Why bought email lists fail

Bought, rented and scraped email lists fail because the people on them never agreed to hear from you. That runs into the consent rules of the EU and Canada, it breaks the acceptable use policy of practically every email platform, and it shows up fast in your deliverability: complaints from strangers, pristine spam traps, and blocklistings that can take your wanted mail down with the rest. Verifying such a list removes some dead addresses, but it does not create consent and cannot find every trap. Growing your own opt-in list is slower and is the only version that lasts.

What counts as a bought list

The name covers more than a spreadsheet you paid for. Treat all of these the same way:

• Purchased lists from a broker or data vendor, including ones sold as "opt-in" or "compliant".
• Rented lists, where you pay for sends to someone else's audience or get the addresses for a campaign.
• Scraped or harvested addresses, collected from websites, directories or social profiles.
• Appended addresses, where a vendor matches your customer records to email addresses the customers never gave you. M3AAWG's Sender Best Common Practices (version 4.0, section 4.4) calls email appending a direct violation of its core values.
• Attendee lists handed over by an event organizer, and partner or co-registration lists.

The common thread is that the person gave their address, if they gave it at all, to someone else. Spamhaus's sender guidelines state it plainly: permission is not transferable, and it cannot be assumed after the fact.

What the law says

This section summarizes what official sources say. It is not legal advice, and rules depend on where you and your recipients are. Ask a lawyer before you rely on any of it.

European Union: ePrivacy Directive and GDPR

Article 13(1) of the ePrivacy Directive allows email for direct marketing only to subscribers or users who have given their prior consent. Article 13(2) carves out one exception: a business that obtained a customer's email address in the context of a sale may market its own similar products to that customer, if it offered a free, easy way to object when it collected the address and in every message since. Neither path fits a list you bought: the people on it did not consent to you, and they are not your customers.

The GDPR adds rules for the personal data itself:

• Article 6(1) makes processing lawful only on one of the listed bases, the first of which is consent for one or more specific purposes.
• Article 7(1) puts the burden on you: where you rely on consent, you must be able to demonstrate it. Article 7(3) adds that withdrawing consent must be as easy as giving it.
• Recital 32 describes valid consent as a clear affirmative act that is freely given, specific, informed and unambiguous. Silence, pre-ticked boxes and inactivity do not count.

Whatever a person agreed to on a seller's form, they agreed to it with the seller. You cannot demonstrate an action they never took toward you.

United States: CAN-SPAM

The FTC's CAN-SPAM compliance guide describes rules built around opting out rather than prior consent. Commercial messages must not use false header information or deceptive subject lines, must identify themselves as ads, must include a valid physical postal address and a clear way to opt out, and opt-outs must be honored within 10 business days. Once someone opts out, you may not sell or transfer their address. The guide lists penalties of up to $53,088 for each email that violates the law, and you cannot contract your responsibility away to the company that sends for you.

Two points matter for bought lists. The FTC names harvesting addresses and generating them through a dictionary attack among the aggravated violations. And being allowed to send under CAN-SPAM does not mean your platform or the mailbox providers will accept the mail.

Canada: CASL

Section 6 of Canada's Anti-Spam Legislation prohibits sending a commercial electronic message unless the recipient has consented, expressly or by implication, and the message identifies the sender and carries an unsubscribe mechanism. Under section 13, whoever claims to have consent must prove it. Section 10(9) limits implied consent to a few cases, such as an existing business relationship, or an address the person published or disclosed to the sender, without saying they do not want such messages, where the message relates to their business role. Section 11(3) requires unsubscribe requests to take effect within 10 business days.

Your email platform forbids it

Even where a law would allow a send, your platform usually will not.

• Mailchimp's Acceptable Use Policy prohibits sending to purchased, rented, third-party, co-registration, publicly available data or partner lists of any kind, and requires evidence of consent for marketing mail. Its audience requirements add lists scraped from public websites.
• HubSpot's opt-in consent article says contacts purchased, rented, borrowed or otherwise taken from a third-party list cannot be used in its marketing email tool, even when the list advertises opt-in consent. An organizer's attendee list does not count either.
• Brevo's anti-spam policy strictly prohibits lists scraped from the internet or acquired from a third party, requires active and explicit consent with proof of opt-in for every contact, and warns that breaking it can lead to immediate suspension of the account.

Platforms enforce this because their sending IPs and domains are shared. M3AAWG's Help! I Hit a Spam Trap! tells providers to require customers to dispose of segments without confirmed permission, and to terminate customers who refuse to fix the problem.

What happens to deliverability

Pristine spam traps

A pristine trap is an address that no person ever used. M3AAWG says pristine trap hits frequently come from web harvesting, address probing or dictionary attacks, and may be a strong indicator of purchased lists. Spamhaus calls purchased, rented and harvested lists the most common source of spam trap hits. What a trap records feeds blocklists; in extreme cases, M3AAWG notes, a sender is blocklisted and its mail rejected across a broad swath of the internet. See spam traps and email blocklists.

Complaints

People who never signed up report the mail as spam. Google's sender guidelines require a spam rate below 0.3% in Postmaster Tools and recommend staying below 0.10%; they also tell senders not to buy addresses from other companies. Yahoo's sender best practices say the same about mailing lists and hold senders to the same 0.3% ceiling. One bought segment can use up that margin in a single send. More in sender reputation.

Bounces and old data

Traded lists are rarely current. Every address that no longer exists returns a hard bounce. M3AAWG's Sender Best Common Practices (section 2.2) notes that receivers use the volume of permanent failures to judge a sender, and that large volumes often point to an old or misapplied list (reduce your bounce rate).

Why verification does not make it safe

Verification checks whether a mailbox accepts mail. On a bought list it will remove addresses that are invalid or disposable, and some valid results with the action remove, such as spamtrap or trap_pattern. That is the part it can do. What it cannot do:

• Create consent. A deliverable address belongs to someone who still never agreed to hear from you. The law, your platform and the complaint button all care about that, not about deliverability.
• Find every trap. A working trap accepts mail like any real mailbox, and operators keep their traps secret. Spamhaus says list validation does not clean out traps and is no replacement for permission, and it advises removing the source of bad addresses rather than trying to filter out individual traps.

Verification is for lists you have permission to mail (list cleaning and consent).

What to do instead

• Sign-up forms that say what people get. M3AAWG's Sender Best Common Practices (section 4.1) asks for clear, obvious consent, the type and frequency of mail stated up front, and use of the address only for that purpose.
• Confirm each sign-up. M3AAWG rates confirmed (double) opt-in as the best level; it keeps typos and maliciously submitted addresses off the list.
• Lead magnets. Offer a guide, template, tool or webinar in exchange for a subscription, and say on the form that marketing mail will follow.
• Unchecked boxes at checkout. Recital 32 and Brevo's policy both rule out pre-ticked boxes.
• Your own presence at events. HubSpot accepts contacts who give you their details in person, for example by a badge scan or your own sign-up sheet; the organizer's attendee list does not qualify.
• Records of every opt-in. Keep the time, source and form for each address, as Spamhaus and M3AAWG recommend.
• Clean input. Check addresses as they are typed (sign-up form validation) and protect forms from bots (list bombing).

If you already bought a list, do not send to it. HubSpot's contact clean-up article says to delete purchased lists at once or import them as an opt-out list, so they drop out of all marketing email. A "permission request" sent to the list is still a first message to people who never asked for it.

Questions

Is buying an email list legal in the United States?

The CAN-SPAM rules the FTC describes center on opting out; they do not ask for consent before the first message. Recipients in the EU or Canada bring other laws, and harvesting addresses is an aggravated violation under CAN-SPAM. Your email platform will almost certainly forbid it regardless. Ask a lawyer about your case.

The seller says the list is opt-in and compliant. Does that help?

Not much. People consented, if at all, to the seller. HubSpot will not accept such lists even when they claim opt-in consent, Spamhaus says permission is not transferable, and under GDPR Article 7 you would have to demonstrate the consent yourself.

Can I email business addresses I found on company websites?

Ask a lawyer: the answer differs by country. In the EU, Article 13(5) of the ePrivacy Directive applies the consent rule to subscribers who are natural persons and asks member states to protect other subscribers' legitimate interests. CASL allows implied consent for a published business address only in narrow conditions. Mailchimp prohibits scraped lists either way.

Try it

For addresses people gave you themselves, check one in the free email checker or clean a whole opt-in list with bulk email verification.

Related

• The valid status: how spam traps work.
• Glossary: double opt-in.

Related guides

• Spam traps explained
• Double opt-in (confirmed opt-in)
• Email blocklists explained
• How to clean an email list
• Re-engagement campaigns and sunset policies
• All guides

Sources

• EUR-Lex: Directive 2002/58/EC (ePrivacy Directive), consolidated text: Article 13 on unsolicited communications.
• EUR-Lex: Regulation (EU) 2016/679 (GDPR): Articles 6 and 7, recital 32 on consent.
• FTC: CAN-SPAM Act, a compliance guide for business: requirements, opt-out timing, penalties, aggravated violations.
• Justice Laws Website: S.C. 2010, c. 23, sections 1 to 8: CASL section 6.
• Justice Laws Website: S.C. 2010, c. 23, sections 9 to 13: implied consent, unsubscribe timing, onus of proof.
• Mailchimp: Acceptable Use Policy: prohibited list types, evidence of consent.
• Mailchimp: Requirements and best practices for audiences: scraped lists.
• HubSpot: Understand opt-in consent for email: third-party and attendee lists.
• HubSpot: Clean up contacts to improve email deliverability: what to do with purchased lists.
• Brevo: Anti-spam policy: bought and scraped lists, consent, suspension.
• M3AAWG: Help! I Hit a Spam Trap! (February 2023): pristine traps and purchased lists, blocklisting, provider remediation.
• M3AAWG: Sender Best Common Practices, version 4.0 (August 2026): sections 4.1 (opt-in levels) and 4.4 (email append).
• Spamhaus: Sender guidelines: purchased lists and trap hits, non-transferable permission, limits of list validation.
• Google: Email sender guidelines: spam rate thresholds, purchased addresses.
• Yahoo: Sender best practices: purchased lists, spam rate.

How we wrote this: drafted by the email-validation.org team with the help of AI writing tools, from our product documentation and the sources linked in the text.