TL;DR: Buying email list records can work for an agency, but only after a due-diligence test on the law, your email tool and your sending domain. The law sets the minimum, the tool sets the rules, and spam complaints decide whether the list damages your domain. Run a small sample test with a written stop rule before you send to the full file.
Legal to buy is not the same as safe to send, and most bought lists fail the send test before they fail the law.
All five top pages I read name legal exposure as a risk, and four of five put data verification first. Only one of them gives a stop number. That gap is where this guide starts.
Is it legal to cold email a file you paid for?
In the US, the CAN-SPAM Act does not require opt-in consent for B2B email, but it does require a working opt-out. The FTC says you must honor an opt-out within 10 business days. In the UK, the ICO says unsolicited marketing to corporate subscribers needs no consent, while individual subscribers still do.
Legal to buy depends less on the list than on how you send to it.
Many buyers assume that paying for a file grants the right to email it. I call that The Paid-For Fallacy. The FTC's compliance guide says otherwise: "You must honor a recipient’s opt-out request within 10 business days." (FTC) The same guide says you cannot sell or transfer the address of someone who opted out, even inside a list.
Picture a three-person agency that buys 2,000 contacts, sends one cold email, and gets a reply that says "remove me." The 10-day clock starts at that reply, not when the file arrived. Who actually opted in here? Nobody on that list did, so the reply is the only consent the agency will ever get.
The ICO rule covers corporate subscribers, not every named person in a file. I did not check the EU or UK data-protection rules that apply to named individuals, so a lawyer should review those before you send to them. (ICO)
What does a bought list do to your sending domain?
A bought list can hurt your sending domain through spam complaints and spam traps. Gmail's bulk-sender rules start at 5,000 messages a day, and they expect a spam rate below 0.3% (Google). Spamhaus says purchased lists can lead to blocklisting. Sender reputation attaches to the domain, so one bad file can reach your regular mail.
A bad list hurts your main domain before you notice the damage.
Spamhaus is blunt about the reason: "Permission is not transferrable." (Spamhaus) A person who never opted in to your emails cannot be turned into a consenting reader by buying their address.
Spam traps are the part you cannot see in the file. They are addresses that never opted in to anything, and blocklists and mailbox providers use them to catch senders. Spamhaus describes seeded traps as a sign that a sender is scraping addresses or buying lists from someone who scrapes. What would you do if a reply said stop, and the file had already hit a trap? You would be the one explaining it to your client.
Will your email tool accept a file you paid for?
Most major email tools forbid purchased lists. Mailchimp's terms say you won't use purchased, rented, or third-party lists. HubSpot's Trust & Safety page says not to email them. Klaviyo's acceptable-use policy prohibits sending to purchased or rented lists too. Breaking the rule can cost you the account, not just one campaign.
Your email tool's rules can shut you out before the list does any damage.
Mailchimp's terms are the clearest case: "You won’t use purchased, rented, or third-party lists of email addresses." (Mailchimp) HubSpot quarantines contacts that cause high bounces or complaints, so a bad import can quietly drop the people you meant to reach. (HubSpot)
A file without permission is like a used car with no service history: the price tells you nothing about what is under the hood. I learned to read the source line before the spam line. Uploading a file is not the same as permission to send to it, and a tool that accepts the upload has not approved the list.
How much of the file will still be valid?
Contact data goes stale when people change jobs, and one job change breaks several fields at once. The 2.1% monthly and 22.5% yearly figures you will see everywhere are hard to trace. A US Census-based measure found that 24.8% of stable jobs held by bachelor's-degree workers ended within 12 months in 2024. For all workers the figure was 30.5% (Forage).
Most decay numbers online cannot be traced, so test the file instead of trusting the stat.
One 2026 analysis put it bluntly: "Trace them back and the trail goes cold." (Forage) Its measured figures came from Census job-to-job records, which track employers, not every title or phone change.
The practical lesson is that a job change breaks the title, the work email and the direct dial together. A file bought in January is already older by the time you send in March, so the test has to run on the file you are about to use.
How do you test a file before committing to all of it?
Ask for a sample, verify it with your own tool, and send only to a small, high-fit segment. Set the stop rule before the first send. Mailchimp's guidance says a campaign bounce rate above 2% means you should look at the list and how it was collected (Mailchimp). Google's rule for bulk senders is a spam complaint rate below 0.3%.
A verification badge does not protect your sending domain; complaints and spam traps do, and you only see them after you send.
Spamhaus is direct about the hygiene pitch: "One of the most misleading claims by data hygiene companies I’ve witnessed is their ability to remove spam traps." (Spamhaus) A single mailbox check also cannot settle everything. On a catch-all domain, every address returns the same answer, so one probe cannot confirm a mailbox (EmailVerify).
I call the file that looks clean on the sample but fails on the send The Clean-File Trap. Testing a file is like tasting soup from one spoon before you serve the pot. Would you send all 2,000 contacts on day one? No. Here is a test you can run this week:
- Ask the vendor for a sample small enough to review by hand, and verify it with a tool you already trust.
- Send only to the highest-fit segment, from a subdomain, not your main domain.
- Write the stop rule before sending: pause if the hard bounce rate goes above 2%, or if complaints head toward 0.3%.
- Ramp slowly. One vendor suggests starting at 20 to 50 emails a day and roughly doubling each week, and that is advice, not a rule (ZoomInfo).
Put a number on the test before you scale it. Calculate what each booked meeting costs so a cheap file does not hide an expensive result. A small test cannot find every trap, and a few sends give noisy numbers. Treat the test as a filter, not as proof that the file is clean.
When is a paid contact file worth it for an agency?
A file can fit when you need to test one segment or enter a market you cannot reach yet. It does not fit a newsletter, and it rarely fits a general "send to everyone" plan. The cleaner cases are trade-association rosters where members agreed to third-party contact, and small, personalized cold outreach from a dedicated subdomain.
Buy a file to test one segment, not to fill a newsletter.
The ZoomInfo guide suggests a test to 500 contacts before a bigger spend, then judging the results (ZoomInfo). Crazy Egg reaches a similar conclusion for marketing: buying is generally off, while personalized outreach is the one use that sometimes holds up (Crazy Egg).
If your buyer is a local business, the task is finding the business and the contact page it already publishes. LeadsAgent searches live Google Maps data, then reads each business website's contact, about and team pages for published emails. It also checks each address's domain setup before you see it. It does not yet confirm that a mailbox exists, so review the list before you send.
Before you pay for anything, be clear about the buyer. A practical ideal customer profile decides which file is worth testing, and no file can fix a vague target.
What should an agency do instead of paying for contacts?
Build your own contact list from people who opt in, and find published business contacts for outreach you can defend. A smaller list you collected yourself usually beats a larger one you bought. Mailchimp argues that organic lists bring better engagement and fewer complaints, and Crazy Egg reports that purchased lists underperform on opens, clicks and conversions.
A smaller list you collected yourself beats a larger one you bought.
Mailchimp puts it this way: "Organic email lists lead to better engagement, fewer spam reports, and long-term growth." (Mailchimp) Those are claims from a vendor that sells list-building, so test them on your own sends.
Opt-in methods are the ones I would start with: gated content, a newsletter signup from your blog, webinars, referrals, and events where attendees agree to follow-up. They take longer. A sustainable agency pipeline covers how to fill that time without guessing.
For outreach to local businesses, the workflow I would use is find, check, review, send. LeadsAgent handles the find and check steps, and you still review the file before anything goes out. Start with LeadsAgent here and run the workflow on your own target.
FAQ
Is buying an email list illegal?
Buying a B2B list is not illegal in the US by itself, according to Mailchimp's guidance. The CAN-SPAM opt-out duties still apply to every email you send, and the ICO's rule for UK corporate subscribers is a separate test.
Can I use a bought list in Mailchimp or HubSpot?
No. Mailchimp's terms prohibit purchased, rented or third-party lists, and HubSpot's Trust & Safety page says not to email them.
What bounce rate is too high?
Mailchimp's guidance puts the line at 2% for a campaign, which means the list needs review (Mailchimp). There is no published ISP bounce limit. Google enforces a spam complaint rate of 0.3%, and that is the number to watch most closely.
What does LeadsAgent cost?
Free forever: 1,000 free leads every month, with emails and lead verification included, and no credit card. Paid plans are $29 a month for 10,000 researched leads, $99 a month for 50,000, and $199 a month for 100,000. Billing is monthly per lead researched (LeadsAgent).
Does LeadsAgent confirm that a mailbox exists?
No. It checks syntax, disposable domains, mail servers, SPF and DMARC. It does not yet run a mailbox-level check, so review the list before you send.
Start with the test, not the purchase. Try LeadsAgent free and build your list from published business contacts.
