Is It Illegal to Buy Email Lists? The 2026 Legal Reality

TL;DR

• Buying an email list is not, by itself, a crime in the United States. Sending to it can still break CAN-SPAM, and in the EU the purchase is legal while the sending is almost never lawful.
• The legal question splits into two parts that people constantly merge: acquiring the data (privacy law) and contacting the people on it (anti-spam law). GDPR polices the first. CAN-SPAM polices the second. CASL polices both.
• Penalties are real but rare. Deliverability damage is near-certain: bought lists routinely bounce at 20-40% and carry spam traps that get your domain blocklisted in one send.
• Licensed, consent-documented B2B data from a reputable vendor is a different product from a $99 "10 million contacts" CSV, even though both get called "buying a list."
• The compliant path is to build the list yourself: identify target accounts, find role-based contacts, verify every address, and keep an audit trail of where each record came from.

This article explains the rules as they stand in 2026. It is not legal advice, and if you operate across the EU, UK and Canada simultaneously, have counsel review your process.

Is It Illegal to Buy Email Lists?#

Short answer: buying the list is usually legal, using it usually is not — and the gap between those two facts is where companies get hurt.

In the United States, no federal statute prohibits the sale or purchase of a commercial email list. CAN-SPAM regulates the message, not the acquisition. You can legally buy a file of 50,000 addresses on Monday and legally email all of them on Tuesday, provided every message has accurate headers, a non-deceptive subject line, a physical mailing address, a working one-click unsubscribe honored within 10 business days, and a clear indication that it is an advertisement. The FTC's CAN-SPAM compliance guide is blunt about this: there is no opt-in requirement in US federal law.

In the European Economic Area, the calculus inverts. GDPR requires a lawful basis for processing personal data, and a work email like firstname.lastname@company.com is personal data. A purchased list almost never comes with a lawful basis you can actually evidence. Consent must be freely given, specific, informed and unambiguous, and consent collected by a third party for "partner offers" does not transfer to you. Legitimate interest is theoretically available for B2B prospecting, but it requires a documented balancing test, a data source you can name, and an Article 14 notice to the person within one month of obtaining their data. Most list vendors cannot help you with any of that.

Canada is the strictest of the three. CASL requires express or implied consent before the first commercial electronic message. Buying a list does not create consent. The CRTC's anti-spam guidance puts the burden of proof on the sender, which means "the vendor told me they were opted in" is not a defense.

What Do the Major Laws Actually Say?#

Two patterns fall out of that table. First, the US is the outlier, not the norm. If any meaningful share of your list sits in Europe or Canada, "CAN-SPAM says it's fine" is the wrong analysis. Second, enforcement follows complaints. Regulators do not audit CSVs. They respond when recipients report you, which is exactly what bought lists generate at scale.

What's the Difference Between Buying a List and Licensing B2B Data?#

The phrase "buying an email list" covers two products with almost nothing in common. Confusing them is why the legal answer feels slippery.

1. The bulk CSV. A one-time file sold by an anonymous broker, often scraped or resold several times over, with no record of source, no refresh cycle, and no contractual warranties. This is the product that produces 30% bounce rates and blocklistings. It is also the one where you have no answer when a recipient asks "where did you get my address?" — a question you are legally required to answer in the EU.
2. The licensed database. A subscription to a maintained dataset from a named company with a DPA, documented sourcing, opt-out suppression, and regular reverification. Vendors like BookYourData sit here: you are licensing access to verified, continuously maintained records under a contract, not buying an orphaned file. That contractual paper trail is what makes a legitimate-interest assessment survivable.
3. The enrichment layer. You bring your own target list (from your CRM, a conference, your website traffic) and a provider appends verified emails, phone numbers and firmographics. Because you chose the accounts, you can articulate why each contact is relevant — the core of a legitimate-interest argument.
4. Self-sourced discovery. You identify the company, find the right role, and resolve that specific person's work address with an email finder. Volume is lower, relevance is far higher, and provenance is clean.
5. Pure opt-in. Newsletter subscribers, demo requests, content downloads with an unbundled consent checkbox. The only category that is unambiguously legal everywhere, and the slowest to scale.

Options 3, 4 and 5 are defensible in every jurisdiction in the table above. Option 1 is defensible almost nowhere. Option 2 depends entirely on the vendor's documentation quality — which is exactly what you should be interrogating before you sign.

Why Do Bought Lists Fail Even When They're Legal?#

Set the law aside for a second and assume you are a US company emailing US contacts with perfect CAN-SPAM compliance. Bought lists still underperform, for four mechanical reasons.

Decay. B2B contact data goes stale at roughly 25-30% per year. People change jobs, companies rebrand, mailboxes get deprovisioned. A list assembled 18 months ago is closer to half-dead than fresh. HubSpot's own research on database decay has been making this point for a decade and the number has not improved.

Spam traps. Recycled traps are abandoned addresses that mailbox providers reactivate specifically to catch senders who never clean their lists. Pristine traps were never real addresses at all and only appear in scraped data. Hitting either one tells Spamhaus and Microsoft exactly what you are doing. One send to a trap-laden file can cost you a domain.

Complaint rate. Google and Yahoo both enforce a 0.3% spam-complaint ceiling for bulk senders, with 0.1% as the target. Cold recipients who never heard of you complain at multiples of that. You do not get a warning; you get throttled, then foldered, then blocked.

Duplication. If a broker sold that file to you, it sold it to 40 other companies. Your prospect is receiving the same pitch from a dozen vendors this quarter. Reply rates on multi-sold lists sit near zero regardless of how good your copy is.

What Happens to Your Sender Reputation?#

The damage compounds faster than most teams expect. A single campaign to a 20,000-record purchased file typically produces something like 5,000 hard bounces, 40-80 complaints, and one or two trap hits. That combination pushes your domain onto a blocklist within 24-48 hours.

Recovery is not a weekend project. You are looking at a new sending domain, four to six weeks of warmup, and a permanently scarred root-domain reputation if you sent from your primary domain rather than a dedicated cold-outreach domain. Meanwhile your transactional email — password resets, invoices, onboarding sequences — degrades along with it, because mailbox providers evaluate sender reputation at the domain level.

The preventable version of this is dull and effective: never send to an address you have not verified. Running a file through an email verifier before the first send catches syntax errors, dead mailboxes, role accounts, disposable domains and known traps. On a purchased list it will also tell you, in about four minutes, exactly how bad the file you just paid for actually is.

Is Buying a List Cheaper Than Building One?#

Per raw record, yes. Per usable record, almost never. Here is the arithmetic on a 10,000-record target, using conservative deliverability assumptions.

A 0.3% reply rate on 7,000 delivered messages is 21 conversations. A 5% reply rate on 3,000 tightly-targeted messages is 150. The "cheap" list costs more per meeting booked, before you price in the domain you might lose.

How Do You Build a Compliant List Instead?#

The replacement workflow is four steps and it is not slow once it is set up.

1. Define the account list first, not the contact list. Firmographics, tech stack, headcount, funding stage, geography. If you cannot explain why a company is on the list, you have no legitimate interest to assert and no reason to email them.
2. Find the roles that matter. For each target domain, pull the people in the relevant function rather than everyone with a mailbox. A domain search returns known addresses at a company along with the pattern the company uses, so you can target three decision-makers instead of importing 200 employees.
3. Verify before the first send, every time. Run the full file through verification, drop everything that is not deliverable, and handle catch-all domains separately with a catch-all verifier rather than guessing. For large batches, bulk verify on a schedule and re-check anything older than 90 days.
4. Keep the provenance record. Store, per contact: the source, the date acquired, the confidence score, and the lawful basis you are relying on. If a European recipient invokes Article 15, you need to answer within a month. If you cannot, that is the violation — not the email itself.

Add a suppression list that survives forever, honor unsubscribes inside 48 hours rather than the legal 10 days, and include a plain-language line in your footer stating how you found them. That last one sounds like a liability. In practice it reduces complaints, because "I found your details on your company's team page" reads as human rather than harvested.

What Should You Ask a Data Vendor Before Buying?#

If you are evaluating a paid data source, these six questions separate the licensed providers from the brokers:

• Where did this record come from? A real vendor names its collection methods. Check whether they publish a data sources page at all.
• Will you sign a DPA and act as processor or controller? If the vendor cannot say which role it occupies under GDPR, it has not thought about GDPR.
• How often is each record reverified? "Continuously" is marketing. Ask for the median record age.
• Do you suppress opt-outs globally? When someone unsubscribes from you, the vendor should not resell that record to your competitor next month.
• What's your guaranteed bounce rate, and what happens if you miss it? Credit-back guarantees are a proxy for confidence.
• Can I buy 100 records first? Any vendor refusing a paid sample is telling you something.

Reputable vendors answer all six without hesitation. Brokers change the subject to volume and price.

Find Contacts You Can Actually Defend#

The legal question has a practical answer: stop acquiring lists and start resolving contacts. Tomba's Email Finder returns verified work addresses for specific people at specific companies, with a confidence score and the sources behind each result, so every record in your CRM has a provenance trail instead of a shrug. Verification is built in, catch-all domains get handled properly, and the Free tier gives you 25 searches a month to test the accuracy against a list you already own. Paid plans start at $49/mo, with Growth at $99/mo and Pro at $249/mo — see Tomba pricing for full credit allowances.

Build the list once, verify it continuously, and you will never have to ask whether the file on your desktop is going to cost you your sending domain.

Related guides#

• B2B Email Lists for Sale in 2026: Buy, Build, or Skip?
• CAN-SPAM Act Email Marketing: The 2026 Compliance Guide
• Are Cold Emails Legal in 2026? CAN-SPAM, GDPR & CASL Rules
• Beware: Buying Email Lists Can Backfire