Is it okay to buy lists for cold email?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Legally, it depends on where your contacts are. Practically, it almost never works the way you hope.
The legal picture: In the US, CAN-SPAM doesn't prohibit purchased lists. You still have to comply with all the other requirements (sender identification, physical address, opt-out mechanism), but the list purchase itself isn't illegal. In Canada, Europe, and the UK, it's much riskier. GDPR and CASL require consent or a clearly documentable legitimate interest. "I bought a list" doesn't satisfy either.
The deliverability picture: Purchased lists are old, over-used, and frequently contain spam traps. Addresses that have been sold dozens of times go stale fast. People move companies, roles change, inboxes get abandoned and turned into honeypots. A list from even 6 months ago will have a meaningful percentage of hard bounces. Hit enough of those and your sender reputation takes damage that's hard to recover from.
The honest answer: If you're sending to EU contacts, don't. If you're sending US-only, proceed with extreme caution and validate the list first. Even then, the response rates on purchased lists are typically so poor that the economics rarely make sense compared to building a targeted list from enrichment tools.
If you've already bought a list and want to use it, validate it before you send. Our validation catches invalid addresses, spam traps, and high-risk contacts that will hurt your reputation. Start with a small segment, watch your bounce and complaint rates closely, and cut anything that performs poorly. Better to send to 500 verified contacts than 5,000 unknowns.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
