Is It Legal to Buy an Email List?

Short answer

Is it legal to buy email lists in the US?

Yes. Buying an email list is legal in the US, and federal law regulates what you send to it. CAN-SPAM requires no opt-in before commercial email, so messages to a purchased list are lawful under the Act when each one carries accurate headers, an advertisement notice, a postal address and a working opt-out.

The legality of buying an email list turns on 2 questions: how the seller built the list, and how the buyer contacts the people on it. Neither the CAN-SPAM Act nor the FTC's CAN-SPAM Rule at 16 CFR Part 316 prohibits the purchase itself, and the same answer holds for whether buying an attorney email list is legal, because the Act treats email to law firms like email to any other business.

List construction matters on the seller's side. The FTC's compliance guide lists harvesting email addresses and generating them through a dictionary attack among the practices that carry criminal penalties, including imprisonment. Under 15 U.S.C. § 7704(b)(1), a message that already breaks subsection (a) becomes an aggravated violation where the sender knew, or knowledge is fairly implied from the objective circumstances, that the address came from either practice.

The buyer's duties start with the first message. The opt-out rules for emailing purchased contacts apply in full: a clear opt-out notice, a mechanism that keeps working for at least 30 days, and removal within 10 business days of each request.

Consent

Does buying an email list give you consent to email the contacts?

No. Buying an email list transfers data, not consent. CAN-SPAM counts consent only when a recipient expressly agreed and, for a different sender, received clear notice that the address was transferable. The Act needs no consent to send, while email platforms such as Mailchimp demand proof of opt-in.

Under 15 U.S.C. § 7702(1), affirmative consent means the recipient expressly consented to receive the message, either in response to a clear and conspicuous request or at the recipient's own initiative. A message from a party other than the one that collected that consent qualifies only when the recipient received clear and conspicuous notice that the address was transferable for that purpose, so ask the seller for that record before treating any purchased address as opted in.

Platform contracts add a separate layer. Mailchimp's Acceptable Use Policy, effective September 26, 2025, forbids uploading or sending campaigns to purchased, rented, third-party, co-registration, publicly available data or partner lists, and requires evidence of consent for any commercial or marketing email. Breaching a platform policy is a contract matter between the sender and the platform, not a violation of federal law.

State laws

Do state privacy and data broker laws affect email list buyers?

Yes. California's CCPA binds buyers that meet its thresholds, and data broker laws in California, Vermont, Texas and Oregon bind sellers. A covered buyer answers privacy requests from California contacts, while a seller that sells data about people it has no direct relationship with registers as a data broker.

The CCPA reaches a for-profit business doing business in California that meets 1 of 3 tests: annual gross revenue above the statutory threshold, buying, selling or sharing personal information of 100,000 or more California consumers or households, or earning 50% or more of annual revenue from selling or sharing personal information. The California Privacy Protection Agency puts the revenue threshold at $26,625,000 effective January 1, 2025, and adjusts it in every odd-numbered year. According to the California Attorney General, the exemption for personal information reflecting business-to-business transactions expired on December 31, 2022.

California Civil Code § 1798.99.80(c) defines a data broker as a business that knowingly collects and sells to third parties the personal information of a consumer with whom it has no direct relationship, and carves out entities to the extent they are covered by the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, the Insurance Information and Privacy Protection Act or the CCPA's health information exemption. Each data broker registers with the California Privacy Protection Agency on or before January 31 for the prior year, owes a $200 administrative fine for each day it fails to register, and appears in the registry the Agency publishes for download after the registration period ends.

Vermont's definition in 9 V.S.A. § 2430(4)(C) states that providing publicly available information related to a consumer's business or profession, and collecting and selling data incidental to that activity, does not by itself make a business a data broker. The Texas Secretary of State registers data brokers under Business and Commerce Code chapter 510 for a $300 fee, and Oregon's Division of Financial Regulation registers them under ORS 646A.593 for $600.