Buying an email list can save a sales team months of manual research. It can also leave a business with bounced campaigns, a blocked sending domain and, in some countries, a letter from a regulator. Which of those happens usually comes down to three things: who is on the list, where those people are based, and how carefully the data has been checked.
This guide covers all three in plain terms. It explains when buying a list is lawful, how to tell good data from bad, what lists cost, and how to use purchased contacts without damaging your sender reputation.
What You Are Actually Paying For
An email list is a file of contact records. A typical B2B record includes a name, job title, company, business email address, phone number, industry, company size and location. A B2C (consumer) record covers individuals rather than people at organisations, and is usually segmented by location, age band or interests.
When you buy a list, you are really paying for three things:
- Coverage: whether the list reaches the people you need, in the right countries, industries and roles.
- Accuracy: whether the email addresses and job details are still correct today.
- Usability: the format, the licence (single use or ongoing), and whether you can lawfully email the contacts where they live.
Most problems with bought lists come from the last two. A cheap list with poor accuracy costs more in bounces and lost reputation than it saves, and a list you cannot legally email is worth nothing at all.
Is It Legal to Buy an Email List?
In most countries, buying contact data is not illegal in itself. What matters is how you use it, and the rules depend on two things: the country the recipient is in, and whether you are emailing a business or a consumer. Here is how the main regions compare.
United States: CAN-SPAM
The US uses an opt-out model. Under the CAN-SPAM Act you can send commercial email to businesses and consumers without prior consent, as long as every message follows the rules. The FTC’s compliance guide sets them out:
- Accurate “From”, “To” and routing information.
- A subject line that reflects the content of the message.
- A clear statement that the message is an advertisement, where applicable.
- A valid physical postal address for your business.
- A clear way to opt out, with opt-outs honoured within 10 business days.
- Responsibility stays with you even if an agency sends the emails for you.
Each email that breaks these rules can attract a civil penalty of up to $53,088. That figure was set in the FTC’s 2025 inflation adjustment and still applies in 2026, and it counts per email, not per campaign.
United Kingdom: PECR and UK GDPR
The UK splits recipients into two groups. Corporate subscribers are limited companies, LLPs and public bodies. Individual subscribers are consumers, sole traders and most partnerships.
According to the ICO’s business-to-business guidance, the PECR consent rule for marketing emails does not apply to corporate subscribers, so you can email a limited company without its prior consent. You still need to identify yourself and give a working way to opt out, and you should honour every opt-out.
Two points catch many senders out. First, an email to a named person at a company (jane.smith@company.co.uk) is still personal data, so UK GDPR applies. You need a lawful basis, usually legitimate interests, and the message must be relevant to the person’s job. Second, sole traders and most partnerships count as individuals, so they need consent just like consumers.
For consumer email, consent is the default. The “soft opt-in” exception only covers your own existing customers, so it can never be used with a bought list. In practice, a purchased UK consumer list can only be emailed if each person consented to receive marketing from your business specifically, and you can prove it.
The stakes have also risen. Since 5 February 2026, the Data (Use and Access) Act 2025 has allowed the ICO to fine PECR breaches up to £17.5 million or 4% of global turnover, whichever is higher, as the ICO confirmed when the changes came into force. The previous cap was £500,000.
European Union: GDPR and national rules
GDPR applies to any personal data, including business email addresses that identify a person. Rules on marketing email itself come from each country’s version of the ePrivacy Directive, and they vary. Some countries allow B2B email on an opt-out basis; others are stricter. Germany, for example, generally expects prior consent for advertising emails even when the recipient is a business. Check the rules country by country before you send.
Canada: CASL
Canada’s Anti-Spam Legislation (CASL) is consent-based for both business and consumer email. Consent can be express or, in limited cases, implied. One implied route is when someone publishes their business email address publicly without saying they do not want marketing, and your message is relevant to their role. Penalties for businesses can reach CA$10 million per violation, so Canadian outreach needs careful planning.
What this means in practice
| Region | B2B email to companies | Consumer email from a bought list |
|---|---|---|
| United States | Allowed with CAN-SPAM rules | Allowed with CAN-SPAM rules |
| United Kingdom | Allowed to corporate subscribers; UK GDPR applies to named contacts | Only with specific, provable consent |
| European Union | Varies by country; some need consent | Generally needs consent |
| Canada | Needs express or implied consent | Needs consent |
This guide is general information, not legal advice. If you plan large campaigns in the UK, EU or Canada, take advice from a data protection specialist.
How to Tell a Good List from a Bad One
Every vendor says its data is “verified”. These are the questions that show what that word actually means.
When and how was each record verified?
Good providers check email addresses in layers: syntax, whether the domain can receive mail (MX records), whether the mailbox exists (SMTP check), and whether the domain is a “catch-all” that accepts every address. Some also research contacts manually. Ask for the last verified date, because a list checked a year ago is not the same product as one checked last month.
How fast does the data go out of date?
People change jobs, companies rebrand and mailboxes close. This is called data decay, and industry estimates often put B2B contact decay at roughly a quarter to a third of records per year. A list is a snapshot, so the older it is, the more it will bounce.
What is in each record?
Ask for a field list and fill rates. A list where only half the records have a direct email address is very different from one where nearly all do. Check whether the emails are named (jane.smith@) or role-based (info@, sales@). Role-based addresses reach a shared inbox and usually perform worse in cold outreach.
Can you test it first?
A free sample is the quickest way to judge quality. Run the sample through your own verification tool, check a few contacts on LinkedIn or company websites, and see whether the job titles and companies match your target. FreshLeads offers a free 10-lead sample for exactly this reason.
Red flags
- Millions of records at a very low price, with no explanation of where they came from.
- Claims of “100% accuracy” or “guaranteed inbox delivery”.
- Consumer lists described as “opt-in” with no consent records on offer.
- No sample, no last-verified date and no replacement policy for bounced records.
- No company details, address or named people behind the website.
How Much Does an Email List Cost?
Prices vary widely. Across the market, B2B leads range from around a cent to more than $5 per contact, depending on how detailed and how recently checked the data is. The main pricing models are:
- Ready-made databases: a fixed price for a country or industry list. The cheapest per record, but you get everyone in the segment, including people you will never contact.
- Per-record pricing: you pay only for the contacts you select. Good when your target is narrow.
- Subscription platforms: monthly access to a searchable database with export credits. Useful for teams prospecting every day.
- Custom-built lists: researched to your brief. The most expensive per contact, but the most precise.
Price per record is not the number to judge by. A better test is cost per valid, relevant contact: a $0.05 record that bounces costs more than a $0.50 record that reaches the right person.
Buy, Build or Subscribe?
| Option | Speed | Precision | Best for |
|---|---|---|---|
| Ready-made country or industry list | Same day | Broad | Large markets, testing a new country, event promotion |
| Custom-built list | Days | Very high | Niche audiences that do not exist in standard databases |
| Subscription platform | Immediate | Medium to high | Sales teams prospecting daily |
| Building in-house | Weeks to months | High | Very small, high-value target lists |
If the audience you need is unusual, such as procurement heads at hospitals in a single region or owners of a particular type of franchise, a standard database will not have enough of them. That is when a custom list such as FreshLeads’ BeSpoke service, built from scratch to your brief, is worth the higher cost.
How to Use a Purchased List Without Hurting Deliverability
Even accurate data can damage your sender reputation if it is sent the wrong way. Follow these steps before the first campaign:
- Verify again before sending. Re-check the list with your own verification tool, even if the vendor already did.
- Segment by country and recipient type. Remove sole traders and consumers in regions where you do not have consent, and split the rest by role so each group gets a relevant message.
- Send from a separate domain or subdomain. Protect your main domain, and warm the new one up gradually over a few weeks.
- Authenticate your email. Set up SPF, DKIM and DMARC. Gmail and Yahoo require these for bulk senders, along with one-click unsubscribe and low spam complaint rates.
- Start small. Send to a few hundred contacts first, watch bounces and complaints, and only then scale up.
- Keep it relevant. A message tied to the recipient’s job is both more effective and easier to justify under legitimate interests.
- Tell people where you got their data. Under UK GDPR and GDPR, if you did not collect the data directly, you must tell people the source and how to object, at the latest in your first message to them.
- Honour opt-outs fast and keep a suppression list, so removed contacts never come back in a future import.
Checklist Before You Buy
- I know which countries my contacts are in and which law applies to each.
- I know whether each contact is a company or an individual subscriber.
- The vendor has told me how and when the data was verified.
- I have tested a free sample against my own verification tool.
- I know what fields are included and their fill rates.
- There is a written replacement policy for bounced records.
- My sending domain is authenticated and warmed up.
- My first email includes who I am, why I am contacting them, where I got their details and how to opt out.
Frequently Asked Questions
Is it illegal to buy an email list?
No, buying contact data is legal in most countries. The law governs how you use it. In the US you can email bought contacts under CAN-SPAM rules, while the UK, EU and Canada place much tighter limits, especially on consumer email.
Can I email a purchased B2B list in the UK?
Yes, if the contacts are at limited companies, LLPs or public bodies and the message is relevant to their role. You must identify yourself, offer an opt-out and meet UK GDPR for named contacts. Sole traders and most partnerships need consent.
Is a purchased B2B list GDPR compliant?
A list cannot be compliant on its own; your use of it has to be. You need a lawful basis (often legitimate interests), relevant messages, a privacy notice that names the data source, and a fast way to object.
What bounce rate should I expect from a bought list?
A well-verified list that was checked recently should produce a low hard-bounce rate. If a test send bounces heavily, stop, re-verify the data and ask the vendor to replace the bad records.
How often should I clean a purchased list?
Re-verify before every major campaign and at least every few months, because contact data decays as people change jobs.
What is the difference between a B2B and a B2C email list?
A B2B list contains people at organisations, usually with business email addresses and job details. A B2C list contains consumers. The legal rules for emailing them are different in most countries.
The Bottom Line
Buying an email list works when three things line up: the data is recent and properly verified, the contacts match who you want to reach, and you email them in a way the law in their country allows. Get those right and a bought list is one of the fastest ways to start conversations with new buyers.
If you want to check quality before you commit, request a free 10-lead sample from FreshLeads and test it against your own criteria.
External Sources Cited
