one country does not help you if part of the list turns out to be European. The higher bar is the contract you already signed with your email platform.
Your email platform has already said no
This is the part people discover too late. Mailchimp's acceptable use policy prohibits customers from uploading or sending campaigns to “purchased, rented, third-party, co-reg, publicly available data, or partner lists of any kind.” ActiveCampaign’s anti-spam policy is blunter still: “We do not allow any form of paid, rented, borrowed, etc. lists.” The reasoning is the same everywhere — a customer sending to bought data damages sending infrastructure the platform’s other customers share.
The consequence is not a warning email. It is usually an account suspension — and the list you spent three years building honestly goes down with the one you bought last week.
What actually happens when you press send
The bounce wave
Sold lists are old lists. They are scraped, resold and recirculated, and address decay is commonly estimated at around two percent a month as people change jobs and abandon mailboxes. A sharp rise in bounce rate — and specifically in hard bounces, the permanent kind — is one of the clearest signals a mailbox provider gets that you do not know who is on your list.
For scale: across 807,203 addresses we verified in the first half of 2026, one in ten was outright undeliverable and eight out of ten lists were at least 20% unusable — and those were lists the senders had collected themselves. A list assembled by someone else, for someone else, sold repeatedly, is not going to be cleaner than that.
Spam traps are concentrated exactly where you are buying
A recycled spam trap is an address that was once real, went dormant, and was reactivated by the mailbox provider specifically to catch senders who never clean their lists. Abandoned addresses are precisely what accumulates in a list that has been scraped and resold for years. Hitting one is not a bounce — it is a direct report to the provider that your acquisition practices are not what you claim.
The damage does not stay on the bought list
Reputation attaches to your sending domain and IP, not to the campaign. Once sender reputation drops, the mail your real subscribers asked for starts landing in spam too. If it goes far enough you end up on a blocklist, and delisting is slow, manual and entirely at the operator's discretion.
“But the seller says it is verified and opt-in”
Three things are worth asking before you believe that.
Verified when, and by whom? A verification result is a snapshot. One taken eighteen months ago describes a list that no longer exists.
Opt-in to whom? Consent is given to a specific sender for a specific purpose. It is not a property of the address that travels with it when the address is sold.
If it performed, why is it for sale? A list that reliably produced revenue would be worth more to its owner than the few hundred dollars you are being asked for.
We sell email verification, so let us be plain about its limit: verification can tell you whether an address exists and can receive mail. It cannot tell you whether the person behind it agreed to hear from you. Running a purchased list through any verifier — ours included — makes it deliverable, not lawful, and not welcome. Those are different problems and only one of them is technical.
You have already bought one. Now what?
- Do not send to it from your main domain. Whatever you decide, keep the decision away from the sending identity your real subscribers depend on.
- Work out where the people are. If a meaningful share sit in the EU, the UK or Canada, the compliant answer for that segment is not to send at all.
- Verify it before you do anything else — to measure, not to launder. A verification pass tells you how much of what you paid for is real — how much is dead, how much sits behind a catch-all, and how much is a role address nobody reads. In our experience that number is the fastest way to settle an internal argument about whether to send.
- Consider writing it off. The money is already spent. The reputation is not. Treating the purchase as a sunk cost is almost always cheaper than treating it as an asset.
What works instead
Slower, and it compounds. A list you build is a list that opens. Start with our list building strategies, use double opt-in where the extra confirmation is worth the friction, and keep what you collect clean with a regular list cleaning pass. If you want the arithmetic on what neglect costs, we put it in the real cost of a dirty email list.
Frequently asked questions
Is buying an email list illegal?
Not in the United States, where CAN-SPAM is opt-out based. Under the GDPR in the EU and UK, and under CASL in Canada, sending to a purchased list is very difficult to do lawfully because you need a lawful basis or prior consent that the seller cannot transfer to you.
Will an email verifier make a purchased list safe to send?
No. Verification removes addresses that cannot receive mail. It does not create permission, it does not make the list compliant, and it does not remove pristine spam traps, which are valid addresses that were never used by a real person, and it cannot turn a disposable address into a real subscriber.
Why did my email platform suspend my account?
Most acceptable use policies explicitly prohibit purchased, rented and third-party lists. Platforms detect them through complaint rates, bounce spikes and spam trap hits, and suspension is the standard response because the behaviour damages sending infrastructure shared with other customers.
Can I use a purchased list for cold B2B outreach?
Cold outreach and bulk marketing email are different activities with different rules, and B2B exemptions vary by country. What does not change is the technical outcome: stale addresses bounce, traps fire, and reputation damage transfers to every other message from the same domain — which is how teams end up in spam with a list they believe is clean.
How long does the reputation damage last?
There is no fixed timer. Mailbox providers weight recent sending history most heavily, so recovery depends on sustained good behaviour — the same discipline as warming a new domain — consistent volume to engaged recipients over weeks, not a single clean send. Blocklist delisting is separate and depends entirely on the operator.
