The Spam Resource Guide to Buying an Email List
Welcome to the Spam Resource Guide to List Purchasing! Everything you need to know about buying an email list, and it fits in just one word: Don’t. That’s all. Thanks for reading. See you next time.
Just kidding. Why are you here? I know why you’re here: You’re an email marketing manager, and somebody above you just told you to go buy a list. Maybe leadership assumes that’s what everybody does. Maybe the quarter is looking rough and the word from on high is “growth at any cost.” Either way, it’s now your job to explain why that’s a bad idea, and “some guy with a deliverability blog and a chip on his shoulder” probably isn’t going to cut it in the next staff meeting.
So this one is for you. I’ve gathered up documentation from mailbox providers, email platforms, regulators and industry experts, all pointing to the same conclusion: email marketing success is built on permission. Forward this post. Print it out. Staple it to a budget request. Whatever helps.
What the Mailbox Providers Say
Gmail, Yahoo and Microsoft are the gatekeepers to the majority of consumer inboxes. All three have been clear that they want you sending to people who asked for your mail.Google’s email subscription guidelines go beyond plain opt-in. Before sending marketing messages, Google wants you to make sure recipients have confirmed their email address after signing up on your website or app. Google calls this “double consent.” What you or I would call double opt-in or confirmed opt-in. Yep, I wish it was worded better, but it does indeed prohibit purchasing lists. How are you going to get double consent from somebody else’s list?
Google also says that senders should keep their spam complaint rate below 0.1%, and should never let it reach 0.3% or higher. (Hold onto those numbers. We’re going to come back to that.)
Yahoo’s sender best practices tell you to send only to users who specifically requested your mail. They name buying mailing lists as something not to do, right alongside pre-checked opt-in boxes.
Microsoft, when it announced updated bulk email sender requirements in 2025, included sending to people who have given consent among its recommended practices. It also reserves the right to filter or block senders who don’t follow them.
Apple is explicit: Send only to recipients who explicitly subscribed to your emails (not list purchases, list rentals, or email appends).
And there you’ve got the “MAGY” (Microsoft, Apple, Google, Yahoo) crowd speaking with one voice. That covers most consumer email inboxes in the US.
What the Email Service Providers Say
Even if you wanted to send to a purchased list, you’d have a hard time finding a reputable platform that would let you. They’re not the thought police — they don’t have “precog” technology to stop you from ever uploading bad data — but most of them do watch for and react negatively, when you send to a purchase list. They can tell, because the tracking data typically stands out as significantly sub-par.Mailchimp’s Acceptable Use Policy prohibits sending to purchased, rented, third-party, co-registration, publicly available or partner lists of any kind. Their help docs even offer examples. In one, somebody bought a list of 30 million addresses “from this guy on the Internet.” Spoiler: Not allowed.
Mailchimp goes even further. They built an abuse-prevention system, called Omnivore, that checks newly imported addresses. If it predicts a high rate of bounces, complaints or spam trap hits, it blocks sending to that audience until it’s cleaned up. The very goal of this thing is to attempt to identify when clients attempt to upload purchased lists.
Way back in 2015, Word to the Wise compiled a list of ESPs and their policies on purchased lists. The point was to give marketers ammunition when asked to send to one. Ten years later, the platforms still agree. Here are HubSpot, Campaign Monitor, Zoho Campaigns, and Mailjet as just a few examples of ESPs and how they explain why you shouldn’t do it. Many platforms treat it as grounds to suspend or terminate your account.
Ask yourself: why would so many companies turn away paying customers? Because they’ve seen what happens. Allowing clients to send to purchased lists can damage the platform’s reputation and hurt deliverability for everyone else sending through it.
You might also be thinking, wait, if all of these platforms prohibit unsolicited mail and purchased lists, why have I gotten spam from them? Maybe you’ve even gotten spam from every single one of them. Spam, ultimately, happens. Speeding, bad driving, ultimately happens. The police don’t catch everyone speeding. Nor does an ESP catch everyone who uploads purchased list data. A lot of the time, the ESP just hasn’t caught on … yet. Email policy enforcement is often reactive. You’ll see other spam out there, sometimes from good platforms. It doesn’t mean that it’s a path to long term success.
Why list purchasing fails? Reputation/Engagement
Mailbox providers decide what lands in the inbox largely based on how recipients react to your mail. Opens, clicks, replies, moving a message out of the spam folder: those are positive signals. Spam complaints, deletes without reading, and mail to dead addresses are negative signals.Now think about who’s on a purchased list. People who have never heard of you, never asked to hear from you, and have no idea why you’re in their inbox. Of course your positive signals go down. Of course your complaints go up. You’re a stranger interrupting their day.
Remember that 0.1% complaint threshold from Gmail? That’s one complaint per thousand recipients. Send to a list of people who never asked for your mail and you’re likely to blow past it quickly. Then your mail goes to the spam folder, or gets blocked outright. That doesn’t just happen to the bought-list send. It can happen to your welcome messages, your receipts and the newsletter that your actual customers signed up for.
Then there are spam traps. Purchased lists are notorious for containing them: addresses that were never used by a real person, or abandoned addresses that have since been turned into honeypots intended to identify spammers. Mailing to them is how senders end up on blocklists like Spamhaus.
Permission Performs Better
If deliverability risk doesn’t move leadership, maybe revenue will. Here’s a case study comparing a nonprofit’s opt-in and non-opt-in list segments. They received the same campaign, with nearly identical send volumes. The opt-in segment converted at 15 times the rate of the non-opt-in segment. Open rates were twice as high, and click-through rates were eight times higher.Fifteen times. Not fifteen percent. Fifteen TIMES. And those not-opt-in folks weren’t even strangers from a purchased list; they were in the organization’s own database. Imagine how much worse it gets with a list of people who have never heard of you.
This is the single link I’d put in front of a VP who wants to buy a list. Bring it to the meeting.
But Everybody Does it!
No, they don’t. Lots of people speed. Some people steal cars. You can find examples of nearly anything if you look hard enough. That doesn’t make it a business strategy. For every bad actor you hear about, there are far more people doing things the right way and finding success from it.The data backs this up. In Mailgun’s email deliverability survey, fewer than one in ten senders admitted to buying or scraping addresses in the previous two years. Which means that over 90% of senders aren’t doing it. “Everybody” is actually the small minority.
But I get so much spam!
Sure, spam exists. But the spam you see is the leftovers. Google says that Gmail blocks more than 99.9% of spam, phishing attempts and malware before it reaches the user. The handful of junk in your spam folder is what’s left after filters threw out the overwhelming majority.Meanwhile, legitimate email is enormous. The Radicati Group estimates that about 392.5 billion emails are sent and received every day in 2026. Mailchimp alone served up more than 340 billion emails on behalf of its customers in 2019. That’s one platform, years ago. The successful, profitable, wanted email marketing out there massively outnumbers the junk in your spam folder. That’s who you want to be like.
What about CAN-SPAM?
“But it’s legal!” somebody will say. The FTC is clear that CAN-SPAM doesn’t require you to get consent before sending commercial email. There’s no opt-in requirement. But that doesn’t mean the law ignores the concept of permission.CAN-SPAM defines “affirmative consent,” and it is straightforward and clear. The definition? The recipient has to have expressly agreed to receive your messages, either in response to a clear and conspicuous request or on their own initiative. A list broker telling you that “everybody on here opted in” doesn’t get you there.
And here’s the kicker. If you send commercial email to people who haven’t given you that affirmative consent, CAN-SPAM requires you to clearly and conspicuously identify the message as an advertisement. Only senders with prior affirmative consent are exempt. So the law effectively makes you label your unsolicited mail as an unsolicited ad. Go ahead and guess how recipients (and spam filters) will react to that. It’s a death knell for email marketing success.
Also keep in mind that CAN-SPAM is the most permissive law out there. Send to recipients in Canada or the EU, and laws like CASL and GDPR make consent a requirement, not a nice-to-have.
Psst — want to buy a list?
Here’s the part that might surprise leadership: a lot of the people selling email lists are lying to you.If you’ve ever exhibited at a trade show, you’ve probably received an offer to buy the “attendee list.” These offers are so common that conference organizers routinely post warnings about them. Bits & Pretzels put out a warning saying flatly that anyone offering a conference attendee list is running a scam. Scammers scrape outdated information from old event pages, social media and public directories, then repackage it as a current list. They also link to a deeper dive discussion from Trade Show Network with more information.
The American Astronomical Society has warned members about the same thing. Search for “attendee list scam” and you’ll find dozens more.
The broader list market isn’t much better. Plenty of sellers advertise “100% permission-based opt-in” lists that are nothing of the sort. They’re harvested or compiled from wherever the seller could scrape addresses.
Think about it this way: anyone with a genuinely engaged, opt-in list knows how valuable it is. They’re not going to sell it to a stranger for a few hundred bucks. If someone is willing to sell you their list, that tells you exactly what it’s worth.
I’ve written about this before, too.
So, what do you tell the boss?
Here’s your cheat sheet:- Gmail, Yahoo and Microsoft all want you sending only to people who asked for your mail, and they set complaint thresholds that bought lists are likely to blow through.
- Reputable email platforms prohibit purchased lists, and many will suspend your account for using one.
- Purchased lists drive down engagement, drive up complaints, and often contain spam traps that can land you on blocklists. That can hurt delivery of ALL of your mail, not just the purchased-list send.
- Opt-in lists perform dramatically better. In the case study shared above, they converted 15 times better.
- Most senders don’t buy lists. The successful ones build them.
- CAN-SPAM sets a high bar for consent and makes you label unsolicited commercial mail as an ad. That means applying a big ole “this is spam” sticker to your spam. That’s bad.
- A lot of list sellers are scammers, and the rest are selling scraped data.
TL;DR? Don’t buy a list. Build one.