Is Buying Email Lists Legal? What the Law Says in 2026

Is Buying Email Lists Legal? Here's What the Law Actually Says

Your CEO just forwarded a spreadsheet of 30,000 contacts from a list vendor and wants them loaded into Mailchimp by Monday. You know something's off, but you're not sure exactly what's illegal versus just risky. This scenario plays out constantly - there's a near-identical thread on r/marketing where a marketer got the same Friday afternoon request with a purchased ZoomInfo export.

So is buying email lists legal?

Here's the direct answer: in the US, purchasing a list is legal. Using it without CAN-SPAM compliance is not. In Canada and the EU/UK, purchased lists are almost always illegal to email because the consent chain breaks. And everywhere, regardless of legality, it's a bad idea - the risks extend well beyond fines.

The Quick Answer by Jurisdiction

Buying the list isn't the problem. Hitting "send" is where the legal exposure starts.

Email List Laws, Country by Country

United States - CAN-SPAM

CAN-SPAM is one of the most permissive major email laws in the world. It doesn't require prior consent to send commercial emails. What it does require: accurate sender information, a valid physical postal address, clear identification that the message is an ad, and a functioning opt-out mechanism that stays active for at least 30 days after sending.

When someone opts out, you've got 10 business days to honor it. Miss that window and you're exposed to penalties up to $53,088 per message.

Verkada got hit with a $2.95 million FTC fine for CAN-SPAM violations - missing opt-outs, omitted physical addresses, failure to honor unsubscribes. Experian paid $650,000 for skipping unsubscribe mechanisms entirely. These aren't obscure edge cases. They're exactly the kind of mistakes that happen when someone bulk-loads a purchased list on a Friday afternoon and sends Monday morning without checking the basics.

California's CCPA/CPRA adds another wrinkle: people can opt out of having their data sold or shared, which complicates purchased-list usage for any contacts in the state.

So yes, purchasing email lists is legal in the US. But one sloppy campaign with no opt-out link can create seven-figure statutory exposure fast.

Canada - CASL

Canada's Anti-Spam Legislation flips the default. You need consent before you send, and purchased lists almost never carry valid consent.

CASL recognizes two types: express consent, which is a proactive opt-in with no expiration until withdrawn, and implied consent from an existing business relationship within 2 years or an inquiry within 6 months. Here's the critical detail for purchased lists: when a business sells a list - as opposed to selling the entire business - the CRTC's own guidance says consent doesn't transfer. The new list owner can't rely on the original company's opt-ins.

The Compu-Finder case set the tone early with $1.1 million in penalties. Enforcement has real teeth: since 2019, no Canadian organization has appeared on Spamhaus's "10 worst spammers" list.

EU and UK - GDPR + ePrivacy

GDPR consent must be freely given, specific, informed, and unambiguous. That last word kills purchased lists.

In most purchased-list scenarios, the original consent language won't name your specific organization as a sender. Generic language like "we may share your data with marketing partners" doesn't meet the bar for GDPR/ePrivacy-grade consent, which is why bought databases are functionally unusable for EU/UK email marketing.

One distinction worth knowing: "renting" a list - where the original list owner sends on your behalf - has different legal dynamics than buying outright, because the list owner remains the sender for that campaign. But it still carries brand and deliverability risks, and you've got zero control over data quality.

Fines run up to EUR20 million or 4% of global annual revenue, whichever is higher.

The Damage Beyond Fines

Legal risk is just the beginning. Let's be honest - the operational damage from emailing a purchased list can outlast any fine.

Global inbox placement averages around 84%, meaning 1 in 6 legitimate emails already miss the inbox. Purchased lists make this dramatically worse. Gmail flags senders who exceed a 0.3% complaint rate, and purchased lists routinely blow past that threshold on the first send.

Then there are spam traps. Old, recycled addresses that exist solely to catch bulk senders. Hit enough of them and you land on a Spamhaus SBL/CSS blocklist, which can push bounce rates above 60%. We've seen teams spend months recovering from a single bad send - rebuilding domain reputation is slow, painful work that doesn't show up on any vendor's pricing page.

Your ESP won't save you, either. Mailchimp explicitly prohibits purchased lists, and most major ESPs do the same. Violate the policy and you'll get suspended, sometimes permanently. That means your legitimate transactional emails - order confirmations, password resets, invoices - go dark too. (If you're already seeing issues, this breakdown of Mailchimp problems helps.)

Here's the thing: 64.6% of businesses report that deliverability issues have directly impacted revenue. Imported purchased lists also contaminate your CRM with invalid records, skewing pipeline reporting and wasting sales reps' time on dead contacts.

If your average deal size is under $25k, you almost certainly don't need a purchased list. You need 200 verified contacts in your ICP, not 30,000 unverified ones. Volume is the wrong game.

What Purchased Lists Actually Cost

Before weighing the tradeoffs, it helps to understand pricing. Expect anywhere from $0.10 to over $1.00 per contact depending on the vendor, list freshness, and targeting specificity. A targeted B2B list of 10,000 contacts typically runs $1,000-$5,000, while cheaper lists from less scrupulous vendors go for a few hundred dollars but come with far higher bounce and spam-trap rates.

The sticker price is misleading. Factor in domain reputation repair, ESP suspension risk, wasted sales cycles on dead contacts, and potential fines, and the true cost per usable contact is often 10-50x the list price. For the vast majority of B2B teams, the math simply doesn't work.

Only 23.6% of businesses verify their email lists before every campaign. Don't be the other 76%. (If you want a deeper benchmark view, start with email bounce rate and work backward.)

What to Do Instead

There's a meaningful difference between buying a stale list from a broker and building your own list with a verified B2B data platform. The first gives you someone else's outdated spreadsheet with no consent chain. The second lets you search, filter, and export contacts that are verified in real time.

Prospeo is the cleanest way to do this. You search 300M+ professional profiles with 30+ filters - industry, job title, company size, location - and every email goes through a 5-step verification process that includes spam-trap removal and honeypot filtering. The result is 98% email accuracy with a 7-day data refresh cycle, compared to the weeks- or months-old data you'd get from a purchased list. It starts free at 75 emails per month and runs about $0.01 per email on paid plans, a fraction of what traditional brokers charge. (If you're comparing options, see our guide to email list providers and the broader landscape of sales prospecting databases.)

The reframe matters: you're not buying someone else's list. You're building your own with verified data and a clear consent trail.

Skip purchased lists entirely if you're emailing anyone in the EU, UK, or Canada. Even for US-only campaigns, the deliverability risk alone makes them a bad bet for most teams. A verified data platform gives you better contacts, cleaner sends, and none of the legal headaches. If you still need to send at scale, follow a cold email marketing playbook and keep an eye on email velocity.

FAQ

Can I legally buy an email list and send cold emails?

In the US, purchasing is legal, but emailing those contacts requires full CAN-SPAM compliance - opt-out mechanisms, physical address, accurate headers. In Canada and the EU/UK, consent requirements mean purchased lists are almost always unusable. The legal risk isn't the purchase itself; it's what happens when you hit send.

Will my ESP let me upload a purchased list?

No. Mailchimp and most major ESPs explicitly prohibit purchased lists in their terms of service. Uploading one can get your account suspended and your sending domain blocklisted, damaging deliverability for every email you send, including transactional messages.

What's the safest way to get B2B email contacts?

Use a verified B2B data platform where emails are validated in real time before export. Prospeo runs every address through 5-step verification including spam-trap removal, delivering 98% accuracy. You build your own targeted list with fresh data instead of inheriting someone else's stale contacts, and you maintain a clear consent trail for every jurisdiction.

How much does a purchased email list cost?

Expect $0.10 to over $1.00 per contact depending on targeting and freshness. A targeted B2B list of 10,000 contacts typically costs $1,000-$5,000. Cheaper lists carry higher bounce rates and greater spam-trap exposure, making the true cost far higher than the sticker price once you account for deliverability damage and domain reputation repair.