The case against buying email lists is usually made on ethical or legal grounds. Those arguments are sound and they are not the reason it fails. It fails because it does not work, mechanically, and the failure is expensive and difficult to reverse.
What actually happens when you send to one
The bounce rate is enormous. Purchased lists are typically scraped or recycled, and the addresses go dead fast. Bounce rates of 20–40% are ordinary. Anything above 2% is a problem; 30% tells the receiving server, unambiguously, that you are sending to a list you did not build.
You hit spam traps. This is the mechanism that does the real damage. Mailbox providers and blocklist operators maintain addresses that exist solely to catch senders mailing lists they should not have. Two kinds matter:
- Pristine traps were never real addresses. They are published where scrapers find them, so hitting one is near-proof that you scraped or bought.
- Recycled traps were real addresses, abandoned, then reactivated as traps after a period of bouncing.
Hitting a pristine trap can put your domain or IP on a blocklist immediately. Delisting is possible, sometimes slow, and sometimes requires explaining what you did.
Complaints spike. People who never asked for your email mark it as spam. The enforcement threshold is 0.3% — three per thousand — and an unsolicited campaign clears that easily.
Your domain reputation is damaged for months. This is the part people underestimate. Reputation attaches to your sending domain and accumulates slowly. One purchased-list campaign can undo a year of careful sending, and the effect is not limited to the campaign — it degrades delivery for every email you send afterwards, including your transactional mail, your invoices and your password resets.
Why the list is bad even when it looks good
It has been sold before. Anyone selling a list is selling it repeatedly. The people on it are receiving unsolicited email from everyone who bought it, so they are already primed to complain.
"Opt-in" means something different than you think. Sellers describe lists as opt-in on the basis that someone once ticked a box agreeing to receive offers from "carefully selected partners". That consent is not transferable to you in any meaningful sense, and under GDPR and CASL it is not valid consent at all.
The data is stale. B2B contact data decays at a rate commonly estimated around 25–30% a year as people change jobs. A list assembled eighteen months ago is substantially fiction.
You cannot verify it. Email verification will remove the obviously invalid addresses, which reduces the bounce rate and does nothing about the traps, the complaints or the fact that nobody asked to hear from you. Verifying a purchased list is not a fix; it is a way of arriving at the same outcome with a lower bounce rate.
The legal position, briefly
- CAN-SPAM (US): does not require consent, so sending to a purchased list is not automatically unlawful. It still requires honest headers, a physical address and a working unsubscribe.
- GDPR (EU/UK): you must be able to demonstrate consent. You cannot, because you were not there when it was given and the wording did not name you.
- CASL (Canada): consent required, penalties up to $10 million per violation for a business.
So it is potentially lawful in the US and clearly unlawful for EU and Canadian recipients. Purchased lists rarely come with reliable geography.
What to do instead
If the goal is reaching people who do not know you yet, the honest options are:
Cold outreach done properly, on a separate domain. Small volumes, individually researched, sent one to one from a domain that is not the one carrying your newsletter and your invoices. It will still generate complaints; the point of the separate domain is that those complaints do not damage everything else. See B2B email marketing.
Content that earns the address. Slower and it compounds. A lead magnet that solves one specific problem produces a list of people who chose to hear from you, which is worth several times a bought list of the same size.
Partnerships and co-marketing, where a partner emails their own list about you and interested people come to you. The consent stays where it belongs.
Paid acquisition into an opt-in form. More expensive per address and the addresses are real.
The uncomfortable arithmetic: a list of 500 people who asked for your email will outperform 50,000 who did not, and it will not cost you your sending domain.
Frequently asked questions
Is it illegal to buy an email list?
Not universally. Under CAN-SPAM in the US, sending to a purchased list is not automatically unlawful provided the message is honest and offers an opt-out. Under GDPR and CASL it is, because both require demonstrable consent that a purchased list cannot provide.
Can I clean a purchased list to make it safe?
Verification removes invalid addresses and lowers the bounce rate. It does not remove spam traps that are technically deliverable, does not create consent, and does not prevent complaints from people who never asked to hear from you.
How long does it take to recover from a blocklist listing?
It varies by operator — from days to months, and some require you to explain and demonstrate remediation. The underlying domain reputation damage typically takes months of consistent good sending to repair.
What about lists from a partner or an acquisition?
Different, and still careful. If a business you acquired had valid consent, that can transfer, depending on jurisdiction and how the consent was worded. Re-permission the list rather than assuming, and start by mailing only the most recently engaged addresses.
