Is it legal to buy an email list in the UK?#
Two UK sources matter here, both published by the Information Commissioner's Office, and both read from its own guidance pages on the day this article was written. One covers electronic mail marketing and states the rule about sending. The other covers marketing lists and states the checks a bought-in file has to survive.
Neither page opens with a ban on purchasing a file of addresses. The mail page opens with the duty instead: "you must not send electronic mail marketing to individuals, unless: they have specifically consented to electronic mail from you; or they are an existing customer who bought (or negotiated to buy) a similar product or service from you in the past, and you gave them a simple way to opt out both when you first collected their details and in every message you have sent." Read that as a rule about the message, because that is what it is.
So the question most people type has two halves. A purchase can be perfectly lawful and the campaign built on it can still break the rule, because the regulated act is the send. Nobody asks for your invoice when a complaint arrives. They ask which address agreed to hear from you, and when.
What is the rule a bought email list has to pass?#
The ICO page on marketing lists answers it in one sentence, and the sentence is worth reading whole rather than through a summary: "You can only use them if all the people on the list specifically consented to receive that type of message from you." The next sentence closes the workaround: "Generic consent covering any third party will not be enough."
Three conditions are packed inside that. Every person on the file, not most of them. Consent to email specifically, rather than to marketing in general. And consent naming you, rather than consent given to whoever collected the address.
Then the page adds a duty of care no supplier can hand over with the download: "You must make checks to satisfy yourself that any list is accurate and the details were collected fairly, and that the consent is specific and recent enough to cover your marketing."
| Condition on the ICO page | What it rules out | What a list advert tends to say |
|---|---|---|
| "All the people on the list specifically consented" | A file where some signups ticked a box and some were added without one | "50,000 opted-in emails" |
| "...to receive that type of message" | Consent to phone calls, to post, or to a newsletter from the publisher | "marketing consent obtained" |
| "...from you" | Consent given to the list owner, or to a bundle of partners | "shared with trusted brands" |
| "Generic consent covering any third party will not be enough" | One broad tick box that names no business | "third-party consent included" |
| "Accurate and the details were collected fairly" | Scraped addresses and competition entries harvested for another purpose | "sourced from multiple channels" |
| "Recent enough to cover your marketing" | Consents gathered years ago for something else entirely | "data refreshed quarterly" |
Does the soft opt-in rescue a bought list?#
The soft opt-in is the exception people reach for, and it is real. An existing customer who bought, or negotiated to buy, a similar product or service can be mailed about similar things, provided you offered a way out when you first collected their details and in every message since.
The same page shuts the bought-list version in its own words: "The soft opt-in rule means you may be able to email or text your own customers, but it does not apply to prospective customers or new contacts (eg from bought-in lists)." The exception is scoped to your own customers by name.
It removes a second hope too: "It also does not apply to non-commercial promotions (eg charity fundraising or political campaigning)." A nonprofit that inherits a donor file cannot reach for it either, which is why a nonprofit newsletter built on permission starts from the forms rather than the archive.
What checks must I make before mailing a bought list?#
The guidance names four separate jobs, and the standard is that you satisfy yourself. A promise in a supplier's email is not a check.
- Accuracy: are these addresses real, and does each name match the mailbox it sits in?
- Fair collection: were the details taken in a way the person would recognise, or were they scraped, bundled or harvested?
- Specific consent: does the wording each person agreed to name email as the channel and you as the sender?
- Recency: is that consent old enough that the person would be surprised to hear from you now?
Two of the four are usually unknowable from outside, and that is the finding. A buyer cannot inspect the form a stranger ticked in 2021 on a site they have never heard of. Where the answer is a claim rather than a record, the condition in the guidance is not met.
The version where the proof arrives as a click, with an address and a time attached, is what how to build an email list that sends covers.
Does the rule change if I rent a list instead of buying it?#
The guidance conditions your use of a bought-in list. It publishes no lighter rule for a file you license, hire, swap or receive for nothing. The word on the invoice is not part of the test. The test is whether each individual on it agreed to email from you.
Renting also changes nothing inside the mailbox. A receiving provider scores the domain you send from, and that score survives the short campaign you meant to run. What sender reputation is and how it is scored covers how the reading works.
Can I sell my own email list?#
The ICO states it as a general rule: "As a general rule, you can only sell your marketing list if you have the consent of the listed individuals to do so." Then, from the buyer's side of the same transaction: "Other businesses will only be able to use the list for recorded calls, texts or emails if the people on the list have specifically consented to receive that type of message from that company."
Consent to be marketed to is therefore not consent to be handed on. Elsewhere on the same page the guidance asks for specific consent if you intend to pass details to other companies, and for those companies to be named or described at the point of the tick.
The reverse direction has its own practical page: moving an email list to a new tool is about changing where a list lives, which is a different act from changing who is allowed to mail it.
Is there a register of people who do not want marketing email?#
No, and the regulator says so directly: "No. There is no equivalent email or text preference service." The reason it gives is that you may only email individuals if they gave specific consent or were already offered an opt-out, so a central register should not be needed.
For a bought file this closes the most common reassurance. Screening against the Telephone Preference Service is a real duty for live calls, and the ICO lists it for calls. There is no email version of that step, which means a list arrives exactly as dirty as it was collected, with no register available to wash it.
Can I email companies instead of individuals?#
The in-brief box on the mail page is clear: "You can send marketing emails or texts to companies. However, it is good practice to keep a 'do not email or text' list of any companies that object." That is the widest door in this guidance, and it is narrower than it looks.
First, the same guidance tells you to record whether each contact is an individual or a company, because different rules apply, and it states what to do when you cannot tell: "If this is not clear, assume they are an individual." A bought B2B file of firstname@companydomain.com addresses is exactly the case where you cannot tell.
Second, the page treats sole traders and some partnerships as individuals where it discusses fax, which says how narrow the company category is in practice rather than setting a rule about email. The honest position is that a business list is only worth what you can prove about it, and a bought file rarely carries that proof either.
What if the addresses on my list are in the United States?#
US federal law on commercial email is an opt-out regime, which is what people mean when they say the rules there are looser. Our breakdown, sourced to the FTC guide, is the CAN-SPAM checklist for a small business list. It sets out what each message must carry and how fast an opt-out has to be honoured.
Two cautions on that difference. A law that is silent on prior consent is not the same as a law that blesses a purchased file. And the mailbox rules do not follow the statute: Google publishes a spam-rate limit for bulk senders without asking which country the list came from, and a complaint rate has no interest in your legal theory.
What happens inside the mailbox when I mail strangers?#
Before any reader sees your work, a machine decides whether they get the chance. Strangers react in two ways that both cost you. Addresses that no longer exist come back as hard bounces. Addresses that do exist, but never asked, use the report button, which is the only reply a mailbox offers somebody who did not sign up.
Google publishes the second of those as a number: bulk senders must keep a spam rate below 0.3 per cent as reported in its Postmaster Tools. That is a rate measured across your traffic, and a first campaign to a bought file is the standard way a small sender crosses it.
| Signal in the report | What it means | Where the cost lands |
|---|---|---|
| Hard bounces | Addresses that do not exist, or stopped existing | A cleaning job you did not budget for, and a provider that records it |
| Spam complaints | Readers who never asked, replying with the only button available to them | A rate Google publishes a limit for, and a domain that stops reaching inboxes |
| Opens from strangers | Attention measured on people who did not choose you, inflated on Apple devices by image preloading | A number that looks like a result and proves nothing |
| Unsubscribes | The honest reply from somebody who did read the message | A smaller list, which is cheaper than a list that complains |
| Blocklist entries | Operators that list a domain on complaint volume | Days or weeks of failed delivery to the warm addresses you already own |
| Domain reputation | A score built from your worst campaign and carried into every later one | Every future email, including the ones meant for real customers |
How many addresses on a bought list work?#
Nobody publishes it. Sellers do not put a delivery rate on the advert, regulators do not audit lists, and there is no independent measurement of a file assembled from signups across fifty other websites. A percentage quoted at you in a sales call is a pitch rather than a measurement.
What exists is the number after the send. Hard bounces, complaints, and an open rate measured on people who never chose you. That is why what a good open rate is treats the denominator as the interesting half of the figure.
Cleaning is a real job for a list you already hold, and how to clean an email list covers it. Cleaning is not consent. It removes addresses that do not work and cannot add permission to the ones that do.
How do I test a list without risking my domain?#
If a file is already in front of you and the consent question cannot be resolved, the smallest experiment is a technical one. Be precise about what it decides: whether to keep going. It does not make a first send lawful, so treat the legal question separately and before it.
- Send from a domain you do not use for your real audience, because reputation attaches to the domain and outlives the campaign.
- Mail a small slice, a few hundred rather than a few thousand, split by the year the addresses were collected if the file carries that.
- Read hard bounces and complaints on that slice alone, not on the campaign as a whole.
- Treat a click as interest in an offer and never as evidence of consent, and treat a rising unsubscribe as the honest reply from somebody who did read.
- Stop on the evidence rather than on the invoice you already paid.
Two things this protocol will not do. It will not un-list a domain once a blocklist entry lands on it, and it will not answer the regulator's question, which was asked before the test send.
What does consent proof look like in practice?#
The guidance gives the shape: "You should record when and how you got consent, and what type of messages it covers." The in-brief list adds the second half: keep clear records of consent, and keep a do-not-contact list of anybody who objects or opts out.
Three fields make that usable rather than symbolic. The moment. The route, meaning the form or checkout the person submitted. The wording they were shown. A record carrying all three answers a complaint. A spreadsheet with an import date in it answers nothing.
On our side, Campaign Kicker stores one row per import declaration and one row per address that confirms, each with the action, the source, the IP address and the time, and you can export that log as your own evidence. Active addresses with no record of their own are shown to you as a gap rather than buried, because an unrecorded address is one neither of us could defend to a complainant.
Do I need consent to email people who bought from me?#
For individuals the soft opt-in covers this without a fresh tick, on conditions you have to be able to show: the purchase or negotiation was for a similar product or service, you offered a clear way out when you first collected the details, and you offer it in every message since. The mail page adds that you must not disguise or conceal your identity, and must provide a valid contact address so a reader can opt out.
Where this gets missed is the middle. A customer who bought once in 2019, was never offered an opt-out, and now receives a monthly newsletter from a rebranded business has none of the three. What a welcome email should do is the cheapest place to re-establish the relationship with the people still willing to hear from you.
What is the legal way to grow a list quickly?#
The route the same guidance describes is collecting your own list with an opt-in box that names the channel and the purpose, and recording the submit. Speed then becomes a conversion problem rather than a purchasing problem, which is the good news in this whole topic: conversion is something you can improve, and a bought file is not.
| How the address arrived | What you can show a complainant | Speed |
|---|---|---|
| Opt-in box on your own site | The form, the wording shown, and the timestamp of the submit | Slowest, and the only list that holds up |
| Confirmation email after a signup | A click recorded with an address, a time and an IP | Adds days, removes the people who were not there |
| Checkout consent from your own store | The soft opt-in, plus an opt-out offered at collection | Fast, if you already trade with these people |
| A referral from an existing reader | The click that brought the new address in | Fast, and it arrives with interest attached to it |
| A bought file | A supplier claim about a form you have never seen | Fast, and the proof is somebody else's word |
Does buying a list break the rules of the tool I mail with?#
Separately from any law, the platform you send through sets its own terms, and those are the ones that stop an account rather than a campaign. Ours is who may use Campaign Kicker, and who may not, and it is written around permission: mail people who asked. A supplier cannot give you a list that satisfies a platform you have to answer to yourself.
If you want the version of fast growth that survives all three tests, the law, the mailbox and the platform, it is the one built on a form and a confirmation click: double opt-in, explained.
Campaign Kicker records consent as a row with the action, the source, the IP address and the time, keeps active addresses with no record visible as a gap rather than a silence, and sends from your own domain on a free plan of 5,000 emails a month. No card, and nothing to explain to a complainant later.
Start a list that came from your own form