Should You Buy an Email List? The Deliverability Answer

No, you should not buy an email list. Every major email platform forbids it in its terms, purchased lists contain spam traps that verification cannot reliably remove, UK and EU consent cannot be transferred from the seller to you, and the bounces and complaints damage the domain you need for your real customers.

That answer is common. What is less common is the reason the usual workaround, "buy it and then clean it", does not work. This post covers both.

What the email platforms say

Every major sending platform prohibits purchased lists in its terms, so the first consequence is losing your account. Here is what each says, fetched on 1 October 2026.

Platform	What its policy says
Mailchimp	Prohibits uploading or sending to "purchased, rented, third-party, co-reg, publicly available data, or partner lists of any kind" (Acceptable Use Policy, effective 26 September 2025)
Twilio SendGrid	Prohibits "using purchased or rented email lists or email lists of recipients that have not affirmatively consented to receive emails from you" (prohibited uses)
HubSpot	Prohibits sending spam and harvesting or collecting email addresses without consent (Acceptable Use Policy)
Shopify Email	Says never to purchase or rent contact lists; a permission-based list is required by its terms (Shopify help)
Gmail (as a receiver)	"Don't purchase email addresses from other companies." (sender guidelines)

Platforms do not rely on you confessing. Mailchimp's Omnivore system checks every address you have not mailed before, on import or send, and prevents sending to them when the risk is too high. HubSpot suspends marketing email when an account goes over a 5% hard bounce rate or a 0.1% spam report rate in a month (HubSpot). A bought list tends to trip one or both.

Why "buy it and clean it" does not work

Verification removes dead addresses, but a bought list's worst problems are addresses that look alive. This is the part list sellers and some verification vendors gloss over.

A verifier asks the recipient's mail server whether a mailbox exists. That catches addresses that will hard bounce. It does not catch:

• Spam traps. M3AAWG's spam trap guidance (February 2023) says traps are "designed to be indistinguishable from other email addresses". A pristine trap is an address that was never used by a real person, and M3AAWG says pristine trap hits "may be a strong indicator of the presence of purchased lists". A trap that accepts mail looks like any real mailbox to a verifier.
• Recycled traps. Old addresses that were abandoned, then turned into traps by the provider. M3AAWG suggests at least 12 months of inactivity before conversion, and calls a recycled trap hit "usually an indicator of poor list management (or an ancient list)". No verifier can see every trap, by design.
• People who will complain. A real, valid mailbox belonging to someone who never asked to hear from you. They will mark you as spam, and Gmail's guidelines ask senders to keep the spam rate below 0.10% and never reach 0.30%.

Spamhaus addresses the workaround directly. Its marketing email FAQ describes "listwashing", removing spam traps and complainers from a list that was not confirmed opt-in while keeping the rest, as against its policy, and says: "Purchased lists contain spamtraps or generate abuse complaints and bounces, and then the buyers find themselves blocklisted for spamming."

So a verified purchased list is a list with fewer bounces and the same traps and complainers. The thing that gets you blocklisted is still there.

We will happily verify any list you upload, and we would rather say this plainly: verifying a bought list reduces one risk and leaves the larger ones untouched.

What the law says

In the US, buying a list is not itself illegal, but every message must comply with CAN-SPAM; in the UK, consent from a list seller usually does not cover you. This is not legal advice.

United States. The FTC's CAN-SPAM guide applies to all commercial email, including B2B, with penalties of up to $53,088 per violating email. Separately, it lists criminal penalties for "harvesting email addresses or generating them through a dictionary attack". If the list you are buying was scraped from websites, that is how it was built.

United Kingdom. The ICO's guidance on using marketing lists says bought-in lists can only be used for email if "all the people on the list specifically consented to receive that type of message from you", and that "generic consent covering any third party will not be enough." It also expects you to check that the list is accurate and was collected fairly. The PECR consent rule for email does not apply to corporate subscribers such as limited companies, but UK GDPR still applies to named individuals (ICO B2B guidance).

Spamhaus's view on consent is simpler: "Permission is not transferable!"

"Opt-in" lists for sale

A list sold as opt-in was opted in to someone else. Spamhaus says all advertisements for lists of "opt-in email addresses" are fraudulent, with the rare exception of a genuine business acquisition where full subscription records transfer with the business.

If a seller claims consent, the ICO's test is useful even outside the UK: does the consent name your organisation, cover email, and come with records of who consented, when and how? If the answer is "they agreed to hear from trusted partners", it fails.

What about B2B data providers?

Using a prospecting database for one-to-one cold email is a different practice from bulk-mailing a bought list, but it carries the same deliverability risks. It would be dishonest to pretend otherwise, given that a lot of B2B outreach runs on data from providers.

The differences that matter:

	Bought marketing list	Prospect data for cold outreach
Sent through	Marketing platform (Mailchimp, HubSpot)	Individual inboxes or cold email tools
Volume per sender	Thousands at once	Small daily volumes per inbox
Message	Newsletter or promotion	Individual, relevant to the recipient's role
Platform policy	Prohibited	Marketing platforms still prohibit it; check any cold email tool's own acceptable use policy
Legal position	Same rules apply	Same rules apply

Data from providers decays like any B2B data (see how fast B2B contact data decays), so verify every export before sending. Our post on re-verifying an Apollo export shows what that looks like. And keep it out of your marketing platform: Mailchimp's policy explicitly covers "third-party" and "publicly available data" lists.

What to do instead

Build the list you would have bought, slowly, from people who chose to hear from you.

• Offer something worth subscribing for on your site: a useful newsletter, a tool, a report. Use double opt-in where trap risk is high.
• Verify at the point of capture so typos and disposable addresses never enter the list. The free verifier shows the checks involved.
• For B2B prospecting, build targeted lists yourself: named people at companies you have a reason to contact, found and verified one at a time with an email finder, sent in small volumes from properly authenticated inboxes.
• Treat partners and events properly. Co-registration and event lists need the consent to name you; see cleaning an event attendee list.

The takeaway: buying a list is a trade of your sending domain's reputation for addresses you are not allowed to email. Verification cannot fix that trade, because the addresses that hurt most are the ones that verify as valid. Spend the money on getting people to sign up instead.