Is Buying Email Lists Legal? GDPR, CAN-SPAM Rules 2026

TL;DR

• Buying an email list is legal in the United States under CAN-SPAM, which regulates how you send, not where the address came from.
• It is effectively illegal in the EU, UK, and Canada for most B2C and much B2B use, because GDPR, PECR, and CASL require a lawful basis or prior consent that a third-party seller almost never transfers to you.
• Legality is the low bar. The higher bar is deliverability — Google and Microsoft now judge you on complaint rate and engagement, and cold-bought lists fail both.
• A reputable B2B data vendor with documented sourcing (BookYourData, for example) is a legitimate option for US-focused prospecting. A $40 "2 million contacts" torrent is not.
• The safest pattern in 2026: define your target accounts first, then find and verify each address at the moment you need it rather than renting a static file.

This is a practical guide, not legal advice. If you are sending at volume into the EU, have counsel review your process.

What does "buying an email list" actually mean?#

The phrase covers three very different transactions, and people argue past each other because they are each picturing a different one.

1. A scraped dump. Someone ran a crawler or bought a breach compilation, dropped it into a CSV, and sells it for the price of a coffee. Zero provenance, zero consent, high bounce rate. This is the version that gets you blacklisted.
2. A licensed B2B database. A vendor compiles business contact data from public filings, company websites, partner networks, and opt-in sources, verifies it, documents where each field came from, and licenses you access under terms. Vendors like BookYourData sit here — you are buying a curated, verified, contractually-backed dataset, not a mystery file.
3. A rented list. You never receive the addresses. The list owner sends your message on your behalf to their subscribers. This is the most legally defensible model in Europe, because the consent stays with the party that collected it.

When people ask "is buying email lists legal," they usually mean option 1 or 2. The legal answer diverges sharply by jurisdiction, so let's take them one at a time.

Is buying email lists legal in the United States?#

Yes — with conditions.

The CAN-SPAM Act is an opt-out regime. It does not require that a recipient consented before you email them. It requires that your commercial message:

• Uses accurate header and "From" information
• Uses a subject line that is not deceptive
• Identifies itself as an advertisement if the relationship isn't obvious
• Includes a valid physical postal address
• Offers a clear, working opt-out mechanism
• Honors opt-outs within 10 business days

Nothing in that list forbids buying the address. The FTC's penalty exposure is per-email and substantial, but it attaches to how you send, not to the acquisition.

Two caveats most people miss. First, CAN-SPAM makes the sender and the advertiser both liable — you cannot outsource the risk to an agency. Second, several states layer on extra rules, and California's CCPA/CPRA gives residents the right to know what personal information you hold about them and where you got it. If you bought a list and cannot answer "where did this come from," you have a CCPA problem even though you do not have a CAN-SPAM problem.

)

Is buying email lists legal under GDPR?#

Practically, no. Technically, "almost never, and you probably can't prove it."

GDPR does not ban purchased data outright. It requires a lawful basis under Article 6 for processing personal data — and a work email like firstname.lastname@company.com is personal data. The two bases people try to use:

• Consent. The recipient must have given specific, informed, freely-given consent for your processing, for your purpose. A checkbox on a third party's webinar form saying "I agree to receive offers from partners" does not survive scrutiny. Consent is not transferable in bulk.
• Legitimate interest. This is the realistic route for B2B. You must run and document a legitimate interest assessment (LIA) balancing your commercial interest against the recipient's rights and reasonable expectations. It can work for relevant, targeted B2B outreach to a person whose job function directly relates to what you sell. It collapses if you blast 50,000 contacts indiscriminately.

Then Article 14 lands on top: when you obtain personal data from a source other than the individual, you must tell them — within a month, or at first contact — that you hold their data, what you are doing with it, and where you got it. Most bought-list senders never do this. That omission alone is a violation independent of whether the outreach itself was justified.

The ePrivacy Directive adds a national layer. Some member states treat unsolicited B2B email as permissible; others require prior consent for any electronic marketing regardless of B2B status. The legality of the same campaign genuinely changes when you cross a border inside the EU.

How do the major jurisdictions compare?#

Two patterns fall out of that table. The US is the outlier that permits cold purchased outreach. And the UK's B2B carve-out is narrower than LinkedIn folklore suggests — info@ltd-company.co.uk is treated differently from a sole trader's address, and UK GDPR still applies to the underlying data even when PECR consent is not required.

Why do purchased lists fail even when they're legal?#

Because the mailbox providers have their own rulebook, and it is stricter than any statute.

Since the 2024 bulk-sender requirements rolled out, Gmail and Yahoo hold senders to a spam complaint threshold — stay under 0.10%, never cross 0.30%. A purchased list blows through this on the first send for three compounding reasons:

• Stale data. B2B contact data decays roughly 2–3% per month through job changes, rebrands, and departures. A list compiled eighteen months ago is largely fiction.
• Spam traps. Recycled traps are real addresses that were abandoned and repurposed by providers specifically to catch senders using old, unmaintained data. Cheap lists are full of them. One hit can trigger a blocklist entry.
• Zero recognition. Recipients who have no idea who you are hit "report spam" instead of "unsubscribe" — and report-spam is the click that destroys email deliverability.

The financial math is brutal. A $500 list of 100,000 contacts looks cheap next to per-credit lookups. But if 30% bounce, 5% are traps, and your domain reputation is torched for the next quarter, you did not buy 100,000 leads. You bought one ruined sending domain and a rebuild project.

)

Bought list vs. built list vs. found-and-verified: which should you use?#

The honest read: the licensed database and the find-and-verify approach are both defensible. They solve different problems. If you need 20,000 US SMB contacts in a specific SIC code this week, a reputable licensed vendor is the efficient path. If you have a defined list of 400 target accounts and need the right five people at each, per-contact lookup is cheaper, fresher, and far easier to justify to a DPO.

What is never defensible is the flat-fee mystery CSV. There is no scenario in 2026 where that math works.

How do you buy a list without breaking the law?#

If you are going to buy, buy properly. Six non-negotiables:

1. Demand documented provenance. Ask the vendor, in writing, where each data category originates and under what legal basis they process it. A vendor who cannot answer this in a sentence is selling you liability.
2. Get the contract right. You need a data processing agreement, an indemnity for unlawfully-sourced records, and confirmation of the vendor's own Article 14 posture. "Terms of service" on a checkout page is not enough.
3. Segment by jurisdiction before you send. Split the file by country and apply the strictest applicable rule per segment. Do not run one campaign across US, EU, and Canadian contacts.
4. Re-verify everything on arrival. Never send to vendor-supplied data without running it through your own email verifier first. Vendor freshness claims and your actual bounce rate are different numbers. A bulk verify pass before first send routinely removes 10–20% of a "verified" file.
5. Suppress aggressively. Build a global suppression list of prior opt-outs, competitor domains, role accounts (info@, sales@, noreply@), and anything that bounced once. Honor opt-outs across every list you own, not just the one that generated the request.
6. Warm up and ramp. Send from a subdomain, start at low daily volume, and watch complaint rate daily. If it crosses 0.1%, stop and fix the targeting — the list is telling you it was wrong.

What's the compliant alternative to buying a list?#

Invert the order of operations. Instead of buying addresses and looking for people to sell to, define the accounts first and resolve the contacts second.

The workflow looks like this. Build your ICP account list from firmographic filters — industry, headcount, tech stack, funding stage. Identify the specific roles that own the problem you solve. Then resolve each individual's business address through a domain search against the company, or a direct lookup by name and company, and verify before the address ever enters your sequence.

That approach costs more per contact and dramatically less per meeting. It also produces a paper trail: for any given contact you can state the source, the date resolved, the business justification for contacting that role, and the verification result. That record is what turns a legitimate interest assessment from a hope into a document.

It also fixes the relevance problem, which is the real reason most cold email fails. A 400-contact list where every recipient genuinely owns the pain outperforms a 40,000-contact list every quarter, and it does it without putting your domain at risk.

Is buying email lists legal — the short verdict#

Legal in the US if you follow CAN-SPAM's sending rules. Broadly indefensible in the EU, UK, Canada, and Australia without consent or a documented, narrow legitimate-interest case. And regardless of jurisdiction, commercially unwise unless the data is licensed, documented, fresh, and re-verified on arrival.

The legality question is the one everyone asks. The one that actually determines whether outbound works is: can you show, for every address in your sequence, where it came from and that it is live? If yes, you are compliant and deliverable. If no, the law is the second-largest of your problems.

Stop renting stale files. Use the Tomba Email Finder to resolve verified business addresses for the accounts you actually want — by domain, by name, or in bulk — with sourcing you can point to when someone asks. The free tier covers 25 searches a month so you can compare accuracy against whatever list you were about to buy; paid plans start at $49/month, and full Tomba pricing scales with volume rather than locking you into a one-time file that starts decaying the day it lands.

Related guides#

• B2B Email Lists for Sale in 2026: Buy, Build, or Skip?
• Best B2B Email List Providers in 2026: A Buyer's Guide
• B2B Mailing List: How to Build a Clean One in 2026
• B2B Compliance in 2026: GDPR, CAN-SPAM & Data Rules Guide