Buy Email List or Build One? Legal Rules, Real Costs and Better Options (2026)

The CAN-SPAM Act "makes no exception for business-to-business email," and each email that violates it can cost up to $53,088, according to the FTC's compliance guide. In Canada, a purchased list doesn't give you consent to email anyone on it: the CRTC's CASL guidance says a third party selling a list of published addresses does not, on its own, create implied consent.

So the real question isn't whether you can buy an email list. You can. It's whether you can use it legally, and whether it will produce anything except bounces. This guide explains the law in the US, EU, UK and Canada, what bought lists actually cost, how to vet a provider if you buy, and the alternatives that usually work better.

This article is general information, not legal advice. Check the rules that apply to your business with a qualified adviser.

Get thousands of leads in 4 minutes.

Stop stitching tools together.
Start with verified sales data, delivered in minutes.

SCALE SALES NOW

No contracts · No setup · No sales call

Can you buy a list of email addresses?

Yes. Many companies sell email lists, and they come in four main types:

• B2B lists contain business contacts, such as names, job titles, company names and work email addresses.
• B2C lists contain consumers' personal email addresses.
• Rented lists never reach you. The provider sends your message to its list on your behalf.
• Scraped lists are compiled by software that collects addresses from websites and directories.

The type matters more than anything else. As Is Cold Email Legal? puts it, the meaningful legal line runs between consumer lists and properly sourced B2B contact data.

Is it legal to buy email lists?

No major law bans buying a list. The laws regulate what you do with it, and the rules differ sharply by country:

United States. CAN-SPAM doesn't require consent before sending commercial email, but every message must have accurate headers, an honest subject line, your physical postal address and a working opt-out honored within 10 business days, according to the FTC. Two details matter for bought lists. First, harvesting addresses or generating them through "dictionary attacks" is an aggravated violation that can carry criminal penalties. Second, both the company that sends the email and the company being promoted can be held responsible.

European Union and UK. Under the GDPR, an email address that identifies a person is personal data, and you need a lawful basis to use it. Recital 47 says direct marketing may be a legitimate interest, but only after weighing people's reasonable expectations. The UK regulator, the ICO, says you must do a three-part test and should document it before you start. And because bought data didn't come from the person directly, Article 14 requires you to tell them where you got it, at the latest when you first contact them.

Canada. CASL requires consent before you send a commercial email. Consent can be implied when someone has conspicuously published their business address and your message is relevant to their role, but the CRTC is explicit that a list resold by a third party doesn't create that consent on its own. Penalties reach $1 million per violation for individuals and $10 million for businesses.

The practical takeaway: a well-sourced B2B list used for relevant, honest outreach can be lawful in the US and defensible in Europe. A consumer list rarely is anywhere outside the US.

Is buying email lists a good idea?

Usually not, even when it's legal. The legal risk is real, but the bigger problem is performance.

• Spam traps. Mailbox providers and blocklists create addresses specifically to catch senders with poor list practices. Zoho's deliverability guide describes three kinds: pristine traps planted on websites, recycled traps made from abandoned addresses, and typo addresses. Bought lists often contain all three.
• Bounces. People change jobs constantly, so static lists decay. Instantly's compliance guide notes that bounce rates above 2% damage sender reputation and spam complaints above 0.3% trigger filtering or blocks from Gmail and Yahoo, in line with Google's sender guidelines.
• Account suspension. Many email platforms don't allow purchased lists. Zoho, for example, suspends sending when bounce or spam rates exceed its thresholds, and Validity warns that many providers may suspend accounts that use bought lists.
• No exclusivity. The same file is often sold to many buyers, so your prospects may already be tired of similar pitches. MailerCheck points out that "opt-in" lists usually mean people opted in to something else, often through partner checkboxes, not to hearing from you.
• No context. A name and address give you nothing to personalize with, and generic messages get ignored.

Bought lists vs. verified B2B data vs. opt-in lists

Not every way of getting contacts carries the same risk:

How much does an email list cost?

Prices vary widely by quality. UpLead puts B2B email list pricing at $0.02 to $3.00 per contact, depending on verification and data type. Bookyourdata, one of the largest list sellers, publishes pay-as-you-go pricing from $99 for 250 contacts, or about $0.40 each, down to about $0.10 each at 10,000 contacts.

The sticker price is the wrong number to compare. What matters is the cost per usable contact: what you paid divided by the contacts that are valid, relevant and reachable. A cheap list with a 25% bounce rate and no relevance can cost more per real conversation than a smaller, verified list.

How much is an email list worth?

An email list is worth what it produces. A simple way to estimate it:

1. Multiply the number of usable contacts by your expected reply rate.
2. Multiply that by your reply-to-meeting and meeting-to-customer rates.
3. Multiply the result by your average customer value.

If the answer is lower than the list price plus the cost of your time and any deliverability damage, the list isn't worth buying. For most bought lists, the reply rate is the number that sinks the math.

A worked example: what a bought list really costs

Say you buy 5,000 contacts at $0.10 each for $500. A realistic picture for a generic file looks like this:

1. Bounces: if 20% of the addresses bounce, 1,000 are gone, and sending to them can push your bounce rate far above the 2% danger line.
2. Relevance: of the 4,000 that deliver, perhaps half match your ideal customer closely enough to care.
3. Replies: at a 1% reply rate on those 2,000, you get about 20 replies, and only some will be positive.

That's roughly $25 per reply before you count the hours spent cleaning data or the cost of a damaged sending domain. Compare that with a smaller list of 500 verified, well-matched contacts. At even a 5% reply rate, it produces about 25 replies, with far less risk. The numbers are illustrative, but the pattern is consistent: relevance and accuracy drive results, not list size.

Red flags that a list seller is selling a bad list

• Huge record counts at very low prices, such as millions of contacts for a few hundred dollars.
• No free sample, or a sample hand-picked by the seller rather than drawn from your own criteria.
• Personal email addresses in a list sold as B2B.
• "Opt-in" claims with no proof of who opted in, when and to what.
• No verification date or refusal to say when the data was last checked.
• No data processing agreement for European contacts.
• No way for people to opt out or have their data removed at the source.

If you buy: a 10-point vetting checklist

If you decide to buy, these checks separate a usable B2B list from a liability:

1. Documented sourcing: the provider can explain where each contact came from.
2. Verification date: emails were verified recently, ideally at the time of export.
3. Business contacts only: work addresses, with no personal Gmail or Yahoo accounts.
4. Targeting you control: you build the list from your own criteria rather than buying a generic file.
5. A free sample: test 100 to 200 contacts before paying for more.
6. Bounce guarantee or credits: the provider stands behind its accuracy.
7. A data processing agreement: essential for any EU or UK contacts.
8. Opt-out handling: the provider removes people who object and tells you how.
9. Suppression against your own lists: remove existing customers and anyone who has opted out.
10. A separate sending setup: keep new contacts away from your main domain until results prove the data is clean.

How to use a B2B list responsibly

• Make every email CAN-SPAM compliant: accurate sender details, honest subject line, postal address and a working opt-out.
• Document your legitimate interest assessment for EU and UK contacts, as the ICO describes, and tell people where you got their details.
• Keep messages relevant to the recipient's role, which matters for both GDPR balancing and CASL's published-address rules.
• Verify before you send and start with small batches to watch bounces and complaints.
• Honor opt-outs everywhere, across every rep and tool, within 10 business days or faster.

Better alternatives to buying email lists

1. Build your own list from your ideal customer profile using a data source that verifies contacts. Our guide to building a lead list walks through it step by step.
2. Use a verified B2B data platform where you choose the criteria, rather than buying a ready-made file. See our best B2B data providers for options.
3. Grow an opt-in list with useful content, webinars and tools.
4. Work events and partnerships, where contacts have a reason to hear from you.
5. Act on buying signals, such as funding or hiring, so outreach arrives at the right time. Our guide to buyer intent data covers the main signals.

Spona: verified leads instead of a bought list

A bought list is a static file that someone else built. Spona builds your list for you, from your own criteria, at the moment you need it. You describe your ideal customer in a chat, and Spona's AI mines 40+ data sources, finds matching companies and decision-makers, validates every lead across its digital footprint and scores it, with the reasoning behind each match.

• See before you buy: free sample leads, a per-lead price and a market size analysis come first.
• Verified, not recycled: Spona states its leads are 95% accurate, and each one is validated before you receive it.
• Pay only for what fits: credits cost $0.008 to $0.01, so bulk leads come to about $0.01 to $0.09 each and qualified, scored leads about $0.32 to $4.00.
• Any market: B2B companies, local businesses, Shopify stores and venture-backed companies, plus enrichment for your CRM with whitelisting and blacklisting.
• Proven results: Qonto saw an 80% higher connect rate and Kaiko a 65% higher connect rate after switching to Spona data, and Zizr tripled its outbound demo bookings.

Get thousands of leads in 4 minutes.

Stop stitching tools together.
Start with verified sales data, delivered in minutes.

SCALE SALES NOW

No contracts · No setup · No sales call

FAQ

Is it legal to buy email lists?

Buying a list isn't illegal in most places, but using it is regulated. In the US, CAN-SPAM requires honest headers, a postal address and a working opt-out. In the EU and UK, you need a lawful basis such as documented legitimate interest. In Canada, CASL requires consent, and a resold list doesn't provide it on its own.

Can you buy a list of email addresses?

Yes. Providers sell B2B, consumer, rented and scraped lists. B2B lists of work addresses, sourced and verified properly, carry far less risk than consumer or scraped lists.

Is buying email lists a good idea?

Usually not. Bought lists often contain spam traps and outdated addresses, can get your email account suspended and produce few replies. Building a verified list from your own criteria usually works better.

How much is an email list worth?

It's worth the revenue it produces: usable contacts multiplied by your reply, meeting and close rates and your average customer value. Compare that with the list price plus the cost of your time and any damage to your sender reputation.

Can I use a purchased list with Mailchimp or HubSpot?

Many email marketing platforms prohibit purchased lists in their terms and may suspend accounts that use them. Check your provider's acceptable use policy before importing any bought data.

What is the difference between buying a list and using a B2B data platform?

A bought list is a fixed file built for many buyers. A B2B data platform lets you choose your own criteria, verify contacts at export and pay for the leads you actually use.

Sources

• FTC: CAN-SPAM Act compliance guide for business (official)
• CRTC: Frequently asked questions about Canada's Anti-Spam Legislation (CASL)
• Is Cold Email Legal?: Is buying email lists legal? (US, EU and Canada)
• GDPR Recital 47: legitimate interest
• ICO: How do we apply legitimate interests in practice?
• GDPR Article 14: information where data was not obtained from the person
• Zoho Campaigns: why you should never purchase mailing lists
• Instantly: GDPR, CAN-SPAM and B2B email list compliance
• Google: email sender guidelines
• Validity: why you shouldn't buy email lists
• MailerCheck: 7 things to know when buying an email list
• UpLead: buy email lists, pros, cons, risks and providers (2026)
• Bookyourdata: is buying email lists legal? (pricing included)