Why are purchased or scraped lists risky?

Purchased and scraped lists fail on three levels at once: deliverability, legal compliance, and trust. Getting all three wrong simultaneously is a fast way to damage a sending reputation that took years to build.

Deliverability: People on purchased or scraped lists never opted in to your emails. When your message arrives, many will hit "report spam" because it is unwanted. Complaint rates on these lists routinely run 10 to 20 times higher than on organic lists. High complaint rates trigger filtering at Gmail, Yahoo Mail, and Outlook within days. Your domain reputation takes the hit and does not recover quickly.

Spam traps: Purchased and scraped databases frequently contain spam trap addresses. These are addresses that anti-abuse organizations monitor specifically to identify senders without proper permission practices. Hitting traps leads to blocklist listings at organizations like Spamhaus that affect your deliverability to all providers that use those blocklists.

Legal: GDPR in the EU requires explicit consent to send commercial email. CASL in Canada requires prior consent and proof of it. CAN-SPAM in the US is more lenient on consent but still requires accurate sender identification and opt-out mechanisms. Sending to purchased lists under GDPR or CASL can result in significant fines. "The vendor said the list was opt-in" is not a sufficient defense.

If you have an existing purchased list and are deciding what to do with it: do not send to it. At minimum, run it through a full list cleaning and validation process to understand what you actually have, and get legal advice before emailing anyone on it. If you are in the EU, the safest answer is to not use it at all.

For what to do instead, organic acquisition practices explain how to build a list that actually works long-term.