Email Lists for Businesses: Buy the File or Build It

Email lists for businesses are files of company records. Each row carries a named contact, a job title and an email address. You can get one in three ways:

1. Buy a ready-made file from a list broker.
2. Rent a seat on a data platform and pull the records yourself.
3. Build the file from your own clients, free public registers and those platforms.

If the people you want to reach are business owners - build it.

The reason sits inside the record. Most US business establishments have no paid staff, so a file that reaches small businesses will hold many "owners" who run a business with nobody else in it.

In the UK that person can be a sole trader, and the email marketing rules treat a sole trader like a private individual. That is a big group.

UK government business population estimates for 2025 count 3.2 million sole proprietorships at the start of 2025, 57% of all private sector businesses. When you build a file yourself, you can explain every row, and both the law and the mailbox providers expect that.

Who is the owner on a business owner email list?

On a list, "owner" is a label a data seller attached to a row. It can mean three different people, and each one carries different rules.

The last row is bigger than most founders expect. The US Census Bureau runs a separate statistics program for businesses with no paid employees. Its own figures back the point from the top of this article: nonemployers are the majority of US business establishments (U.S. Census Bureau). A business enters that count once it has $1,000 or more in receipts, or just $1 in construction.

The Census Bureau's 2025 release puts that program at 29.8 million businesses without paid employees. And the group grows faster than the rest. The same release found nonemployers grew an average 2.7% a year from 2012 to 2023. Employer businesses grew 1.1% a year.

The census counts establishments, which is a different unit from the rows on a seller's file. Even so, the deeper a file reaches into small businesses, the more owners on it are the whole team and the only inbox.

On the corporate side, I start every owner file by deleting the filler titles: Assistant, Associate and the bare "Manager". "Manager" at a 6-person firm tells you nothing about who signs. Keep the titles the niche really uses for its owners, such as Founder, Owner, Managing Director, Principal or Partner. A CEO email list works differently, because the chief executive of a larger company is often a hired executive and not the owner.

Two decision rules follow from the table:

1. If only companies with a team buy your product, delete the sole traders from the file before you do anything else.
2. If one-person businesses are your buyers, you need their consent under UK rules, and in any market you should not rely on a bought file whose sources you cannot trace.

Should you buy a list, rent a data seat, or build your own?

The cheapest version of the first row is a file bought from a freelancer. When a company shows me one of those, I already know how the campaign went: low open rates and a lot of bounces. I would take a list pulled from Sales Navigator, Apollo or UpLead by someone who knows the buyer over any scraped file. Every time.

What does a built list look like over a full year? For a UK social media marketing agency, my team ran LinkedIn outreach with warm emails, plus cold email, into 3 niches. The lists came from Sales Navigator, Apollo and UpLead.

Month 1 produced 44 booked sales calls, month 2 produced 57, month 3 produced 68, and the 12-month total was 714. Every one of those was a meeting booked through LinkedIn or email, with no paid ads.

What does each route cost?

Here is what the best-known sellers publish, checked on their own sites. These are the sellers' own list prices, not quotes I have negotiated.

Building has costs. The register is free, but you still pay for a data seat to find the named owner and for a verifier to check each address. The difference is what the money buys: a seat lets you pull fresh rows whenever your targeting changes, while a bought file is a fixed set of rows that you work through once.

A built file also has to be big. Our first list for a campaign is at least 20,000 contacts. Quality alone is not enough; you need quantity as well. A hand-picked file of a few hundred owners looks impressive in a spreadsheet and runs dry fast.

Decision rule: if you cannot say where a record came from, do not send to it. To compare brokers and data seats side by side, with the bounce arithmetic, see the full broker vs data seat comparison.

Is it legal to buy an email list of business owners?

The trouble starts when you send to the file, and the answer depends on the market and on the type of record. Below is the part of each regime that matters for owner lists. This is not legal advice.

United States

Under CAN-SPAM, an email to a company owner counts as commercial email like any other: the FTC says B2B messages get no exemption. Every commercial message needs a working opt-out, and you must honor a request within 10 business days. The FTC's CAN-SPAM compliance guide puts the penalty at up to $53,088 for each separate email in breach.

The FTC adjusts that cap for inflation, so the number on its page may be higher when you read this.

Two points hit bought lists directly:

• Opted-out addresses. Once someone opts out, their address cannot be sold or transferred, even as part of a mailing list. A spreadsheet will not show you which rows opted out from someone else in the past.
• Harvesting. The FTC guide names harvesting addresses, or generating them with a dictionary attack, among the practices that can bring criminal penalties.

United Kingdom

According to the ICO, the PECR rule on marketing email does not cover corporate subscribers (ICO B2B marketing guidance). You can email a limited company without consent, as long as you say who is sending and give the reader a valid way to opt out.

Individuals are a different case, and sole traders and some partnerships belong to that group. For them you need consent or the soft opt-in, a narrow exception for people you already deal with. Per the ICO, the soft opt-in never covers prospects, and it never covers new contacts taken from a bought-in list (ICO electronic mail guidance).

Put those rules together and a bought file of UK sole traders gives you no soft opt-in route, so you would need valid consent from each person, which you can rarely show for a bought file.

Corporate rows have rules too. A named address like initials.lastname@company.com is personal data under UK GDPR. A generic one like info@company.com is not. So the named owner on your file needs a lawful basis, and they have to be told that you hold their data.

Because of the Data (Use and Access) Act, the ICO lists its business-to-business marketing page as under review, so the rules may change.

European Union

GDPR Article 14 applies when you obtain personal data from a source other than the person (EUR-Lex, Regulation 2016/679). Every bought or rented record about a named person falls under it.

Among other things, you must tell the person where their data came from. The deadline is one month after you obtain the data, or your first message to them if that comes earlier. That first message must also point out their right to object, clearly and separately from everything else in it.

Canada

CASL asks businesses to get consent before they send commercial electronic messages. Its definition of spam includes collecting or using email addresses without permission (Government of Canada, CASL).

Germany

Under section 7 of the German Unfair Competition Act (UWG), advertising by email always counts as an unreasonable nuisance when the person receiving it has not given explicit consent in advance (UWG section 7). The text speaks of any addressee, with no carve-out for companies.

Germany sits outside my team's core focus. If a client wants German owners on the file, we reach them on LinkedIn under our own stricter rules. For an owner file covering Germany, Austria or the Czech Republic, cold email stays switched off until there is a compliant basis for it. The same caution applies to scraping and cold outreach in general.

What does Gmail say about sending to bought lists?

Google's sender guidelines for Gmail are blunt. Under sending practices, one line reads: "Don't purchase email addresses from other companies" (Google sender guidelines). The same page tells every sender to set up SPF or DKIM. It also says to hold the spam rate under 0.10% in Postmaster Tools and never reach 0.30% or higher.

Google's guidelines cover mail sent to personal Gmail addresses, and that is exactly where they collide with owner lists. Some sole traders run their business from a free personal mailbox, so a bought owner file can send mail into the inboxes this rule protects.

A one-person business also has no gatekeeper. The person who reads your email is the owner, and the same person decides whether to mark it as spam.

Decision rule: on any file you did not build yourself, delete the free-mailbox addresses first. Keep one only if the person gave you that address directly.

How do you build a business owner email list step by step?

Five steps, in this order.

1. Start with the clients you already have. List your past and current clients, then look for companies like them. For each client, write down the industry, the size, the region and who actually signed the deal. That last column tells you which "owner" title to search for.
2. Pull companies from a free public register. In the UK, Companies House publishes a monthly snapshot of live companies on the register, free of charge (Companies House). It comes as CSV files within 5 working days of the month end. Each record has the registered office address and a SIC code for the nature of the business, so you can filter by industry.

The snapshot has no email addresses and no contact names, and Companies House leaves you responsible for complying with data protection law. It covers UK companies only; for US or EU targets, start at step 4 and build the company list inside your data seat. 3. Check your lawful basis separately from the register. The ICO says personal data is not free to use for direct marketing just because it sits in the public domain, and it names Companies House among those places. Use the register to find companies. Decide your lawful basis as a separate question. 4. Find the named owner in a data platform. Look up each company from step 2 in your data seat. Filter with the real titles from step 1 and leave out the generic ones from the first section. Aim for one owner per company, plus a second decision-maker where the company has a board. 5. Tag every row before it leaves the sheet. Add two columns. Subscriber type (corporate or sole trader) tells you which rule applies. Source (the register, platform or client list the row came from, plus the date) gives you what an Article 14 notice needs.

A file built from Companies House starts out corporate, because the register lists companies. Sole traders, such as consultants who trade alone, get into your file through other routes, usually a data platform, so tag those rows with extra care.

A worked example. Say a UK software house that sells project tools to engineering consultancies wants to reach their owners.

• It writes down who signed its recent orders: managing directors at small firms, a commercial director at the larger ones.
• It downloads the Companies House snapshot, keeps live companies under the engineering consultancy SIC codes and drops the regions it cannot deliver to.
• It looks up each company's managing director in a data seat.
• It tags every row as corporate and logs the snapshot month as the source.
• It sends only to the rows that pass verification.

One-person roofers and electricians trading as sole traders never enter the file, because the product sells to firms with crews. If the one-person shops are your buyers, that is a different job, covered in outbound to small business owners.

What should you check before the first email goes out?

Run these four checks on the finished file:

1. Every address verified. My team runs every address through NeverBounce or DeBounce and sends only to the ones that pass. Before that step, audit the lead list before you send for wrong titles, wrong company sizes and overlap between reps.
2. A hard bounce ceiling. Keep bounces below 0.5% of sends. If a send goes above that, stop the campaign and fix the file before anything else goes out.
3. A suppression screen. Keep a do-not-email list of everyone who has objected, and screen every new file against it, as the ICO recommends. Do not delete people who opted out. Once their record is gone, nothing stops their address from coming back in the next file you load.
4. Both tags filled in. No row goes out with an empty subscriber type or an empty source column from build step 5.

When a campaign goes quiet, founders start rewriting the email, because the subject line is the part they can see. The spreadsheet usually stays closed, so that is the first thing I open. Even sharp wording fails when the list is wrong or the sender is weak. Period. Fix the file first. Then scale.

Who pays for the data when an agency builds the list?

A disclosure, since this whole article argues for building: list building is part of the work my agency does for clients, so I have a stake in this. The monthly fee covers our work, list building included. The client pays for the data, the tools, the sending domains and the mailboxes directly, to the providers.

That setup changes with the industry, the market and the volume, so we scope it for each client.

Many owner files also come with phone numbers. We never cold call those numbers, and we run no dialing floors. The owner hears from us by email and on LinkedIn; a phone call is an optional extra, kept for owners who already replied, engaged or opted in. Every result I quote here comes from email and LinkedIn.

Whoever builds your list, ask before you sign whether you can open the file yourself at any time. If you cannot, you have no way to check what goes out under your domain. Build the file yourself, or insist on seeing every row.

Building an owner file for a niche where many buyers are sole traders? Book a call and tell me the niche. I will say which titles and registers I would start from.