Usually, no. A ready-made B2B email list from a list broker or a freelancer is rarely worth a cold email campaign. You cannot see how it was built or when, and every dead address in it bounces against your sending domain.
Paying for data is a different decision. A seat on a data platform such as Apollo or ZoomInfo, where you set every filter yourself and verify each address before it goes into a sequence, is how good outbound lists get built. For any list, my ceiling is 0.5% bounces, with every address run through a verification tool before the first send.
So when someone asks whether to buy a list, the useful answer depends on which of the three things they mean: a broker's file, a data platform seat or a freelancer's spreadsheet. They carry very different risks.
Below: the legal position in four markets, the three options side by side, bounce math on a 20,000-contact list, and a checklist for a list you already paid for. Rules, prices and policies were checked in September 2026.
Is it legal to buy a B2B email list?
Whether a bought list is usable depends on where your prospects sit and on what you can show about where each address came from. This is not legal advice, so have a lawyer look at your own case before you send.
United States. Under CAN-SPAM, B2B email gets no exemption, as the FTC's compliance guide for business states plainly. Every commercial message needs accurate header information, a subject line that matches the content, a valid physical postal address and a clear way to opt out, honored within 10 business days.
Penalties run to $53,088 for each email that breaks those rules. The same guide says harvesting addresses can bring criminal penalties, so ask any seller exactly how the addresses were collected.
European Union. A work address with a person's name in it is personal data under the GDPR. Recital 47 says direct marketing "may be regarded as carried out for a legitimate interest." That only holds after a balancing test against what the person could reasonably expect, as the European Commission's legitimate interest page explains.
The part that matters most for a bought list is Article 14. When you did not collect the data from the person, you have to tell them which source it came from within a month of getting it, and at the latest in the first email you send them. Under Article 21, once they object to direct marketing, you stop using their data for it.
National rules sit on top of that. Germany's unfair competition law, UWG section 7, counts advertising by email as an unreasonable nuisance unless the recipient agreed to it expressly beforehand, and that paragraph has no separate rule for business recipients.
United Kingdom. Under PECR, you can email companies, LLPs and government bodies without prior consent, according to the ICO, as long as you identify yourself and include a working address people can use to opt out. Sole traders and certain partnerships are treated as private individuals, so they need consent.
The ICO also says the soft opt-in does not cover new contacts from bought-in lists, and UK GDPR still applies to named employees. The ICO flags that the Data (Use and Access) Act has put this guidance under review.
Canada. CASL requires consent. The CRTC's CASL FAQ allows implied consent when a person published their own address conspicuously, with no note refusing messages, and your email is relevant to their role.
The same FAQ is direct about lists: if a third party reproduces those addresses or sells a list of them on its own initiative, that does not create implied consent on its own. Penalties reach $1 million per violation for an individual and $10 million for a business.
What that means for a founder: the safest list is one where you can name the source of every row. In the EU and Canada, that is exactly what you may be asked to show.
Are you buying from a broker, a data seat or a freelancer?
"Buy a list" covers three different products with different risks, so compare the product before you compare vendors.
| List broker file | Data platform seat | Freelancer spreadsheet | |
|---|---|---|---|
| What you get | A finished file, built before you ordered it | Access to a database you search and export from yourself | A one-off file built by one person, by methods you take on trust |
| Who sets the targeting | The seller's categories | You, filter by filter | The freelancer, working from your brief |
| Who verifies | The seller says it did | You, before every send | The freelancer says it did |
| How fresh | Whenever the seller last updated it | As fresh as the platform's data on the day you export | Fixed on the day it was built |
| Can you name the source (GDPR Art. 14) | Only if the broker tells you | Yes, the platform | Only if the freelancer tells you |
| What bounces look like | Unknown until you verify it | Under 0.5% is reachable if you verify first | Low opens and high bounces in the lists I have seen |
| My verdict | Avoid for cold email | The default | Avoid |
The freelancer column is the one I have seen go wrong in practice. A UK design agency had paid freelancers for its lead lists and got poor open rates and plenty of bounces, one of several problems I found on our first call and wrote up in my post on why one cold email got two very different reply rates.
Two more sources come up often. Directories and association member lists give you company names, and you still have to find and verify the right person at each company. A list built to your spec by a researcher or an agency sits closer to the data seat, because it is made after you order it. Ask which platforms were used and when it was verified.
Even a data seat needs your own check. One data vendor advertises a 95% email accuracy rate on its pricing page. That is the vendor's own claim, and taken at face value it still allows 1 bad address in 20, ten times my 0.5% ceiling. That is why verification is your job, whoever sold you the data.
What does a bought list do to your bounce rate?
A hard bounce is an email to an address that does not exist. The Amazon SES enforcement FAQ says email providers and anti-spam organizations use high bounce rates to spot senders with bad habits, and that high bounces can push your mail into spam.
Your cold email may never touch SES, which is a sending platform. It is still a useful yardstick, because it publishes its lines: below 2% for best results, a review at 5%, a possible sending pause at 10%.
Here is what those rates mean on 20,000 contacts, the minimum I plan for a first list. The bounce rate is hard bounces divided by emails sent, and every contact gets the first step of the sequence.
| Dead addresses in the list | Hard bounces on 20,000 first emails | What that means |
|---|---|---|
| 0.5% | 100 | My ceiling, verified with NeverBounce or DeBounce |
| 2% | 400 | The edge of what SES calls best results |
| 5% | 1,000 | SES would put an account under review |
| 10% | 2,000 | SES may pause sending |
The file is the cheap part. The expensive part is a domain that now lands in spam for your next campaign too, including the one sent to a perfect list.
Age makes it worse. ZeroBounce, a verification vendor, reports in its 2026 list decay report that 23% or more of a list goes bad within a year, based on more than 11 billion addresses it checked in 2025 across all kinds of lists, B2B and otherwise. A file that sat in a broker's database for a year has had time to rot.
Old addresses carry one more risk. SES notes that addresses which stop working and keep bouncing for a long time can be turned into spam traps. That makes an old, unverified list a likely place to hit one.
I already bought a list. What should I do with it?
You do not have to throw the money away. You do have to treat the file as unverified until it proves otherwise.
- Ask where it came from and when. Get the source, the build date and the method in writing, and keep a source column per contact. If nobody can answer, you also cannot meet Article 14 for EU contacts.
- Verify every address. Run the whole file through NeverBounce or DeBounce and send only to the addresses that come back valid.
- Cut rows that do not fit your buyer. Sort by title, country and company size and remove what you do not sell to. I wrote up the checks I run on any lead list in more detail.
- Keep it out of your email marketing platform. Mailchimp's acceptable use policy bans sending to purchased, rented or third-party lists.
- Send from warmed-up secondary domains, never your main one. A bounce spike should cost you a spare domain, not the one your invoices go out from. My post on domains, inboxes and warmup covers the setup.
- Start with a small batch. SES advises sending to addresses you have not mailed lately only as a small share of your volume. Check the bounce rate on that batch before you send the rest.
- Stop at 0.5%. If the test batch bounces above that, do not push through. Rebuild the failing segment from a data platform instead.
How do you build the list instead?
Building beats buying because you control each step. Choose the market first, as I describe in how I pick a market before writing a word. Then pull decision-makers by title, country and company size, export, verify and send.
My team builds lists with Apollo, ZoomInfo, RocketReach and Sales Navigator, among other tools, and a list pulled from tools like these beats a scraped one. For a first list, plan on at least 20,000 contacts, so the campaign has enough people in it to survive the ones who are busy, mid-contract or simply not buying this quarter.
The seat itself is cheap next to a burned domain. Apollo's pricing page lists its Basic plan at $49 a seat per month on annual billing, with 30,000 credits a year and 1 credit per email (checked September 2026). That is $588 a year, or about 2 cents an email if every credit gets used.
How do you choose between data platforms?
- Judge it by how many of your buyers it holds. Run your real filters in a trial (titles, countries, company size) and count what comes back. A huge database with thin coverage of your niche is a small database for you.
- Verify a sample export yourself. Put a sample of rows through NeverBounce or DeBounce. The share that fails is the number to compare between vendors, and 0.5% is the bar.
- Check the countries you sell into. For EU contacts, you also want a platform that can tell you where its data comes from, because Article 14 makes that your question to answer.
- Compare cost per usable contact. Credits you never spend and addresses that fail verification both push up the real price of each contact you can actually email. I worked that math through for five vendors in what B2B contact data really costs per contact.
For transparency: Smirnov Consulting Group is a Prague-based B2B outbound lead generation agency that runs cold email and LinkedIn campaigns for founder-led B2B companies and books qualified sales calls. Building lists is part of that work, so read my bias into this section. The method above works the same whoever runs it.
Short answers on buying B2B email lists
Can you legally email a purchased B2B list?
It depends on where your prospects are. In the US, CAN-SPAM covers business email and requires an opt-out and a postal address. In the EU, you must tell people where you got their data. The UK lets you email companies without consent, but not sole traders. In Canada, a sold list does not create consent.
Where can you get B2B leads that are safe to email?
From a data platform seat where you set the filters and verify every address yourself, or from a list built to your spec with named sources and a verification date. Files from list brokers and cheap freelancer spreadsheets are the riskiest options, because you cannot check how or when they were built.
What bounce rate is safe for cold email?
Keep it below 0.5% by verifying every address before the first send. Amazon SES, which publishes its thresholds, recommends staying under 2%, reviews accounts at 5% and may pause sending at 10%. If a test batch goes above 0.5%, stop and verify again before you send any more.
Will a purchased email list hurt deliverability?
It can, badly. Dead addresses produce hard bounces, and mailbox providers and anti-spam groups read high bounce rates as a sign of a bad sender. Old addresses can also be turned into spam traps. The damage lands on your domain and follows it into later campaigns.