Buying Email Lists in 2026: Is It Legal, What It Costs & How to Buy Safely

Ask a room of marketers whether buying an email list is legal, and you will hear two confident answers: “Of course it is” and “Absolutely not.” Both are wrong, and the space between them is where domains get blocklisted, sending accounts get suspended, and regulators start writing letters.

The honest answer in 2026 is that buying an email list is not one decision. It is five. Acquiring the data, holding it, emailing the people in it, sending through your platform, and landing in the inbox are each judged by a different rulebook. A list can clear the first and fail the other four.

This guide walks through all five decisions: what the law says in the US, UK, EU, Canada and Australia, what lists really cost once you count everything, and the questions that separate usable prospect data from a liability with a .csv extension.

Is Buying an Email List Legal? Run It Through the Five Clearances

Buying an email list is neither universally legal nor universally illegal. It is a chain of five separate permissions, and your campaign is only as safe as the weakest one.

Most articles on this topic answer one question, usually “Is it legal under CAN-SPAM?”, and stop there. That is how teams end up with a list their lawyer approved, their email platform bans, and Gmail quietly routes to spam. Before you evaluate a vendor or a price, map the purchase against all five clearances.

The Five Clearances: every gate must pass before a purchased list is safe to use

1. AcquisitionCan I lawfully buy this data?Decided by privacy and data-broker laws
2. ProcessingCan I lawfully store, enrich and use it?Decided by GDPR, UK GDPR and US state privacy laws
3. ContactCan I lawfully email these people?Decided by CAN-SPAM, PECR, CASL, the Spam Act and ePrivacy rules
4. PlatformWill my email service let me send to them?Decided by your ESP or sales engagement tool’s terms
5. InboxWill mailbox providers accept the mail?Decided by Gmail and Yahoo sender rules and blocklist operators

Legal clearances (law decides)Commercial clearances (platforms decide)

What decides the outcome at each gate is rarely the list itself. It is where each recipient is located; whether they are a consumer, a sole trader or an employee of an incorporated company; how the seller collected the data; and whether any consent the seller claims actually extends to you.

That last point catches more buyers than any other. Consent is not a transferable asset. In stricter regimes, an “opt-in” that a seller collected for its own purposes, or for unnamed “trusted partners”, usually does nothing for the buyer.

Keep the five clearances in mind as we go region by region, because the law only covers the first three.

Buying Email Lists Legally: What Each Region Requires in 2026

The US is the only major market where federal law does not require opt-in before commercial email. Almost everywhere else, a purchase does not create the consent you need to send.

How strict is each market about consent before commercial email?

More permissiveConsent first

Opt-out modelUnited States
No federal opt-in requirement, but every send must follow CAN-SPAM.

Country by countryEuropean Union
GDPR always applies; national ePrivacy laws set the sending rule.

Consent before sendingUnited KingdomCanadaAustralia
A purchased list does not create the consent you need. In the UK, corporate subscribers are treated differently.

A simplification, of course. Recipient type and the facts of your campaign can change the answer in every row.

What getting it wrong can cost: penalties and enforcement cited in this guide

$53,088United StatesMaximum FTC penalty for each email that violates CAN-SPAM.

CAD $10MCanadaMaximum CASL penalty per violation for an organization (CAD $1M for individuals).

£300,000United KingdomICO fine issued in May 2026 for more than 5.5 million unsolicited marketing texts.

AUD $702,900AustraliaPenalty paid in March 2026 after 370,000+ commercial emails lacked an unsubscribe.

United States: CAN-SPAM Plus a Tougher State Layer

The FTC’s CAN-SPAM compliance guide is clear on two points marketers often get backwards. The law covers all commercial messages, not only bulk email, and it makes no exception for B2B. It also does not generally require recipients to opt in first.

A US campaign to purchased contacts can therefore be lawful, provided every message uses accurate header and routing information, avoids deceptive subject lines, identifies itself as an ad where required, includes a valid postal address and a clear opt-out, and honors opt-outs promptly. You are also responsible for any agency or partner sending on your behalf.

The FTC flags a risk specific to bought lists: they can contain people who have already unsubscribed from you. Scrub every purchased file against your own suppression list before the first send. Each violating email can carry a penalty of up to $53,088.

California raises the stakes for 2026. Under the Delete Act, registered data brokers had to begin accessing the state’s Delete Request and Opt-out Platform (DROP) from August 1, 2026, at least once every 45 days, and process the deletion requests it returns (California Privacy Protection Agency). If your vendor sells California consumer data, ask whether it is registered and how deletions flow down to your copy of the file.

United Kingdom: Named Consent or Nothing

The ICO’s electronic mail marketing guidance, updated on April 28, 2026 to reflect the Data (Use and Access) Act 2025, sets a high bar for bought-in lists. Valid consent has to name your organization, not just “selected partners”, cover email specifically, and be recorded so you can show who agreed, when and how.

The soft opt-in will not rescue you either. It depends on collecting details directly from the person, which a purchased list never does.

The nuance B2B teams need: PECR treats corporate subscribers differently from individuals, sole traders and some partnerships, so emailing a limited company is not judged like emailing a consumer (ICO B2B marketing guidance). UK GDPR still applies to a named employee’s work address, though. Enforcement is active, too: in May 2026, the ICO fined KRA Consultancy Ltd £300,000 for sending more than 5.5 million unsolicited marketing texts (ICO enforcement notice).

European Union: Two Laws, Two Tests

GDPR governs whether you can process the personal data. The ePrivacy Directive, implemented differently in each member state, governs whether you can send electronic marketing. You have to pass both.

On third-party data, the European Commission says the original collection and your intended reuse must both be compatible with GDPR. Where the seller relied on consent, that consent should have contemplated passing the data to other organizations for their own marketing. Legitimate interests can sometimes support processing, but they do not override a national rule that requires consent to send.

That is why “GDPR allows cold email under legitimate interest” is a dangerous shortcut. It answers the processing question and skips the sending one.

Canada: CASL Means Consent First

Canada’s Anti-Spam Legislation requires consent, sender identification and a working unsubscribe for commercial electronic messages (CRTC FAQ). Buying a contact file does not establish express or implied consent for you. Penalties reach CAD $1 million per violation for individuals and CAD $10 million for organizations, and the CRTC’s March 2026 enforcement update signals that it now expects mature compliance.

Australia: The Sender Carries the Risk

The ACMA requires consent before commercial email, plus accurate sender details and a functional unsubscribe. A vendor’s assurance that contacts are “business leads” or “publicly available” does not shift responsibility away from you. In March 2026, Lululemon Athletica Australia paid a AUD $702,900 penalty after more than 370,000 commercial emails went out without a way to unsubscribe (ACMA). That case did not involve a bought list, but it shows how strictly the basics are enforced.

How Much Does an Email List Cost in 2026?

There is no single market rate for an email list, because “email list” now describes at least five different products with five different pricing models.

When someone quotes you a price per thousand, the first question is: a thousand what? A one-off CSV, a year of platform access, and a custom-built enterprise file are not comparable purchases, even if each ends in a spreadsheet of names and addresses.

What Public Pricing Shows

Published 2026 pricing from two widely used prospecting platforms illustrates the spread.

One credit-based platform charges $99 a month for 170 contacts or $199 a month for 400 on monthly plans, falling to about $74 and $149 a month when billed annually, with larger yearly allowances. Worked through, that lands between roughly $0.37 and $0.58 per contact, or about $373 to $582 per 1,000 records, with extra credits at around $0.50 to $0.60 each.

A seat-based platform comes in far lower on paper, at roughly $20 per 1,000 credits across its paid tiers. But those credits also pay for other features, so the figure reflects subscription economics, not the price of a standalone list.

Effective cost per 1,000 records on published 2026 plans (USD)

Credit-based, entry planBilled monthly

$582

Credit-based, mid planBilled monthly

$498

Credit-based, entry planBilled annually

$435

Credit-based, mid planBilled annually

$373

Seat-based platformPer 1,000 credits, not contacts

~$20

$0$300$600

These figures come from vendors’ public pricing pages as observed in October 2026 and change often. Treat them as a range, not a quote.

What Moves the Price

Expect the quote to rise or fall with:

• Audience: B2B versus consumer data, plus how niche the industry or role is. A targeted CIO email list is priced differently from a broad executive file.
• Precision: seniority, title, company size and revenue filters narrow the list and raise the unit cost.
• Geography: some countries cost more to source and carry more compliance work.
• Depth: direct dials, mobile numbers, technology user data, intent signals and other enrichment fields.
• Freshness: real-time verification and a short refresh cycle cost more because they reduce wasted sends.
• Access: seats, export limits, API access and CRM integrations.
• Protection: documented provenance, suppression support and replacement credit for invalid records.

The Number That Matters Is Cost per Usable Contact

A list that costs half as much but bounces three times as often is not cheaper. Count verification tools, enrichment, suppression management, email infrastructure, legal review, and the hardest line item to price: damage to a sending domain you spent years warming.

The sticker price is the smallest cost you will pay for a bad list.

Why Do Cheap Email Lists Get Expensive After You Hit Send?

Your sender reputation is an economic asset, and a poor list can spend it faster than any regulator could fine you.

Clearances four and five have nothing to do with statute law. They are run by the companies that carry and accept your email, and in 2026 their thresholds are tight.

Gmail and Yahoo Set the Bar

Google’s email sender guidelines ask all senders to keep user-reported spam rates below 0.10% and never to reach 0.30%. Anyone sending 5,000 or more messages a day to Gmail accounts must also have SPF, DKIM and DMARC in place, valid forward and reverse DNS, TLS, properly formatted messages, and one-click unsubscribe on marketing mail.

Yahoo’s sender best practices require the same authentication trio, a visible and easy unsubscribe, prompt handling of opt-outs, and complaint rates below 0.3%.

Put those numbers next to a list nobody asked to receive. At 0.3%, just three complaints in every thousand delivered emails puts you in the danger zone, and a cold, unfamiliar audience can reach that on a single send.

User-reported spam rate: where Gmail and Yahoo draw the lines

Target zone

Caution: reputation at risk

Danger

0%0.10%
Gmail target0.30%
Gmail and Yahoo limit0.40%

What a Bad List Actually Triggers

Spamhaus strongly discourages purchased and rented lists on the grounds that permission does not transfer. The damage it describes compounds:

• Hard bounces from stale or invented addresses tell providers you do not maintain your list.
• Spam traps hidden in scraped or recycled files flag you as a careless or abusive sender.
• Complaints from people who have never heard of you push you over provider thresholds.
• Blocklisting of your domain or IP can stop delivery to customers, not only to prospects.
• Lost inbox placement lingers long after the campaign that caused it.

Your Platform May Say No Before the Law Does

A list can be lawful to email in one country and still break your email service provider’s rules. Mailchimp, for example, prohibits third-party lists outright, including purchased, rented and scraped addresses. Many sales engagement tools have similar clauses, and breaking them can mean a suspended account in the middle of a campaign.

A verified email is a deliverable address, not a permission to send. Verification partly answers clearance five. It says nothing about clearances one to four.

How to Buy an Email List Safely: 10 Questions for Any Data Vendor

Buying safely does not mean finding a list you can blast. It means reducing legal, data-quality and deliverability risk before a single record lands in your CRM.

A reputable vendor will answer every question below in writing, and quickly. Hesitation on any of them tells you more than a glossy sales deck.

1. Where did each contact come from? Public business sources, licensed partners, first-party contribution, enrichment or scraping. Knowing the source tells you which clearances the data can realistically pass.
2. If you claim consent, can I see it? Ask for the exact wording, timestamp, source form or URL, the channels covered, and whether your company is named. In the UK and many EU markets, this is the difference between usable and unusable data.
3. Which countries are in the file, and can I exclude some? Filtering out consent-first jurisdictions before export is far cheaper than cleaning up after a complaint.
4. When was each record last verified? A date-last-verified field and a stated refresh cycle help you spot decayed contacts and people who have changed jobs.
5. How do you verify emails, and what is your bounce guarantee? Ask how catch-all domains are handled and what credit or replacement you get for hard bounces.
6. Can you match against my suppression list? Uploading your unsubscribes and objections before delivery protects you from emailing people who have already said no.
7. How do deletion and opt-out requests reach me? Rights requests should flow downstream, including California DROP deletions where they apply.
8. What does the contract promise? Look for representations on lawful collection, audit rights, indemnification, retention and deletion terms, and disclosure of sources.
9. What am I licensed to do with the data? Some files are licensed for research or enrichment only, not for direct email outreach.
10. Will my sending platform accept this use? Check your ESP or sales engagement tool’s terms before you buy, not after the upload fails.

Red Flags That Should End the Conversation

Walk away, or at least slow right down, if you hear any of these:

• “100% opt-in” with no consent records to back it up.
• “Fully GDPR compliant” with no explanation of lawful basis or consent chain.
• “CAN-SPAM compliant list.” Compliance attaches to how you send, not to a spreadsheet.
• “Millions of emails for $50.”
• No date-last-verified or source field anywhere in the file.
• No country segmentation and no suppression support.
• No refund or replacement policy for invalid records.
• Personal webmail addresses sold as B2B contacts.
• “It’s public data, so it’s legal to email.” Public availability does not create permission.
• A refusal to say where the data came from or how opt-outs are handled.

What Should You Do Before the First Send?

Even a well-sourced list can hurt you if it goes out all at once to every address. Treat launch as a controlled test, not a broadcast.

Once the data has passed vendor due diligence, work through these steps in order:

1. Segment by jurisdiction and recipient type. Separate US corporate contacts from UK, EU, Canadian and Australian records, and consumers or sole traders from employees of incorporated businesses. Each group may need a different legal basis, or no email at all. Buying region-specific files, such as US business executive lists, UK business executive lists or Australian business executive lists, makes this split easier from the start.
2. Suppress first. Remove everyone who has unsubscribed, objected or asked for deletion, across every system you own.
3. Re-verify right before outreach. Addresses decay between purchase and send, and a fresh check cuts hard bounces where they do the most harm.
4. Protect your main domain. Send from a properly authenticated domain with SPF, DKIM, DMARC, TLS and correct DNS, and monitor it. Many teams keep cold outreach off the domain that carries invoices and customer mail.
5. Start small and watch the numbers. Send to a slice of the list, then check bounces, complaints and replies against the Gmail and Yahoo thresholds before scaling.
6. Keep the exits wide open. Honor unsubscribes promptly, log deletion and objection requests, and feed them back to your vendor.

Safer Ways to Build the Same Pipeline

A static purchased list is only one route to new contacts, and often not the strongest. Compare it with:

• First-party capture through newsletters, gated content with clear disclosure, webinars and events.
• Partner co-marketing where the consent wording names both organizations.
• Account-based prospecting that starts from company-level data and builds contacts around target accounts, the approach behind account-based marketing services.
• Enrichment of a CRM you already hold lawfully, using data appending or email appending to fill in titles, firmographics and current contact details. The benefits of data enrichment compound as your own records grow.
• Paid lead generation and content syndication where prospects knowingly hand over their details and downstream use is disclosed.
• Referral programs that turn existing customers into introductions.

A high-quality list is not merely verified. It is relevant, current, legally usable, suppressible, documented at the source, and compatible with the platform you send from.

The Real Question Is Not Whether to Buy Data, but What Kind

B2B teams will keep using third-party data in 2026. The ones that win treat it as intelligence to be governed, not a list to be blasted.

Read the Five Clearances again and a pattern appears. Almost every risk in this guide traces back to something a buyer could not see: where the data came from, how old it was, whether opt-outs had been applied, and what it was licensed for. Cheap lists stay cheap by hiding those answers. Good data makes them easy to find.

That is the gap LakeB2B was built to close. Rather than selling static files, LakeB2B works as a B2B data intelligence partner, supplying verified B2B contact and company data with accuracy often around 95 to 98%, segmented by geography, industry, job function and company size. That covers everything from healthcare email lists to technology buyers, delivered with the sourcing and verification detail you need to make your own compliance decisions. It also plugs into the safer routes above, from enriching the CRM you already own to building account-based contact maps around your target companies.

Compliance still sits with the sender, and no vendor can make a campaign lawful on your behalf. What the right partner can do is give you the visibility to make that call with confidence.

Frequently Asked Questions About Buying Email Lists

Is it legal to buy email lists in the US?

Generally, yes. Federal CAN-SPAM law does not ban buying contact data or require opt-in before commercial email. Every message must still use accurate headers, honest subject lines, a postal address and a working opt-out, and you must honor unsubscribes. State privacy and data-broker laws, such as California’s Delete Act, can add further obligations.

Can I email a purchased B2B list?

Sometimes. It depends on where recipients are located, whether they are corporate or individual subscribers, how the data was sourced, and whether you hold a valid consent or legal basis. US corporate outreach is often possible under CAN-SPAM, while the UK, EU, Canada and Australia set much stricter conditions. Your email platform’s rules also apply.

Does GDPR make purchased email lists illegal?

Not automatically. GDPR regulates how personal data is processed, so you need a lawful basis, transparency and a way to honor rights such as objection and deletion. Sending marketing email is governed separately by the ePrivacy Directive and national laws, which often require consent. A purchased list has to satisfy both sets of rules.

Is a verified email list a compliant email list?

No. Verification confirms that an address exists and is likely to accept mail, which helps deliverability. It does not prove consent, establish a lawful basis or give you permission to market. Treat verification as a data-quality check, and handle legal and platform requirements as separate steps in your buying process.

How much does an email list cost in 2026?

Prices vary by product. Public 2026 pricing from one credit-based prospecting platform works out to roughly $0.37 to $0.58 per contact, while one-off bulk lists can be cheaper and custom builds are usually quoted per project. Compare cost per usable contact, including verification, suppression and deliverability risk, rather than headline price.

Can I upload a purchased list to Mailchimp?

No. Mailchimp’s published audience requirements prohibit third-party lists, including purchased, rented and scraped addresses, even where local law might allow the outreach. Uploading one risks account suspension. Many other email and sales engagement platforms have similar clauses, so read your provider’s acceptable use terms before buying any third-party contact data.

What is the biggest risk of buying an email list?

For most B2B teams, it is damage to sender reputation rather than the purchase price. Bounces, spam complaints and spam-trap hits can push you past Gmail’s 0.3% complaint threshold, trigger blocklisting and reduce inbox placement for every email you send, including messages to existing customers. The effects can outlast the campaign that caused them.