Should you buy an email list? Why it backfires and what to do instead

When growth targets loom, the offer looks tempting: pay a broker, get 50,000 "targeted, opt-in" contacts in your industry, and start mailing tomorrow. If you've searched how to buy an email list, you've seen those offers. This guide gives you the straight answer, explains what you would actually be paying for, and covers the legitimate ways to grow a list that won't cost you your sender reputation, your email platform account, or a regulator's attention.

The short answer#

Don't buy email lists, and don't rent them either. A purchased list doesn't come with consent that names you, so mailing it is generally unlawful in the EU, the UK, Canada and Australia. It breaks the acceptable use policy of nearly every email platform. And it is the classic way to hit spam traps, pile up complaints and land on a blocklist that then hurts mail to the customers who actually want it. Email verification can't rescue a bought list either, because the core problem isn't dead addresses. It's that nobody on the list asked to hear from you.

What you actually get when you buy an email list#

Brokers describe their lists as targeted, verified and opt-in. Look at how the addresses are collected and the picture changes:

• Scraped addresses. Bots crawl websites, directories and public profiles and collect anything that looks like an email address. Many are stale, and some were published precisely to catch harvesters.
• "Opt-in" from someone else's form. Sweepstakes, co-registration and "receive offers from our partners" checkboxes produce people who agreed to hear from the broker or unnamed third parties. That's not agreement to hear from you.
• Guessed addresses. Tools assemble firstname.lastname@company.com from a name and a domain. When the company uses a different format, the guess bounces.
• The same file, sold many times. Every buyer mails the same people, who are fatigued and quick to report spam.

What you don't get is any record of who agreed to what, when, or where. That record is what the law and your email platform will ask for.

Renting is the same deal with less visibility. The broker sends your message to its list on your behalf, you never see the addresses, and your brand sits in the From line of every unwanted email. Under CAN-SPAM, the business whose product is advertised stays responsible even when someone else presses send, as the CAN-SPAM compliance guide explains.

Buying email lists and the law#

Email law splits into two camps: opt-in regimes that require permission before you send, and opt-out regimes that let you send until someone says stop. A purchased list fails the first camp outright and still creates exposure in the second. The overview of email marketing laws by country maps which camp applies where.

GDPR and UK GDPR#

In the EU and UK, marketing email generally needs consent, and that consent has to be specific and informed: the person must know who will be emailing them. Consent given to "selected partners" doesn't name you, so it doesn't cover you. You must also be able to demonstrate consent for each address, and a broker's assurance that the list is "GDPR compliant" is not that evidence. GDPR adds one more obligation when you obtain personal data from a third party: you have to tell the people concerned where you got their data. Purchased lists essentially never carry valid consent for the buyer. The GDPR email marketing guide covers what valid consent looks like.

CASL in Canada#

CASL requires consent before you send a commercial electronic message to a Canadian address, along with sender identification and a working unsubscribe. A message that asks for consent counts as a commercial message too, so you can't email a bought list to ask permission. Penalties for businesses reach up to C$10 million per violation. The CASL compliance guide explains express and implied consent.

Australia's Spam Act#

Australia's Spam Act 2003 requires consent for commercial email and goes further: it expressly prohibits supplying, acquiring or using address-harvesting software and harvested-address lists.

CAN-SPAM in the United States#

CAN-SPAM is the exception people point to, because it doesn't require opt-in. Buying a list isn't banned outright in the US. But sending commercial email to addresses obtained by harvesting or dictionary attacks is an aggravated violation that increases penalties, and every other rule still applies: honest headers and subject lines, a physical postal address, and a working opt-out honored within 10 business days. A bought list can also contain people who already unsubscribed from you, so you would still have to scrub it against your own suppression list. The email compliance checklist covers the rules that apply to every send.

Your email platform will probably say no#

Leave the law aside and you still hit your email service provider's terms. Most ESPs' acceptable use policies prohibit purchased, rented or scraped lists, and many ask you to confirm at import that every contact opted in to hear from you.

Platforms enforce this because they share infrastructure. On a shared IP pool, one customer's bought list damages delivery for every other customer, so ESPs watch bounce and complaint rates on new imports closely. Outcomes range from a paused campaign to a closed account, sometimes with your legitimate subscribers stuck behind the suspension.

Spam traps, complaints and blocklists#

Even if a purchased list were legal and your platform allowed it, the deliverability math doesn't work.

Pristine spam traps. These are addresses that never belonged to a real person. Trap operators plant them where only harvesters will find them, which means they collect in scraped and purchased lists. A hit tells blocklist operators your list came from a source no permission-based sender uses. The guide to spam traps explains the three trap types.

Complaints. People who never heard of you report your message as spam. Gmail and Yahoo require bulk senders to stay under a 0.3% spam complaint rate. On a 10,000-recipient send, that's 30 complaints. A list of strangers can pass that on the first send.

Blocklists. Trap hits and complaints are what get domains and IPs listed by operators like Spamhaus. A listing doesn't only affect the campaign that caused it; it affects every message from that domain or IP, including receipts and password resets if they share it. The guide to what happens when you're blacklisted covers the fallout, and how to avoid email blacklists covers the habits that keep you off them. If you've already mailed a purchased list, run your domain and sending IPs through the blacklist checker.

Why verification can't fix a bought list#

Email verification answers one question: does this mailbox exist and accept mail? On a purchased list that removes some dead addresses and lowers the hard bounce count. It can't do the rest:

• It can't create consent. A mailbox that exists is not a person who agreed to hear from you.
• It can't detect pristine traps. A live trap accepts mail like any real mailbox, so it passes verification.
• It can't create interest. A clean list of strangers still complains.
• It doesn't satisfy your ESP's terms or any consent-based law.

So we don't recommend running a purchased list through any verifier, ours included, as a way to make it sendable. Verification is the right tool for a list people actually joined, where the problem is addresses decaying over time. It is the wrong tool for a list whose problem is where it came from.

Lists you legitimately inherit#

Some lists arrive from outside your own signup forms and are still usable, because the people on them did agree to hear from you, or from a business that is now yours.

• A business you acquired. Customer data can move with a business. Those customers agreed to hear from the company they bought from, so keep that brand visible, tell them about the change, and send a re-permission email before adding them to regular campaigns. Under GDPR, the new use must stay compatible with what they originally signed up for.
• A co-hosted event, webinar or report. This works only if the signup form named your company and the attendee actively opted in to hear from you. Ask your partner for the consent records: the form wording, timestamps and source. Generic "share my details with sponsors" wording is a weak foundation.

These lists still need care, because they may be old and unfamiliar with your brand. Verify them before the first send; Qualisend can check an uploaded CSV or clean a list in place inside the connected platforms listed on the integrations page. Then follow the restart plan in how to safely email an old email list.

Cold B2B outreach is a different practice#

Some teams treat cold outreach and list buying as the same thing. Done properly, they aren't. Legitimate B2B prospecting is one-to-one: a small number of researched prospects, each message relevant to that person's role, sent at low volume from a separate sending domain so a mistake doesn't land on your main one, and within local law. CAN-SPAM permits it with a working opt-out; in Europe the rules for business addresses differ from country to country; Canada generally requires consent. It is not a loophole for blasting a purchased file.

If you prospect this way, cold email deliverability covers domains, warm-up and volume, and email verification for cold email covers checking each prospect address before you send.

What to do instead: build a list that's yours#

A list people joined on purpose is smaller at first and worth far more. These tactics produce consent you can prove:

Then protect what you build. Confirm new subscribers with double opt-in or verify each address as it is entered through the Qualisend API, so typos and disposable addresses never get in. Block bots before they fill your forms, as covered in how to stop fake email signups. A list built this way grows slower in week one and faster in year one, because the people on it open, click and buy.

Building your list the slow, legitimate way? Keep it clean as it grows: check any address with the free email checker, or verify signups in real time with the Qualisend API.