Buying a B2B email list for cold email is legal in most cases but carries real risk: the data decays fast, it can carry spam traps, and most email platforms ban sending to purchased lists outright. None of that makes it automatically a bad idea, but it changes what "buy a list" should actually mean.
This page covers whether buying is legal, why bought lists bounce and trap more than built ones, and why your sending platform might shut the campaign down before it starts. It also covers the real difference between a static list and a data subscription, how to vet a provider if you go that route, and building a list yourself as the alternative. For the deeper mechanics of cleaning and verifying any list once you have one, see our cold email list quality guide.
Is it legal to buy a B2B email list for cold email?
Buying a B2B email list is legal in the US under CAN-SPAM, but the law puts the compliance burden on you as the sender, not on where the data came from. The FTC's CAN-SPAM compliance guide makes no exception for B2B email. It holds both the business behind a campaign and whoever sends it accountable for the same rules: honest sender details, a real postal address, and a working opt-out honored within 10 business days.
In the UK and EU the picture is narrower. The ICO's guide to electronic mail marketing allows emailing a corporate body without prior consent under PECR, but a sole trader or an individual contact needs consent first. A bought B2B list almost always mixes company contacts with sole traders and named individuals, so buying the list does not tell you which rule applies to each row; you still have to check.
Canada and Australia go further: both treat a list built by harvesting addresses as a separate violation, on top of whatever consent rule applies. Our cold email legality guide covers the full country-by-country breakdown.
Legality is the floor, not the whole decision. A legal list can still be a bad one to send to, for reasons that have nothing to do with the law.
Why do bought B2B email lists bounce and hit spam traps in cold email?
Bought lists bounce more and hit more spam traps because the data was collected once, at a point in time, and nothing about buying it keeps it current afterward. Three separate problems stack on top of each other:
- Decay. People change jobs, companies shut down domains, and a contact that was accurate on the day the list was compiled can be dead a few months later. A list sitting unsold for a year before you buy it is already partly stale on arrival.
- Recycled spam traps. An address that was a real mailbox once can quietly turn into a spam trap after it goes dormant. A list built from older or scraped sources carries a real chance of these, and no amount of verification at your end can see one coming; it looks exactly like a normal address until it is not.
- Shared lists. The same rows often get sold to many buyers at once, so a single business can receive near-identical cold emails from several senders in the same week. That drives up spam complaints independent of whether any single email was well written, and complaint rate damages a sending domain faster than bounce rate alone.
Does sending cold email to a bought list break your email platform's terms?
Yes, for most mainstream email platforms, buying a list violates the terms you agreed to when you signed up, regardless of whether the list itself is legal to own. Mailchimp's acceptable use policy lists "upload or send email Campaigns to purchased, rented, third-party, co-reg, publicly available data, or partner lists of any kind" as a prohibited action. Its standard terms of use repeat the same ban directly in the contract, and EmailOctopus's acceptable use policy bans "purchased, rented, scraped, harvested, appended or otherwise third-party sourced lists of email addresses" in the same way.
| What the policy bans | What it means for a bought list |
|---|---|
| Purchased, rented or third-party lists | A bought B2B database falls inside this definition on both platforms checked |
| Publicly available or scraped data | Lists built by scraping directories or websites are banned the same way, even without a purchase |
| Lists with no proof of permission | Both platforms can ask for evidence of how and when a contact agreed to hear from you |
A platform that finds a purchased list mid-send does not just warn you. It can throttle sending, suspend the account, or remove it outright, which stops a campaign faster and more completely than a bad bounce rate ever would. This is a contract risk that exists independently of whether the law allows the list itself.
If you decide to build instead, our guide to building a cold email lead list walks through sources, fields and verification.
Static list vs data subscription for cold email: what is the difference?
A static list is a one-time export you own and keep, while a data subscription is ongoing access to a provider's database that you query whenever you need new contacts. The difference matters because it changes how fast what you are sending to goes stale.
| Static list (one-time purchase) | Data subscription / queryable database | |
|---|---|---|
| What you get | A fixed file, delivered once | Ongoing access, query on demand |
| How it ages | Starts decaying the day you receive it, with no updates | The provider refreshes records behind the scenes between your queries |
| Typical pricing | Per record or per list, paid once | Monthly or annual access, often with a credit allowance |
| Best fit | A narrow, one-off campaign where speed matters more than longevity | Repeated prospecting over months, where fresher pulls matter more than owning a fixed file |
Neither model removes the legal or ESP-policy issues above; both are still a purchased list in the sense those rules mean. The subscription model does reduce the decay problem somewhat, since a query run today pulls fresher records than a file bought a year ago. It does not solve the shared-list problem: the same database still gets queried by many other buyers.
How do you vet a B2B data provider before cold outreach?
Vet a provider by checking five things before you pay, not after a bad send has already damaged a sending domain. A provider's marketing page rarely answers these directly, so ask.
- Freshness date. When was this specific record last confirmed or updated, not just when the overall database was launched.
- Verification method and timing. Is every record checked at the moment you export it, or only when it was first added to the database.
- Bounce guarantee. Does the provider credit back or refund addresses that bounce, and within what window after delivery.
- Source. Where did this contact's information come from: a public filing, a form the person filled in, a scrape, or something the provider will not disclose.
- Opt-out and suppression handling. If a contact has already asked not to be emailed, does the provider track that and keep them out of future exports, or is suppression entirely your problem once you buy.
A provider that answers all five clearly is a meaningfully different risk than one that only advertises accuracy percentages. The percentage figure describes the database on average; the five questions above describe the specific batch you are about to send to.
Can you build a cold email list yourself instead of buying one?
Yes, and a list built from current, public sources is usually fresher than a bought one, because you control exactly when each contact was found rather than inheriting someone else's compilation date. Three sources cover most of what a bought list would otherwise provide.
- Company websites. Most small and mid-size businesses publish a contact or team page with a role-based address like info@ or sales@, or sometimes a named contact directly.
- Map and directory listings. Business listing platforms often show a published contact email or link straight to the company site, and the listing itself confirms the business is currently active.
- Industry directories. Trade associations, chambers of commerce and sector-specific directories list current member businesses, which is a narrower but more relevant pool than a generic database pull.
Self-built data still needs verifying before the first send, the same as bought data. Building it yourself does not skip that step. It only means the starting point is fresher, and the source is one you can stand behind if a recipient asks where you got their details.
Should you buy a B2B email list for cold email, or build one?
Buy only if you have checked the legal basis for the specific contacts involved, confirmed your sending platform allows purchased data, and vetted the provider on freshness, verification, bounce guarantee, source and opt-out handling. If any of those checks comes back uncertain, building the list yourself removes the ESP-policy risk entirely and usually produces fresher data besides.
Whichever path you take, verify every address before it goes anywhere near a live send. Pipefire finds its own prospects for every campaign rather than working from a list the user supplies, and verifies each address before sending, with the campaign pausing automatically if hard bounces cross 3%. Our setup guide covers how a campaign gets its prospect list built before the first email goes out.
For the deeper mechanics of catch-all addresses, spam traps and bounce thresholds once you have a list from any source, see the cold email list quality guide. For how an SMTP-level check actually confirms an address exists, see our email verification guide.
Buy B2B email list for cold email FAQ
Is it illegal to buy a B2B email list for cold email?
Not on its own in the US, where CAN-SPAM allows B2B cold email without prior consent, but the sender stays liable for honesty and opt-out requirements regardless of the data's source. In the UK and EU the answer depends on whether each contact is a company or an individual; see our cold email legality guide for the country-by-country rules.
Will my email platform let me send cold email to a bought list?
Usually not. Mailchimp and EmailOctopus both ban purchased, rented or third-party lists directly in their acceptable use policies, and a platform that detects one can suspend the account or the campaign, not just the one email.
What is the safest way to buy a B2B email list for cold outreach?
There is no fully safe way, only a lower-risk one. Check the legal basis for the contacts, confirm your sending platform allows the data, and vet the provider on freshness, verification method, bounce guarantee, source and opt-out handling before paying.
Is a data subscription safer than a one-time list for cold email?
It is fresher, since a query run today pulls more current records than a file bought months ago, but it is not legally or contractually different. Both are still purchased third-party data under the laws and ESP policies covered above.
How do I build a cold email list without buying one?
Pull contacts from company websites, business directory and map listings, and industry or trade association directories, then verify every address before sending. This takes longer than buying a list but gives you a known source for every contact and data that has not already decayed in someone else's database.