> Enrich.chat gives AI agents verified work emails and mobiles. To use it from an agent, read https://enrich.chat/agents.md . This is the Markdown version of https://enrich.chat/blog/buying-email-lists/

# Should you buy an email list? What the law says, what inbox providers do and what to do instead

Buying a list is not banned outright in the US, UK or Canada, but sending to it is regulated, and the big inbox providers and email platforms say not to use one. Here are the rules, the risks and the options that work.

By Enrich.chat Editorial. Updated October 16, 2026.

**Short answer:** Buying an email list is not banned by the [FTC's CAN-SPAM rules](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business), which set rules for each message you send, B2B included. The risk is yours: Canada's [CASL](https://laws-lois.justice.gc.ca/eng/acts/E-1.6/FullText.html) makes you prove consent, the UK [ICO](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/organisations-using-marketing-services-of-data-brokers/) says buyers must check the seller's data, and [Google](https://support.google.com/a/answer/81126), Yahoo, Mailchimp and Amazon SES tell senders not to use purchased lists. Build a list you can source and date instead. This is not legal advice.

## Key takeaways

- US: CAN-SPAM covers B2B email, with penalties of up to $53,088 per email. The FTC says you cannot contract away responsibility, so renting a list that a seller mails for you does not move the risk.
- UK: the ICO says a buyer must check who compiled the data, where it came from and what people were told, and must give people privacy information within one month. Accepting the seller's assurances is not enough.
- Canada: CASL requires consent for a commercial message, and whoever claims consent must prove it. The maximum penalty is $10,000,000 for an organization.
- Google, Yahoo, Mailchimp, Twilio SendGrid, HubSpot and Amazon SES each say not to use purchased lists. Google asks senders to keep spam reports below 0.10%, about 1 in 1,000 messages.
- Better routes: double opt-in forms, your own records, and one-by-one lookups of named people with a status per email, a source and a date.

## What do you actually get when you buy an email list?

You get contact records, not permission. A bought list is a file of names, job titles, company websites and email addresses that someone else compiled. It does not prove that those people agreed to hear from you, and it does not prove that the data is current.

[Mailchimp](https://mailchimp.com/resources/never-purchase-email-lists/), an email platform, says sellers often market these files as leads even though many addresses are unvetted. It adds that a seller may have sold the same list to a dozen other companies. The UK regulator tells buyers to ask about the source first. Figure 1 sets the fields in the file beside the questions in [the ICO's guidance on buying or renting information](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/collect-information-and-generate-leads/).

**Figure 1: What a bought list holds and what it leaves out.** Two panels. The left panel shows the four fields in a typical bought list row: name, title, work email and company. The right panel lists five questions the file cannot answer: who compiled it, where each address came from, what people were told, when it was collected, and whether consent names the buyer.

*A bought list holds contact fields. The five questions on the right are ones the [ICO](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/collect-information-and-generate-leads/) says a buyer should be able to answer before using a list. The example row is made up.*

Data also ages. The Bureau of Labor Statistics reports that [20.6% of US wage and salary workers](https://www.bls.gov/news.release/tenure.nr0.htm) had been with their employer for 12 months or less in January 2026. A file compiled last year can already hold people whose work emails are gone. Our guide to [how fast B2B contact data goes bad](https://enrich.chat/blog/b2b-data-decay/) compares the published rates, and the [email bounce rate guide](https://enrich.chat/blog/email-bounce-rate/) shows what dead addresses cost you.

## Is it legal to buy an email list?

Buying a list is not banned in the US, UK or Canada in the sources we read. The rules attach to what you do next: how you hold the data, whom you email and whether you can prove permission. The table gives the main B2B rule in each country. This is general information, not legal advice, and other countries differ.

| Country and law | Main rule for B2B email | What a bought list changes |
| --- | --- | --- |
| United States: [CAN-SPAM](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business), enforced by the FTC | No B2B exception. Messages need accurate headers, an ad label, a postal address and an opt-out you honor within 10 business days. Each violating email can cost up to $53,088. | The FTC guide sets rules for each message and does not mention bought lists. You cannot hand the duty to a seller or a sender. |
| United Kingdom: UK GDPR and PECR, enforced by the [ICO](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/) | The PECR email rule does not cover companies, but sole traders and some partnerships need consent. UK GDPR covers any named person, and the right to object to marketing is absolute. | You need a lawful basis, due diligence on the seller and privacy information for each person within one month. |
| Canada: [CASL](https://laws-lois.justice.gc.ca/eng/acts/E-1.6/FullText.html) | Every commercial electronic message needs express or implied consent. Opt-outs must take effect within 10 business days. The maximum penalty is $10,000,000 for an organization. | The person who claims consent must prove it. A seller's word is not proof. |

### What does US law say about a bought list?

CAN-SPAM covers email between businesses. The [FTC's compliance guide](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business) says the law "makes no exception for business-to-business email". It asks for accurate header information, honest subject lines, a clear ad label, your postal address and an opt-out that you honor within 10 business days. The guide never mentions bought lists. It sets rules for the message, so the duty stays with you.

Two details matter if you buy. First, the FTC says that even if you hire another company to handle your email marketing, you cannot contract away your legal responsibility. Second, the statute adds a harsher charge for how addresses were gathered. Under [15 U.S.C. 7704(b)(1)](https://www.law.cornell.edu/uscode/text/15/7704), a message that already breaks the law becomes an aggravated violation if the sender knew, or the facts make it fairly clear, that the address came from automated harvesting of a site that bars sales of its addresses, or from software that builds addresses out of names, letters or numbers. The rule also reaches anyone who helps by providing or selecting those addresses.

State privacy law matters too. California's attorney general says the CCPA exemption for business-to-business personal information [expired on December 31, 2022](https://oag.ca.gov/privacy/ccpa), so work contact details of California residents can now fall under it. CalPrivacy says California residents can send one deletion request to every active data broker, and brokers had to start processing those requests on [August 1, 2026](https://cppa.ca.gov/data_broker_registry/). Ask a seller whether it counts as a data broker and how it handles those requests.

### What does UK law say about a bought list?

The ICO's [business-to-business marketing guidance](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/) splits recipients in two. The PECR email rule does not apply to corporate subscribers such as companies and limited liability partnerships. It does apply to sole traders and some partnerships, who must have consented to your messages or meet the narrow soft opt-in. If you cannot tell which a contact is, the ICO says to treat them as an individual.

UK GDPR applies on top whenever an address identifies a named person, even at work. The ICO's B2B guidance also says that buying or selling a list of business contacts needs a lawful basis, and that you must tell people you hold their data. For email to corporate subscribers, it says legitimate interests is often the right basis, but there is no absolute rule and you must apply its three-part test.

The ICO's [guidance on data brokers](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/organisations-using-marketing-services-of-data-brokers/) covers the purchase itself. You stay responsible for compliance, so you must do proportionate due diligence before you get the data. Accepting the seller's assurances is not enough, and you should not use the data if the seller cannot show it is reliable. You must also give the people on the list your privacy information within one month of obtaining their details. The ICO marks both pages as under review after the Data (Use and Access) Act, so check for updates.

### What does Canadian law say about a bought list?

[CASL section 6](https://laws-lois.justice.gc.ca/eng/acts/E-1.6/FullText.html) bars sending a commercial electronic message unless the person has consented, expressly or by implication, and the message carries the required sender details and an unsubscribe mechanism. Section 13 puts the burden on the sender: whoever says they have consent has the onus of proving it. The Government of Canada tells senders to be [ready to provide proof of consent](https://ised-isde.canada.ca/site/canada-anti-spam-legislation/en/getting-consent-send-email) if asked.

A bought address rarely fits the usual routes to implied consent. Section 10(9) allows it for an existing relationship, an address the person disclosed to you, or an address the person conspicuously published. A published address counts only if no statement refuses unsolicited messages and your message is relevant to the person's business role or duties. On our plain reading, a seller's file leaves only the published route, so you would need to show how each address was published. An express consent request must name who is asking (section 10(1) and the [CRTC regulations](https://laws-lois.justice.gc.ca/eng/regulations/SOR-2012-36/FullText.html)).

### Do other countries have different rules?

Yes, and the gaps are wide. In 2004 the EU's Article 29 Working Party, an advisory body that predates the GDPR, wrote that Member States remain free to choose how to protect companies from unsolicited messages. In the same [opinion](https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2004/wp90_en.pdf), it told buyers of email lists to be cautious and to check that prior consent was given under the opt-in rules. The Government of Canada tells businesses that [market outside Canada](https://ised-isde.canada.ca/site/canada-anti-spam-legislation/en/common-business-concerns-about-canadas-anti-spam-legislation) to follow those countries' anti-spam laws. Read the rules for each country before you add it to a send. Our [cold email data guide](https://enrich.chat/blog/cold-email/) covers CAN-SPAM, the ICO and CASL for lists, and the [TCPA guide](https://enrich.chat/blog/tcpa-b2b-cold-calling/) covers phone numbers.

### Does renting a list, or paying a seller to send, change who is responsible?

No. The FTC says [both the company whose product is promoted and the company that sends](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business) may be held legally responsible. The ICO says PECR duties sit with the sender or the instigator, and you can be an [instigator](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/plan-direct-marketing/) even if you do not send the message or hold the contact details.

## Can you email a bought list if the seller says it is opt-in?

Usually not safely. An opt-in given to a seller or to another website is not an opt-in to you. The regulators and platforms we read all point to consent that names the sender.

- **UK regulator.** The ICO says a consent request must explain who wants to rely on the consent, such as you or [another organisation](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/plan-direct-marketing/). For individual subscribers on a bought list, it says buyers [need consent given to them as sender](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/). Its due diligence questions ask whether you were named.
- **Canada.** A consent request must identify the person seeking consent, and the sender must be able to prove it.
- **Email platforms.** Twilio SendGrid says [consent cannot come from a third party](https://support.sendgrid.com/hc/en-us/articles/4404315959835-Email-Opt-in-and-Opt-out-Requirements) and names purchased lists as an example. In the US, CAN-SPAM works mainly through the opt-out, so the consent test usually comes from your sending platform.

The route left open is narrow: a list where the seller can show, address by address, that each person consented to messages from you. Most files cannot. Ask for the records. If the seller cannot show the data is reliable, the ICO says not to use it.

## What do Google, Yahoo, Microsoft and email platforms do with purchased lists?

They tell senders not to use them, and several can suspend accounts that do. Mailbox providers also judge you by what recipients do, whatever the source of your list. We read each policy on October 16, 2026.

| Provider | What it says about purchased lists | Source |
| --- | --- | --- |
| Google (Gmail) | Lists buying email addresses from other companies, and mailing people who did not sign up, among sending practices to avoid. Asks senders to keep spam reports below 0.10%. | [Email sender guidelines](https://support.google.com/a/answer/81126) |
| Yahoo | Says not to purchase mailing lists, and to send only to users who specifically requested mail. Asks all senders to keep their spam rate below 0.3%. | [Sender best practices](https://senders.yahooinc.com/best-practices/) |
| Microsoft (Outlook.com) | Asks high-volume senders to make sure recipients have consented. Says it may filter or block non-compliant senders. | [Outlook requirements post](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730) |
| Mailchimp | Bars campaigns to purchased, rented, third-party, co-registration, publicly available data or partner lists, and may suspend or terminate accounts. Treats a trade show host's attendee list as a third-party list. | [Acceptable Use Policy](https://mailchimp.com/legal/acceptable_use/), [compliance guide](https://mailchimp.com/help/examples-of-compliant-and-non-compliant-lists/) |
| Twilio SendGrid | Prohibits purchased or rented email lists and lists of people who have not consented to mail from you. | [Email Policy](https://www.twilio.com/en-us/legal/service-country-specific-terms/email) |
| HubSpot | Prohibits contacting people from purchased, rented, borrowed or other third-party lists, including append and enrichment lists used in breach of law or third-party terms. | [Anti-Spam Policy](https://legal.hubspot.com/anti-spam-policy) |
| Amazon SES | Prohibits sending to purchased or rented lists, because they can contain spamtrap addresses. | [Reputation metrics](https://docs.aws.amazon.com/ses/latest/dg/reputationdashboardmessages.html) |

Spam traps explain why a bought list is risky even when the addresses look real. [Spamhaus](https://www.spamhaus.org/resource-hub/deliverability/spamtraps-fix-the-problem-not-the-symptom/), which publishes blocklists, describes seeded traps: addresses planted where only scrapers will find them. It says a hit shows the sender is scraping addresses or buying lists from someone who does. Dead-address traps work another way. Once-valid addresses reject mail for a period, often 12 months or more, and are then quietly turned back on as traps. Spamhaus calls hitting one a significant red flag. Policies differ by tool, and cold outreach tools set their own, so read the terms of your sending tool before you upload any list.

## How does a bought list hurt your sender reputation?

It adds addresses that never agreed to hear from you, addresses that no longer exist and sometimes spam traps. Bounces and spam reports then rise together, and providers measure both against your domain.

[Google](https://support.google.com/a/answer/81126) says that if messages from your domain are frequently reported as spam, future messages from you are more likely to be marked as spam, and that user reports can lower your domain's reputation over time. It warns that people who did not sign up may report your mail. Mailchimp's [compliance guide](https://mailchimp.com/help/examples-of-compliant-and-non-compliant-lists/) says purchased addresses can bring higher bounce and abuse rates that damage your sending reputation.

**Figure 2: Spam reports and hard bounces per 1,000 emails at the lines providers draw.** Two bar groups. Spam reports per 1,000 emails: Google asks senders to stay below 1, which is 0.10 percent. Google and Yahoo ask for staying below 3, which is 0.30 percent. Amazon SES may pause an account at 5, which is 0.5 percent. Hard bounces per 1,000 emails: Amazon SES places an account under review at 50, which is 5 percent, and may pause it at 100, which is 10 percent.

*Provider lines for spam reports and hard bounces, shown as counts per 1,000 emails. The two groups use different scales, and each provider calculates its rate its own way. Orange marks the 0.30% line that both Google and Yahoo name. Sources: [Google](https://support.google.com/a/answer/81126), [Yahoo](https://senders.yahooinc.com/best-practices/) and [Amazon SES](https://docs.aws.amazon.com/ses/latest/dg/reputationdashboardmessages.html).*

The lines are low. If all 2,000 messages of a first send reach the inbox, 2 spam reports equal 0.10% and 6 equal 0.30%. Amazon SES puts an account under review at a 5% hard bounce rate, so 100 dead addresses in those 2,000 is enough. Your normal customer email shares your domain, so a bad send can hurt more than that one campaign. Our [email bounce rate guide](https://enrich.chat/blog/email-bounce-rate/) compares the limits that other sending platforms set.

## What should you do instead of buying an email list?

Build a short list of named people you chose, from sources you can name and date. Start with your own contacts and opt-ins, then look up new prospects one at a time and check each email before you send.

1. **Define who you want.** Write down titles, company size and countries before you look for data. A tight profile makes a short list, and a short list draws fewer complaints. Our [ideal customer profile guide](https://enrich.chat/blog/ideal-customer-profile/) shows how.
2. **Start with your own records.** [The ICO tells buyers](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/collect-information-and-generate-leads/) to check new lists against their own suppression lists, so nobody who asked you to stop is contacted again. Keep a source and a date for every row. The [database hygiene checklist](https://enrich.chat/blog/database-hygiene/) covers the cleanup.
3. **Collect opt-ins where you can.** [Google](https://support.google.com/a/answer/81126) asks senders to confirm each recipient's address before subscribing them, and Amazon SES [recommends double opt-in](https://docs.aws.amazon.com/ses/latest/dg/faqs-enforcement.html). [Mailchimp](https://mailchimp.com/help/examples-of-compliant-and-non-compliant-lists/) says a sign-up kiosk at your booth is fine if visitors knew they would get your emails.
4. **Look up named people one at a time.** For prospects who have not opted in, pick the person, look up the work email, and record when and why. This is [data enrichment](https://enrich.chat/blog/what-is-data-enrichment/), and the ICO's [broker guidance](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/organisations-using-marketing-services-of-data-brokers/) keeps the buyer's duties the same. UK contacts need to hear where you got their details within one month.
5. **Check each email's status.** Send to confirmed addresses first and hold back catch-all and unknown ones. The free [catch-all checker](https://enrich.chat/tools/catch-all-checker/) tests a domain, and the [cold email guide](https://enrich.chat/blog/cold-email/) explains the status labels.
6. **Send small and keep score.** Start with a small batch and watch bounces and spam reports against the lines in Figure 2. Honor unsubscribes fast: [Yahoo](https://senders.yahooinc.com/best-practices/) asks bulk senders to honor them within 2 days.

Figure 3 turns the rules into a gate. A "no" at any step stops the list or slows it down.

**Figure 3: Four checks before you email a list someone else compiled.** A vertical gate with four questions. One: can the seller show who compiled the list, where it came from and when? If not, do not use it. Two: do you hold consent that names you, or a lawful basis for that country? If not, hold that segment back. Three: does your sending tool allow the list? If not, do not upload it. Four: can you tell each person where you got their details, within a month in the UK? If not, fix that first. If every answer is yes, send a small batch to checked addresses and watch the numbers.

*Four checks before you email a list someone else compiled. The first and fourth come from the [ICO's data broker guidance](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/organisations-using-marketing-services-of-data-brokers/), the third from the platform policies above, and the second from the country rules in this guide. It is a checklist, not legal advice.*

Email is not the only route. Referrals, events and content that people choose to subscribe to all produce contacts who expect to hear from you. Our guides to [B2B lead generation strategies](https://enrich.chat/blog/b2b-lead-generation-strategies/) and to whether to [build or buy a marketing database](https://enrich.chat/blog/b2b-marketing-database/) compare the options.

## How can an AI agent build a small, dated list with Enrich.chat?

Ask the agent to find named people who match your target profile, look up each work email and report a status for every address. Enrich.chat does this over a plain HTTPS API, with 10 free lookups a day per IP address and no signup. It supplies contact data. It does not supply consent, and it does not send email.

### Is a one-by-one lookup different from buying a list?

In size and intent, yes. You choose each person, you record why, and you stop when the target list is done. In law, no. The ICO's [data broker guidance](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/organisations-using-marketing-services-of-data-brokers/) counts data enrichment and data matching among broker services, so due diligence, a lawful basis and privacy information still apply to any provider you use. A status is a label on an address. It is not consent, and it does not tell you whether you may email that person.

### What does the agent do?

- It reads [enrich.chat/agents.md](https://enrich.chat/agents.md) once, or you add the MCP server at `https://enrich.chat/mcp`. The [agents page](https://enrich.chat/agents/) has the steps for ChatGPT, Claude, Cursor and more.
- It finds people with `/v1/search` by title, seniority, industry, country and company size, or lists the people at one company with `/v1/company/people`.
- It looks up each work email with `/v1/person`. The email comes back as `verified`, `catch_all` or `unknown`.
- A lookup that finds nothing returns `found: false` and uses 0 credits. Each match shows `credits_used`.

```text
Use www.enrich.chat to find 25 heads of operations at US logistics companies with 50 to 200 employees. Look up each work email and show its status. Put verified emails in one list, and put catch_all, unknown and not found in a second list to hold back. For each person add the company website and the date of the lookup, and report the total credits used. Do not send any email.
```

A person returned by search uses 5 credits, a work email found uses 10, and a lookup that finds nothing uses 0. If every person on a 1,000-person target list comes back with an email, the list uses 15,000 credits. That fits the Growth plan at $29 a month. Credits renew with each monthly payment, and unused credits do not roll over. See [Enrich.chat pricing](https://enrich.chat/pricing/) for every plan, or try the free [AI lead list builder](https://enrich.chat/tools/lead-list-builder/) and [email finder](https://enrich.chat/tools/email-finder/) first. In the dashboard you can save the people you picked to a list with a tag and a note about why, then export it as a CSV (see [lists and export](https://enrich.chat/features/lists-and-export/)).

### What does Enrich.chat leave to you?

- **Consent and lawful basis.** A found email is not an opt-in. You decide whether you may email the person, and you stay responsible for CAN-SPAM, GDPR and the other rules that apply to you. See our [terms](https://enrich.chat/terms/).
- **Sending and suppression.** Enrich.chat does not send email. Its dashboard has a [do-not-contact list](https://enrich.chat/features/do-not-contact/) that keeps the emails, company websites and LinkedIn profiles you add out of every list export, but it cannot see who opted out of your mailings elsewhere. Keep your own suppression list in your CRM or sheet and check every new list against it. People can ask to be removed at the [opt-out page](https://enrich.chat/opt-out/).
- **Judgment on the status.** Treat every contact as a strong lead, not a guarantee. The [email finder API](https://enrich.chat/api/email-finder/) and [people search API](https://enrich.chat/api/people-search/) pages show full responses.

## Frequently asked questions

### Is buying an email list illegal?

Not in itself in the US. The [FTC's CAN-SPAM guide](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business) sets rules for each message you send, B2B included, and does not mention bought lists. Using a list is where the risk sits: Canada's [CASL](https://laws-lois.justice.gc.ca/eng/acts/E-1.6/FullText.html) requires consent that you must prove, and the [ICO](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/organisations-using-marketing-services-of-data-brokers/) says a UK buyer needs a lawful basis and must check the seller's data. Email platforms also ban purchased lists. This is not legal advice.

### Can you email a bought B2B list in the UK or Canada?

In the UK, the [ICO](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/) says the PECR email rule does not cover companies, but sole traders and some partnerships need consent given to you, and UK GDPR still covers named people. In Canada, [CASL section 6](https://laws-lois.justice.gc.ca/eng/acts/E-1.6/FullText.html) requires express or implied consent for every commercial message, and you must prove it. A seller's opt-in claim rarely meets either test. Ask a lawyer before you send.

### Is a list opt-in if the seller says it is?

Not for you, because consent has to be to the sender. The [ICO](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/plan-direct-marketing/) says a consent request must say who will rely on it, so you need to be named. [Twilio SendGrid](https://support.sendgrid.com/hc/en-us/articles/4404315959835-Email-Opt-in-and-Opt-out-Requirements) says consent cannot be gathered from a third party or a purchased list. Ask the seller for per-address consent records that name you. If it cannot supply them, do not use the list.

### Can you upload a purchased list to Mailchimp, HubSpot or SendGrid?

No. [Mailchimp's Acceptable Use Policy](https://mailchimp.com/legal/acceptable_use/) bars campaigns to purchased, rented, third-party or partner lists and allows account suspension. [HubSpot's anti-spam policy](https://legal.hubspot.com/anti-spam-policy) prohibits contacting recipients from purchased, rented, borrowed or third-party lists. [Twilio's email policy](https://www.twilio.com/en-us/legal/service-country-specific-terms/email) prohibits purchased or rented lists. Other tools differ, so read your sending tool's terms before you upload anything.

### What happens to your sender reputation if you email a bought list?

Bounces and spam reports rise, and providers weigh both. [Google](https://support.google.com/a/answer/81126) says frequent spam reports make future messages from your domain more likely to be marked as spam. [Amazon SES](https://docs.aws.amazon.com/ses/latest/dg/reputationdashboardmessages.html) puts accounts under review at a 5% hard bounce rate or a 0.1% complaint rate and says purchased lists can contain spamtrap addresses. [Spamhaus](https://www.spamhaus.org/resource-hub/deliverability/spamtraps-fix-the-problem-not-the-symptom/) says seeded traps point to senders who scrape or buy lists.

### What should you do instead of buying an email list?

Build a short list of named people you chose, from sources you can name and date. Use your own contacts and double opt-in forms first. For new prospects, look up each person one at a time, check each email's status and keep a suppression list. An agent can do the lookups with an [email finder API](https://enrich.chat/api/email-finder/); see our [cold email data guide](https://enrich.chat/blog/cold-email/). Contact data from any source is not consent.

## Sources

1. [CAN-SPAM Act: A compliance guide for business](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business)
2. [15 U.S. Code 7704: Other protections for users of commercial electronic mail](https://www.law.cornell.edu/uscode/text/15/7704)
3. [California Consumer Privacy Act (CCPA), FAQ 11](https://oag.ca.gov/privacy/ccpa)
4. [California Data Broker Registry](https://cppa.ca.gov/data_broker_registry/)
5. [Canada's Anti-Spam Legislation (S.C. 2010, c. 23)](https://laws-lois.justice.gc.ca/eng/acts/E-1.6/FullText.html)
6. [Electronic Commerce Protection Regulations (CRTC), SOR/2012-36](https://laws-lois.justice.gc.ca/eng/regulations/SOR-2012-36/FullText.html)
7. [Getting consent to send emails](https://ised-isde.canada.ca/site/canada-anti-spam-legislation/en/getting-consent-send-email)
8. [Understanding common business concerns about CASL](https://ised-isde.canada.ca/site/canada-anti-spam-legislation/en/common-business-concerns-about-canadas-anti-spam-legislation)
9. [Business-to-business marketing](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/)
10. [Organisations using marketing services of data brokers: what you need to know](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/organisations-using-marketing-services-of-data-brokers/)
11. [Direct marketing guidance: Collect information and generate leads](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/collect-information-and-generate-leads/)
12. [Direct marketing guidance: Plan direct marketing](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/plan-direct-marketing/)
13. [Electronic mail marketing (Guide to PECR)](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/)
14. [Opinion 5/2004 on unsolicited communications for marketing purposes under Article 13 of Directive 2002/58/EC](https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2004/wp90_en.pdf)
15. [Email sender guidelines](https://support.google.com/a/answer/81126)
16. [Sender best practices](https://senders.yahooinc.com/best-practices/)
17. [Strengthening Email Ecosystem: Outlook's New Requirements for High-Volume Senders](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730)
18. [Mailchimp Acceptable Use Policy](https://mailchimp.com/legal/acceptable_use/)
19. [About Compliance for Email Marketing](https://mailchimp.com/help/examples-of-compliant-and-non-compliant-lists/)
20. [3 Reasons Never To Buy Email Lists](https://mailchimp.com/resources/never-purchase-email-lists/)
21. [Twilio Email Policy](https://www.twilio.com/en-us/legal/service-country-specific-terms/email)
22. [Email Opt-in and Opt-out Requirements](https://support.sendgrid.com/hc/en-us/articles/4404315959835-Email-Opt-in-and-Opt-out-Requirements)
23. [HubSpot Anti-Spam Policy](https://legal.hubspot.com/anti-spam-policy)
24. [Reputation metrics messages](https://docs.aws.amazon.com/ses/latest/dg/reputationdashboardmessages.html)
25. [Amazon SES sending review process FAQs](https://docs.aws.amazon.com/ses/latest/dg/faqs-enforcement.html)
26. [Spamtraps: fix the problem, not the symptom](https://www.spamhaus.org/resource-hub/deliverability/spamtraps-fix-the-problem-not-the-symptom/)
27. [Employee Tenure in 2026](https://www.bls.gov/news.release/tenure.nr0.htm)

## Try this prompt

Build a small, dated prospect list one lookup at a time

```text
Use www.enrich.chat to find 25 heads of operations at US logistics companies with 50 to 200 employees. Look up each work email and show its status. Put verified emails in one list, and put catch_all, unknown and not found in a second list to hold back. For each person add the company website and the date of the lookup, and report the total credits used. Do not send any email.
```

## Related

- [Cold email: the data side](https://enrich.chat/blog/cold-email/)
- [Email bounce rate: what is good](https://enrich.chat/blog/email-bounce-rate/)
- [What is a B2B marketing database?](https://enrich.chat/blog/b2b-marketing-database/)