Buying an email list is legal in some situations and against the law in others. The difference comes down to what you plan to do with the addresses and where the people on that list actually live. In the United States, the CAN-SPAM Act lets you send commercial email without asking permission first, as long as you follow its rules once you hit send. GDPR and PECR flip that logic across the European Union and the United Kingdom, where you generally need consent before you email an individual. That requirement makes most purchased consumer lists unusable. Buying a list to blast and buying B2B contact data to research prospects are two different activities with very different risk, and the rest of this page separates them.
Is it legal to buy an email list?
It depends on which country’s law applies to the people you’re emailing and on what you do with the list after you buy it. Under US federal law, buying a list and emailing it isn’t illegal by itself. The CAN-SPAM Act doesn’t require prior consent to send a commercial email; it requires you to follow specific rules once you send one. Under EU and UK law the calculation is different. GDPR and PECR require a valid legal basis, usually consent, before you send marketing email to an individual, and a name on a purchased list almost never comes with consent that covers your business specifically.
So a US company emailing US recipients from a purchased list faces a compliance burden, not an outright ban. A company emailing EU or UK individuals from that same list is on much shakier ground, wherever the company itself is based. The law that matters is the recipient’s law, not the sender’s.
The US rule: CAN-SPAM Act and the opt-out model
CAN-SPAM runs on an opt-out model. You don’t need permission before you send a commercial email to someone in the US, but the Federal Trade Commission requires every sender to meet the following checklist, which follows the FTC’s CAN-SPAM compliance guide:
- Your “From,” “To,” “Reply-To” and routing information must be accurate and must identify the person or business that actually sent the message.
- Your subject line must accurately reflect what is in the message, so no bait-and-switch.
- You must clearly and conspicuously disclose that the message is an advertisement.
- Every message must include your valid physical postal address.
- Every message must tell recipients how to opt out of future marketing email, with a simple method that is easy to use.
- You must honor each opt-out request within 10 business days, and the opt-out mechanism must keep working for at least 30 days after you send the message.
- You can’t charge a fee for opting out, and the recipient should need nothing more than one reply email or one visit to a web page.
- You remain legally responsible for email marketing that another company sends on your behalf, even when you hire an agency or vendor to do it.
Once someone opts out, you can’t sell or transfer their address to anyone else, with one narrow exception: a company you hired specifically to help you stay CAN-SPAM compliant. Buying a list doesn’t violate CAN-SPAM on its own, but ignoring this checklist after you buy one does. The FTC states that each separate email in violation can bring penalties of up to $53,088, and the agency confirmed in its 2026 inflation notice that its civil penalty amounts remain at 2025 levels this year.
The EU and UK rule: GDPR, PECR and why purchased lists rarely work
GDPR sets the bar for personal data processing across the EU. PECR (the UK’s Privacy and Electronic Communications Regulations) adds more specific rules for marketing by electronic mail. Between the two, sending marketing email to an individual in the EU or UK generally requires a lawful basis, and for cold marketing that basis is almost always consent. Implied interest and “they didn’t say no” don’t count; the consent has to be freely given and specific, and it has to be informed, unambiguous and given to you.
Purchased lists run into trouble right at this point. The UK regulator’s guidance on PECR is direct about it: the “soft opt-in” exception only covers people whose details you collected yourself during a sale or negotiation, so it can’t cover a third-party marketing list. Even if the list vendor claims everyone on it opted in to something, that consent has to name your business and cover the kind of marketing you’re about to send. A generic “we may share your data with partners” checkbox somewhere else doesn’t clear that bar. A purchased consumer email list is therefore close to unusable for compliant EU or UK email marketing. Buying data isn’t what is illegal; sending unsolicited marketing email without valid, sender-specific consent is.
The penalties are real. Under the EU GDPR, regulators can fine a company up to €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious violations. Under the UK GDPR the ceiling is £17.5 million or 4% of worldwide annual turnover, whichever is higher. The ICO has also said the Data (Use and Access) Act brings PECR fines up to the same level, as set out in its statement on the Act’s commencement.
The UK B2B exception: corporate subscribers vs. sole traders
PECR treats business addresses differently depending on who is behind them. The ICO explains in its business-to-business marketing guidance that you can send marketing email to a corporate subscriber, such as a limited company or a Scottish partnership, without its consent under PECR. You still have to identify yourself and honor any opt-out you receive. Sole traders and some other partnerships are treated like individuals for email, so you need their consent or a valid soft opt-in. If you can’t tell which kind of subscriber an address belongs to, the ICO says to treat it as an individual’s. A [email protected] address doesn’t settle the question either, because a sole trader can use a business domain.
UK GDPR still applies to the personal data in a work address, such as a named employee’s email, so you need a lawful basis for processing it and must tell people how you use their data. That’s why the B2B route is more workable than the consumer route in the UK, and why it isn’t a free pass.
Canada, California and other regimes to know
Canada’s Anti-Spam Legislation, CASL, is stricter than CAN-SPAM. You need consent, either express or implied through an existing business relationship, before you send a single commercial electronic message. That consent doesn’t travel with a purchased list the way you might expect: if a vendor’s customers consented to hear from the vendor, that consent doesn’t automatically extend to you as the buyer, unless the list changed hands as part of a genuine business sale. CASL enforcement carries some of the steepest penalties of any anti-spam law, with administrative penalties of up to C$10 million per violation for a business, so it’s worth getting right before you send anything to a Canadian audience.
California’s CCPA and CPRA work differently. They aren’t email-specific consent laws like CASL. They govern how businesses handle personal information about California residents, including data that ends up on an email list. If you buy a list that includes California residents, you may take on disclosure and data-handling obligations under those laws, depending on your business size and data practices, on top of whatever email-specific rules apply.
A handful of other countries run their own versions of the same idea. South Africa has POPIA and Brazil has LGPD. Singapore has PDPA, and Japan has APPI. Each one sets consent or data-handling standards that can affect a purchased list touching those regions. The pattern repeats everywhere: the more consent-driven the local privacy law, the less useful a purchased list becomes.
CAN-SPAM vs. GDPR and PECR at a glance
The core difference between US and EU/UK email law is when consent is required, not whether the underlying activity is banned outright. This table compares the main frameworks on the questions that decide whether a purchased list is usable.
| Question | CAN-SPAM (US) | GDPR / PECR (EU/UK) | CASL (Canada) |
|---|---|---|---|
| Consent needed to send? | No, opt-out model | Yes for individuals; no PECR consent for UK corporate subscribers, who still get opt-out rights | Yes, express or implied |
| Is buying a list itself illegal? | No | No, but sending to it usually is | No, but the consent doesn’t transfer |
| What you must do | Follow the eight-point checklist above | Get valid, sender-specific consent for individuals | Get valid consent before the first message |
| Purchased consumer list usable? | Compliance risk, not automatically illegal | Almost never | Almost never without a fresh consent step |
| Maximum penalty | $53,088 per violating email | EU: €20 million or 4% of turnover. UK: £17.5 million or 4% of turnover | C$10 million per violation |
Buying a list to email directly vs. buying B2B contact data for outreach
This is the distinction most guides on the topic skip, and it determines your risk. “Buying an email list” usually means acquiring a bulk file of addresses to blast marketing email at, often with no relationship to those people and no idea how the addresses were collected. That’s the use case every law above is trying to regulate, and it’s the riskiest way to use purchased data by a wide margin.
Buying verified B2B contact data is a different activity, even though it can look similar from the outside. Sales and business development teams use B2B data platforms to find the right person at a target company and confirm that a role and email address are current. From there they reach out personally, through a LinkedIn message, a phone call, or a CAN-SPAM-compliant cold email with a real opt-out. The data itself isn’t the problem; how you use it is. A verified contact record used for individualized outreach with a working unsubscribe option sits in a much safer compliance position than an anonymous consumer list used for mass blasts.
If you’re evaluating a B2B data source, a few checks matter more than price:
- Does the provider explain how it verifies emails and how often it refreshes data?
- Does it publish where its data comes from, rather than staying vague about sourcing?
- Does it let you filter to business contacts and roles instead of scraping personal consumer inboxes?
- Does it support CAN-SPAM basics like sender identification and opt-out handling on your end?
UpLead is built around this second use case: verified B2B contact and company data for prospecting and research, not bulk consumer lists for blasting. That doesn’t make every use of the data automatically compliant. It’s still on you to send responsibly: honor opt-outs and follow the rules that apply to your recipients’ location.
Why purchased consumer email lists usually backfire anyway
Even where sending to a purchased list is technically allowed, it tends to perform badly enough that legal risk isn’t the only reason to avoid it. Addresses on bulk lists are often outdated or mistyped, and some are planted as spam traps, so bounce rates climb fast. Recipients who never asked to hear from you mark messages as spam at a much higher rate than people who signed up themselves, and every spam complaint chips away at your sender reputation. That damage doesn’t stay contained to one campaign. Once an inbox provider starts routing your mail to spam, it can affect delivery for your legitimate, permission-based sends too.
Frequently asked questions
Can you legally buy an email list in the US?
Yes. Buying and using a purchased email list in the US isn’t illegal on its own, because CAN-SPAM doesn’t require consent before you send. You still have to follow every CAN-SPAM rule once you email that list, including honest sender details plus a working opt-out.
Is it legal to buy an email list in the EU or UK?
Generally no, not for marketing email to individuals, because GDPR and PECR require valid consent before you send, while a purchased list rarely comes with consent that names your business. The UK regulator’s guidance confirms the soft opt-in exception doesn’t cover third-party marketing lists. UK corporate subscribers such as limited companies are the main exception, since PECR doesn’t require their consent, though you must still identify yourself and honor opt-outs.
Is buying B2B contact data the same as buying an email list?
Not exactly. A bulk consumer email list is meant for mass blasts to people with no relationship to your business, while B2B contact data is meant for individualized prospecting and outreach through a compliant cold email process or another channel. The use case, not just the data itself, drives the legal risk.
Does CAN-SPAM require an opt-in before I can email someone?
No, CAN-SPAM is an opt-out law, not an opt-in law. You can send a first commercial email without prior permission, but you must honor an opt-out request within 10 business days and keep the opt-out option working for at least 30 days after you send.
What happens if I email a purchased list and ignore opt-out requests?
You risk FTC enforcement under CAN-SPAM, with penalties of up to $53,088 per violating email. You also risk damage to your sender reputation, which can hurt all of your email sends, and in the EU or UK you face potential penalties under GDPR or PECR if consent was never obtained.
How much does a legal B2B email list cost?
You don’t buy a static list; you pay for credits to look up verified contacts you choose. On UpLead’s pricing page, Essentials is $99 a month for 170 credits, or $74 a month billed annually, and Plus is $199 a month for 400 credits, or $149 a month billed annually. Extra credits cost $0.60 on Essentials and $0.50 on Plus, and a 7-day trial includes 5 credits. Other vendors price differently, so check each vendor’s own pricing page.
