Should you buy an email list? How to do it with care

Why bought lists fail

The reason is mechanical, not moral. A purchased file is third-party data about people who have never heard of you. Some of them will press "Report spam", some addresses will bounce, and both providers measure exactly that. Once your complaint rate crosses their line, mail from your domain starts going to spam for everyone, including your real customers.

Outside the US

The law points the same way outside the US. The EU's ePrivacy Directive (Article 13) allows email marketing to individuals only with their prior consent, with a narrow exception for a company's own customers.

Canada's anti-spam law (CASL, section 6) prohibits sending a commercial electronic message without the recipient's express or implied consent. A list bought from a stranger rarely carries consent that covers you.

Postal lists

For postal lists, MPA, a print-and-mail firm, says purchased records cost two to four times more per record than rentals, and suggests renting if you will mail an audience one to three times a year. For email, renting the list instead keeps the addresses with the owner, so complaints and unsubscribes are handled by someone the recipients already know.

What the numbers mean for a bought file

Put those numbers next to a cold, bought file. A 0.3% ceiling means three complaints for every thousand messages delivered. Mail sent to people who never signed up is the most common way senders break it.

In the US, CAN-SPAM does not require opt-in consent, which is why buying lists is still common there. It does set rules for every commercial message, and the FTC says each email in breach can bring a penalty of up to $53,088.

The checklist

• Accurate header information: From, To, Reply-To and routing must identify you.
• A subject line that matches the content.
• A clear statement that the message is an advertisement.
• A valid physical postal address.
• A working opt-out that keeps working for at least 30 days after the send.
• Opt-outs honoured within 10 business days, with no fee and no more than an email address asked for.
• No selling or transferring addresses of people who opted out.
• Oversight of anyone who sends for you: the FTC says both the company promoted and the sender may be held liable.
• No harvested or dictionary-generated addresses; the FTC lists these among aggravated violations.

1. Where did each address come from, and on what date was it collected?
2. What exactly did the person agree to? Ask for the consent wording and whether it named third-party offers.
3. Can you show proof of consent for a sample of records?
4. Do you send the campaign yourselves, or hand over the file?
5. When was the list last verified, and what bounce rate should I expect?
6. Have opted-out and suppressed addresses been removed?
7. How many other buyers have received the same records?
8. Does the file include people in the EU, the UK or Canada?
9. What happens if bounces or complaints exceed an agreed level?
10. Will my email platform accept the file? Campaign Monitor, for example, requires every subscriber to be opted in.

If the vendor can't answer

A vendor who can't answer the first three questions is selling a liability. Ask a list broker who works in your market: they usually know owners who rent their names on clear terms.

Vendors often sell selections: contacts filtered by industry, job title, state or zip code. Narrowing a file does not change where the names came from, so the questions above apply to each selection. Ask how the industry or location field was set, because a wrong label is the quickest way to pay for contacts you can't use.

We don't sell email lists, leads or contact data. DataBroker is a paid course and a set of tools for people who broker company datasets to buyers such as AI labs.

Why this guide is here

This guide is here because buyers of data face the same questions in every market: where did the records come from, what did people agree to, and who is liable when it goes wrong.