# Bought Email Lists: Why Purchased Lists Fail

URL: https://email-validation.org/guides/bought-email-lists/
Updated: 2026-11-06

> Documentation index: https://email-validation.org/llms.txt

Bought, rented and scraped email lists fail because the people on them never agreed to hear from you. That runs into
the consent rules of the EU and Canada, it breaks the acceptable use policy of practically every email platform, and
it shows up fast in your deliverability: complaints from strangers, pristine spam traps, and blocklistings that can
take your wanted mail down with the rest. Verifying such a list removes some dead addresses, but it does not create
consent and cannot find every trap. Growing your own opt-in list is slower and is the only version that lasts.

## What counts as a bought list

The name covers more than a spreadsheet you paid for. Treat all of these the same way:

- **Purchased lists** from a broker or data vendor, including ones sold as "opt-in" or "compliant".
- **Rented lists,** where you pay for sends to someone else's audience or get the addresses for a campaign.
- **Scraped or harvested addresses,** collected from websites, directories or social profiles.
- **Appended addresses,** where a vendor matches your customer records to email addresses the customers never gave
  you. M3AAWG's
  [Sender Best Common Practices](https://www.m3aawg.org/sites/default/files/doc_files/m3aawg-sender-best-common-practices-aug-27-2026--1-.pdf)
  (version 4.0, section 4.4) calls email appending a direct violation of its core values.
- **Attendee lists** handed over by an event organizer, and partner or co-registration lists.

The common thread is that the person gave their address, if they gave it at all, to someone else. Spamhaus's
[sender guidelines](https://www.spamhaus.org/sender-guidelines/) state it plainly: permission is not transferable,
and it cannot be assumed after the fact.

## What the law says

This section summarizes what official sources say. It is not legal advice, and rules depend on where you and your
recipients are. Ask a lawyer before you rely on any of it.

### European Union: ePrivacy Directive and GDPR

Article 13(1) of the [ePrivacy Directive](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02002L0058-20091219)
allows email for direct marketing only to subscribers or users who have given their prior consent. Article 13(2)
carves out one exception: a business that obtained a customer's email address in the context of a sale may market its
own similar products to that customer, if it offered a free, easy way to object when it collected the address and in
every message since. Neither path fits a list you bought: the people on it did not consent to you, and they are not
your customers.

The [GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) adds rules for the personal data itself:

- **Article 6(1)** makes processing lawful only on one of the listed bases, the first of which is consent for one or
  more specific purposes.
- **Article 7(1)** puts the burden on you: where you rely on consent, you must be able to demonstrate it. Article 7(3)
  adds that withdrawing consent must be as easy as giving it.
- **Recital 32** describes valid consent as a clear affirmative act that is freely given, specific, informed and
  unambiguous. Silence, pre-ticked boxes and inactivity do not count.

Whatever a person agreed to on a seller's form, they agreed to it with the seller. You cannot demonstrate an action
they never took toward you.

### United States: CAN-SPAM

The FTC's [CAN-SPAM compliance guide](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business)
describes rules built around opting out rather than prior consent. Commercial messages must not use false header
information or deceptive subject lines, must identify themselves as ads, must include a valid physical postal address
and a clear way to opt out, and opt-outs must be honored within 10 business days. Once someone opts out, you may not
sell or transfer their address. The guide lists penalties of up to $53,088 for each email that violates the law, and
you cannot contract your responsibility away to the company that sends for you.

Two points matter for bought lists. The FTC names harvesting addresses and generating them through a dictionary attack
among the aggravated violations. And being allowed to send under CAN-SPAM does not mean your platform or the mailbox
providers will accept the mail.

### Canada: CASL

Section 6 of [Canada's Anti-Spam Legislation](https://laws-lois.justice.gc.ca/eng/acts/E-1.6/page-1.html)
prohibits sending a commercial electronic message unless the recipient has consented, expressly or by implication,
and the message identifies the sender and carries an unsubscribe mechanism. Under
[section 13](https://laws-lois.justice.gc.ca/eng/acts/E-1.6/page-2.html), whoever claims to have consent must prove
it. Section 10(9) limits implied consent to a few cases, such as an existing business relationship, or an address
the person published or disclosed to the sender, without saying they do not want such messages, where the message
relates to their business role. Section 11(3) requires unsubscribe requests to take effect within 10 business days.

## Your email platform forbids it

Even where a law would allow a send, your platform usually will not.

- **Mailchimp's** [Acceptable Use Policy](https://mailchimp.com/legal/acceptable_use/) prohibits sending to
  purchased, rented, third-party, co-registration, publicly available data or partner lists of any kind, and requires
  evidence of consent for marketing mail. Its
  [audience requirements](https://mailchimp.com/help/requirements-best-practices-audiences/) add lists scraped from
  public websites.
- **HubSpot's** [opt-in consent article](https://knowledge.hubspot.com/marketing-email/understand-opt-in-consent-for-email)
  says contacts purchased, rented, borrowed or otherwise taken from a third-party list cannot be used in its marketing
  email tool, even when the list advertises opt-in consent. An organizer's attendee list does not count either.
- **Brevo's** [anti-spam policy](https://www.brevo.com/legal/antispampolicy/) strictly prohibits lists scraped from
  the internet or acquired from a third party, requires active and explicit consent with proof of opt-in for every
  contact, and warns that breaking it can lead to immediate suspension of the account.

Platforms enforce this because their sending IPs and domains are shared. M3AAWG's
[Help! I Hit a Spam Trap!](https://www.m3aawg.org/help-i-hit-a-spam-trap) tells providers to require customers to
dispose of segments without confirmed permission, and to terminate customers who refuse to fix the problem.

## What happens to deliverability

### Pristine spam traps

A pristine trap is an address that no person ever used. M3AAWG says pristine trap hits frequently come from web
harvesting, address probing or dictionary attacks, and may be a strong indicator of purchased lists. Spamhaus calls
purchased, rented and harvested lists the most common source of spam trap hits. What a trap records feeds blocklists;
in extreme cases, M3AAWG notes, a sender is blocklisted and its mail rejected across a broad swath of the internet.
See [spam traps](https://email-validation.org/guides/spam-traps/#pristine) and [email blocklists](https://email-validation.org/guides/email-blocklists/).

### Complaints

People who never signed up report the mail as spam. Google's
[sender guidelines](https://support.google.com/mail/answer/81126) require a spam rate below 0.3% in Postmaster Tools
and recommend staying below 0.10%; they also tell senders not to buy addresses from other companies. Yahoo's
[sender best practices](https://senders.yahooinc.com/best-practices/) say the same about mailing lists and hold
senders to the same 0.3% ceiling. One bought segment can use up that margin in a single send. More in
[sender reputation](https://email-validation.org/guides/sender-reputation/).

### Bounces and old data

Traded lists are rarely current. Every address that no longer exists returns a
[hard bounce](https://email-validation.org/glossary/#hard-bounce). M3AAWG's Sender Best Common Practices (section 2.2) notes that receivers use
the volume of permanent failures to judge a sender, and that large volumes often point to an old or misapplied list
([reduce your bounce rate](https://email-validation.org/guides/reduce-email-bounce-rate/)).

## Why verification does not make it safe

Verification checks whether a mailbox accepts mail. On a bought list it will remove addresses that are `invalid` or
`disposable`, and some `valid` results with the action `remove`, such as [`spamtrap`](https://email-validation.org/docs/statuses/valid/#spamtrap)
or [`trap_pattern`](https://email-validation.org/docs/statuses/valid/#trap_pattern). That is the part it can do. What it cannot do:

- **Create consent.** A deliverable address belongs to someone who still never agreed to hear from you. The law,
  your platform and the complaint button all care about that, not about deliverability.
- **Find every trap.** A working trap accepts mail like any real mailbox, and operators keep their traps secret.
  Spamhaus says list validation does not clean out traps and is no replacement for permission, and it advises
  removing the source of bad addresses rather than trying to filter out individual traps.

Verification is for lists you have permission to mail
([list cleaning and consent](https://email-validation.org/guides/email-list-cleaning/#consent)).

## What to do instead

- **Sign-up forms that say what people get.** M3AAWG's Sender Best Common Practices (section 4.1) asks for clear,
  obvious consent, the type and frequency of mail stated up front, and use of the address only for that purpose.
- **Confirm each sign-up.** M3AAWG rates [confirmed (double) opt-in](https://email-validation.org/guides/double-opt-in/) as the best level; it
  keeps typos and maliciously submitted addresses off the list.
- **Lead magnets.** Offer a guide, template, tool or webinar in exchange for a subscription, and say on the form that
  marketing mail will follow.
- **Unchecked boxes at checkout.** Recital 32 and Brevo's policy both rule out pre-ticked boxes.
- **Your own presence at events.** HubSpot accepts contacts who give you their details in person, for example by a
  badge scan or your own sign-up sheet; the organizer's attendee list does not qualify.
- **Records of every opt-in.** Keep the time, source and form for each address, as Spamhaus and M3AAWG recommend.
- **Clean input.** Check addresses as they are typed
  ([sign-up form validation](https://email-validation.org/docs/guides/signup-form-validation/)) and protect forms from bots
  ([list bombing](https://email-validation.org/guides/list-bombing/)).

If you already bought a list, do not send to it. HubSpot's
[contact clean-up article](https://knowledge.hubspot.com/marketing-email/how-to-clean-up-your-contact-lists-to-improve-deliverability)
says to delete purchased lists at once or import them as an opt-out list, so they drop out of all marketing email.
A "permission request" sent to the list is still a first message to people who never asked for it.

## Questions

### Is buying an email list legal in the United States?

The CAN-SPAM rules the FTC describes center on opting out; they do not ask for consent before the first message.
Recipients in the EU or Canada bring other laws, and harvesting addresses is an aggravated violation under CAN-SPAM.
Your email platform will almost certainly forbid it regardless. Ask a lawyer about your case.

### The seller says the list is opt-in and compliant. Does that help?

Not much. People consented, if at all, to the seller. HubSpot will not accept such lists even when they claim opt-in
consent, Spamhaus says permission is not transferable, and under GDPR Article 7 you would have to demonstrate the
consent yourself.

### Can I email business addresses I found on company websites?

Ask a lawyer: the answer differs by country. In the EU, Article 13(5) of the ePrivacy Directive applies the consent
rule to subscribers who are natural persons and asks member states to protect other subscribers' legitimate
interests. CASL allows implied
consent for a published business address only in narrow conditions. Mailchimp prohibits scraped lists either way.

## Try it

For addresses people gave you themselves, check one in the free [email checker](https://email-validation.org/email-checker/) or clean a whole
opt-in list with [bulk email verification](https://email-validation.org/bulk-email-verification/).

## Related

- [The valid status: how spam traps work](https://email-validation.org/docs/statuses/valid/#how-traps-work).
- [Glossary: double opt-in](https://email-validation.org/glossary/#double-opt-in).

## Related guides

- [Spam traps explained](https://email-validation.org/guides/spam-traps/)
- [Double opt-in (confirmed opt-in)](https://email-validation.org/guides/double-opt-in/)
- [Email blocklists explained](https://email-validation.org/guides/email-blocklists/)
- [How to clean an email list](https://email-validation.org/guides/email-list-cleaning/)
- [Re-engagement campaigns and sunset policies](https://email-validation.org/guides/re-engagement-sunset-policy/)
- [All guides](https://email-validation.org/guides/)

## Sources

- [EUR-Lex: Directive 2002/58/EC (ePrivacy Directive), consolidated text](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02002L0058-20091219):
  Article 13 on unsolicited communications.
- [EUR-Lex: Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/eli/reg/2016/679/oj): Articles 6 and 7,
  recital 32 on consent.
- [FTC: CAN-SPAM Act, a compliance guide for business](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business):
  requirements, opt-out timing, penalties, aggravated violations.
- [Justice Laws Website: S.C. 2010, c. 23, sections 1 to 8](https://laws-lois.justice.gc.ca/eng/acts/E-1.6/page-1.html):
  CASL section 6.
- [Justice Laws Website: S.C. 2010, c. 23, sections 9 to 13](https://laws-lois.justice.gc.ca/eng/acts/E-1.6/page-2.html):
  implied consent, unsubscribe timing, onus of proof.
- [Mailchimp: Acceptable Use Policy](https://mailchimp.com/legal/acceptable_use/): prohibited list types, evidence of
  consent.
- [Mailchimp: Requirements and best practices for audiences](https://mailchimp.com/help/requirements-best-practices-audiences/):
  scraped lists.
- [HubSpot: Understand opt-in consent for email](https://knowledge.hubspot.com/marketing-email/understand-opt-in-consent-for-email):
  third-party and attendee lists.
- [HubSpot: Clean up contacts to improve email deliverability](https://knowledge.hubspot.com/marketing-email/how-to-clean-up-your-contact-lists-to-improve-deliverability):
  what to do with purchased lists.
- [Brevo: Anti-spam policy](https://www.brevo.com/legal/antispampolicy/): bought and scraped lists, consent, suspension.
- [M3AAWG: Help! I Hit a Spam Trap!](https://www.m3aawg.org/help-i-hit-a-spam-trap) (February 2023): pristine traps
  and purchased lists, blocklisting, provider remediation.
- [M3AAWG: Sender Best Common Practices, version 4.0](https://www.m3aawg.org/sites/default/files/doc_files/m3aawg-sender-best-common-practices-aug-27-2026--1-.pdf)
  (August 2026): sections 4.1 (opt-in levels) and 4.4 (email append).
- [Spamhaus: Sender guidelines](https://www.spamhaus.org/sender-guidelines/): purchased lists and trap hits,
  non-transferable permission, limits of list validation.
- [Google: Email sender guidelines](https://support.google.com/mail/answer/81126): spam rate thresholds, purchased
  addresses.
- [Yahoo: Sender best practices](https://senders.yahooinc.com/best-practices/): purchased lists, spam rate.

## Get up to 500 free credits. No card needed.

New accounts get 500 free credits (100 when you sign up with a free email provider such as Gmail, Outlook or Yahoo, or another personal mailbox such as a paid one like Fastmail or one from your internet provider). Try it on your own list before you buy. [Create your account](https://email-validation.org/signin/?new=1) or [open the free email checker](https://email-validation.org/email-checker/).