Buying an email list: why it doesn't pay off

Buying an email list, that is, a list of addresses obtained from a third party for money, does not pay off. The people on it never gave you consent to receive commercial emails, so sending offers to them breaks the EU ePrivacy rules as well as the GDPR. When we checked one purchased list with roughly 70,000 addresses with NeverBounce, more than 35 % of the addresses were invalid, faulty or risky. A campaign sent to a list like that ends in bounces, spam complaints and a damaged domain reputation. In Quanda it also ends in suspended sending, because we monitor the deliverability of every account. Instead of buying, it pays to build your own contact database from forms, lead magnets and meetings with customers.

Key takeaways

1. You have no consent for the addresses on a purchased list. Consent people gave to the seller cannot be transferred to you.
2. When we checked a purchased list with NeverBounce, more than 35 % of the addresses were invalid, faulty or risky.
3. Deliverability of a campaign sent to a purchased list commonly drops below 70 %, while Quanda keeps every account's deliverability above 95 %.
4. Spam complaints must stay below 0.3 %. When they rise, Quanda pauses sending and helps you find the cause.
5. A damaged domain reputation also hits the emails you send to your own customers.
6. A healthy own list keeps deliverability around 98 %. You can build it in six steps.

In short: is it legal, what are the risks and what to do instead

• Is it legal: you may send a commercial email only with the recipient's consent or to an existing customer with an offer of your own similar products. A purchased list meets neither condition.
• What it contains: outdated and non-existent addresses, spam traps and people who do not know you.
• What you risk: fines that depend on the country (in Czechia up to CZK 10,000,000), emails in spam, a damaged domain reputation and, in Quanda, suspended sending.
• What to do instead: a form with consent, a lead magnet, double opt-in and contacts from trade fairs, shops and events.

What has changed since the article was published: The article first came out in January 2016 under the title Why purchased database stinks? We rewrote it in October 2026. It now includes the result of checking a purchased list with NeverBounce, the rules Quanda uses to monitor account deliverability, spam traps, the GDPR duty to inform and a guide to building your own list.

What a purchased email list is

A purchased email list is a database of email addresses that you did not get from the people themselves, but from a third party for money. Sellers present it as a quick route to thousands of new contacts. They assure you that you can send your emails to the addresses and that they update the list regularly.

The same rules apply to lists that are not bought or sold, but are still not yours:

• Rented list: the seller sends your email on your behalf to their own list.
• Scraped addresses: contacts collected from business directories, websites or social networks.
• Inherited list: a list from a business partner, another company in your group or a former colleague.

In every case the same thing holds: the people on the list never gave you their address personally and are not expecting an email from you.

Is buying an email list legal?

Sending an offer to a purchased list is not legal: you lack the recipients' consent and a customer relationship. A commercial communication is any email that promotes your goods, services or company, including a newsletter or a webinar invitation. In the EU, sending them by email is governed by Article 13 of the ePrivacy Directive (2002/58/EC), which every member state has transposed into its own law. You may send a commercial communication by email in only two cases:

Source: Directive 2002/58/EC (ePrivacy Directive), Article 13(1) and 13(2).

A purchased list meets neither case. Even if the people on it once gave consent, they gave it to the seller, not to you. The anti-spam organisation Spamhaus puts it simply in its guidance on marketing emails: permission is not transferable. It adds that no legitimate company sells or rents a list of confirmed opt-in addresses.

The second obligation comes from the GDPR. When you do not obtain personal data directly from the person, Article 14 requires you to tell them who you are, why you process their data and where you got it. You must do so within one month at the latest, and if you want to email them, at the latest in the first email. Opening an offer with "we bought your address" will not make a good impression.

Warning: Fines for sending commercial communications in breach of the law depend on the country, because each EU member state sets its own penalties. In Czechia, for example, the data protection authority can fine a company up to CZK 10,000,000, and sanctions under the GDPR may apply on top of that. Authorities act on recipients' complaints, so one person who dislikes your email is enough.

A purchased database of companies is no exception, although the rules for company addresses differ between countries. The ePrivacy Directive requires prior consent for individuals and leaves the protection of companies to each EU country (Article 13(5)). In Czechia, Act No. 480/2004 Coll. requires the prior consent of every user, and under § 2(e) a user is any natural or legal person, so you need consent for the addresses of specific people in a company as well as for generic addresses such as info@. In Slovakia, by contrast, Act No. 452/2021 Coll. § 116(15) exempts direct marketing sent to the published contact details of entrepreneurs and companies from prior consent, but every message must offer an easy, free way to opt out. We recommend not sending to purchased company lists anyway, because people in companies mark unsolicited emails as spam just like other recipients. You will find more about the rules for commercial communications in the article What spam is and 4 rules to keep emails out of spam.

What happens when you send a campaign to a purchased list

A campaign sent to a purchased list damages four things at once: deliverability, domain reputation, your relationship with recipients and, in the end, the emails you send to your own customers.

A large share of the addresses do not work. When we checked one purchased list with roughly 70,000 addresses with NeverBounce, it flagged more than 35 % of the addresses as invalid, faulty or risky. In our experience, the deliverability of a campaign sent to a purchased list therefore commonly drops below 70 %. The promise that "we update the list regularly" will not prevent it. According to a 2026 ZeroBounce analysis, about 23 % of email addresses decay every year, as people change jobs and close mailboxes.

The list contains spam traps. A spam trap is an email address that a mailbox provider or anti-spam organisation uses to catch senders who mail without consent. Nobody uses it for normal mail, so it only gets onto a list through buying, scraping websites or neglecting a database for a long time. According to Spamhaus, purchased lists inevitably contain spam traps or generate complaints and bounces. Hitting a trap is a clear signal to mailbox providers that you send without consent, and it can land you on a list of spam senders.

Recipients mark you as spam. People who do not know you do not read your email, they click the Report spam button. The spam complaint rate is the share of recipients who marked your email as unwanted. Google's email sender guidelines require you to keep it under 0.3 %, which means fewer than three complaints per thousand emails. With a purchased list you will cross that line easily.

Emails to your customers suffer too. Sender reputation is tied to your domain, not to a single campaign. When a campaign to a purchased list damages it, Gmail, Outlook and Yahoo start filtering into spam even the newsletter to your loyal customers and your order confirmations.

Source: our own check of a purchased list with NeverBounce and Quanda's rules for monitoring account deliverability. The 0.3 % limit for spam complaints is set by Google.

How Quanda monitors account deliverability

Deliverability is the share of sent emails that the receiving servers actually accepted. Quanda evaluates it regularly for every account, together with the bounce rate, spam complaints and unsubscribes. We watch two limits: deliverability above 95 % and spam complaints below 0.3 %.

When an account's deliverability drops below 95 %, we investigate why. If it lasts longer, repeats or the numbers are much lower, we suspend the account, contact the customer and look for the cause together.

Spam complaints are even more sensitive. As soon as they start to rise for an account, we pause sending and help the customer adjust their sending routine. The aim is to stop emails being marked as spam before the sender reputation gets worse and delivery problems begin.

A campaign stopped in time does less harm than one that keeps going. Thanks to this, spam complaints for campaigns sent from Quanda have stayed below 0.03 % over the last 36 months.

Other email marketing tools take a similar approach. Mailchimp's acceptable use policy explicitly forbids sending campaigns to purchased, rented or third party lists.

Tip: Why specific emails were not delivered and what the error codes mean is explained in the article Reasons for undelivered emails. Quanda blacklists non-existent addresses automatically, see the help article Blacklisted contacts.

How to tell that a list is not yours

A list is yours when, for every contact, you know when and where they gave you their address and on what basis you are emailing them. Warning signs that a list is not yours:

• The seller offers contacts "with consent to receive emails from third parties" or "verified", without proof of who gave consent and when.
• The price is per thousand contacts and you can filter the list by industry or region.
• Most addresses are generic, such as info@, sales@ or office@.
• The contacts have no date or source showing where they came from.
• The addresses come from another company, public directories or websites.

When you import contacts into Quanda, you can store the legal basis, purpose and duration of processing for each of them. The article How to correctly import the legal aspects of personal data processing (GDPR) shows how.

How to build your own email list

Your own list grows more slowly than a purchased one, but every contact on it wants your emails. In our experience, a healthy list of honestly collected contacts commonly keeps deliverability around 98 % and higher. You build it in six steps:

1. Form with consent. Put a form on your website with an unticked checkbox for consent to receive news.
2. Lead magnet. Offer something useful in exchange for an email address, such as an e-book, a checklist or a webinar invitation.
3. Animated form. Make the form stand out with an animation that appears at the right moment, for example after a few seconds or after scrolling down the page.
4. Double opt-in. Turn on double opt-in so that every new contact confirms their address by clicking a link.
5. Offline contacts. Collect contacts at trade fairs, in your shop and at events too, always with consent.
6. Tag and welcome email. Give every new contact a tag based on its source and send them a welcome email while they still remember you.

What to offer in exchange for a contact is covered in the article Lead magnets in B2B marketing, and how to write an e-book people trade their email for in How to create an e-book. How to make a form stand out is described in Animated forms: a vending machine for new contacts, and you can set up tags and the welcome email by following Form automation: how to set it up and make the most of it. Why verifying the address pays off is explained in Double opt-in. What is it and how does it work?

Do not forget your existing customers. You may send them offers of your own similar products even without consent, as long as you got the address from a sale and offer an easy unsubscribe in every email.

What to do if you already have a purchased list

The best thing you can do with a purchased list is not to use it. If you already have one:

• Do not send anything to it, not even one test campaign. Complaints and spam trap hits arrive with the very first send.
• Do not import it into Quanda. Under the terms and conditions, you are responsible for having consent to the contacts' personal data and for having obtained it lawfully.
• Delete the contacts for which you cannot prove consent or a customer relationship. An unclear origin will not become clearer over time.
• If you have already sent a campaign, watch spam complaints and bounces in the statistics and get in touch with us. We will help you restore your sender reputation.

Older contacts in your own list that have not responded for a long time are worth cleaning out regularly. Contact scoring by open rate will help you with that.

Checklist: a healthy list without buying

Before you send your next campaign, check six things: contact origin, consent, address verification, tags, unsubscribe and statistics.

• For every contact, I know when and where they gave me their address.
• The contacts have given consent, or they are my customers and I offer them similar products.
• I verify new addresses with double opt-in.
• Contacts have a tag based on their source, such as a form or a trade fair.
• Every email contains an easy unsubscribe.
• After a campaign, I check deliverability above 95 % and spam complaints below 0.3 %.

Conclusion

A purchased list looks like a shortcut, but in reality it is the fastest way into spam. It comes without consent, more than a third of the addresses may be invalid or risky and a damaged domain reputation also hits your loyal customers. Your own list grows more slowly, but every contact on it knows you and is waiting for your email.

You can learn how to collect contacts in line with the GDPR in the free online course GDPR and Email Marketing in Practice, and how to look after your list in the course Contact database: import, hygiene, and segmentation. And if you are not sure how to build your own list, get in touch with us, we will be glad to help.