Buying an email list — what EU law allows and what email tools forbid
You practically cannot send marketing to a bought list of consumers: consent has to be given in advance, and according to the European Data Protection Board it has to name the company relying on it. For business addresses the rules are national, and some countries allow marketing to generic company addresses without consent. All seven email tools we compare forbid bought lists in their terms or help pages, whatever the law says. Here is the law, the tools’ wording with sources, and what to do instead.
A ready-made email list looks like a shortcut: thousands of addresses at once, filtered by industry and region. The question is whether you may send marketing to them, and the answer depends on two things that are not the same: what the law allows and what the email tool allows. This page is read from EU law, the European Data Protection Board’s guidelines and seven email tools’ own terms.
Short answer
For consumers, in practice, no. The law requires prior consent, and the consent has to name the company relying on it. The consent behind a bought list was given to someone else. For business addresses, some countries allow it: Finland, for example, allows marketing to generic company addresses without consent. But then a second limit applies: all seven email tools we compare forbid bought lists. Sending one through them costs you the account.
What seven email tools say about bought lists
Every tool we compare takes a position, and six of the seven mention bought lists explicitly. Systeme.io does not mention buying as such, but its help page says to import only contacts who have explicitly consented to receive your emails.
| Tool | Wording | Source |
|---|---|---|
| Mailchimp | Prohibited: “Upload or send email Campaigns to purchased, rented, third-party, co-reg, publicly available data, or partner lists of any kind” | Acceptable Use Policy (updated 26 September 2025) |
| MailerLite | No addresses that “You bought, loaned, rented or in any way acquired from a third party, no matter what they claim about quality or permission” | Anti-spam policy |
| Brevo | Lists scraped, acquired or purchased from a third party are “strictly prohibited”, for transactional messages too | Anti-spam policy |
| ActiveCampaign | Prohibited: “Send Marketing Content to recipients on paid or rented lists (of any form)” | Acceptable Use Policy (updated 19 October 2026) |
| GetResponse | Strictly prohibited: “sending messages to any purchased or rented email lists, or any third party lists whatsoever” | Prohibited practices |
| EmailOctopus | No sending to people who did not opt in: “This includes rented, swapped, purchased and scraped lists” | Is my content allowed? |
| Systeme.io | “Only import contacts who have explicitly consented to receive your emails”; keep opt-in proof | Help page on importing contacts |
← scroll →
Terms and help pages read on the providers’ own sites on 23 October 2026.
The table shows that the tools draw the line tighter than the law. Mailchimp also forbids lists compiled from publicly available data and partner lists, and MailerLite says explicitly that the seller’s promises about quality or permission change nothing. Neither distinguishes consumer from business addresses, even where national law does.
What happens if a bought list is imported
Under the tools’ own terms, the account is suspended or closed. Brevo’s terms say a breach may result in the immediate suspension or restriction of the entire account or of certain services. ActiveCampaign’s terms say that after spam complaints the account may be suspended or terminated immediately, with no refund of any kind.
The risk of a bought list is not only contractual. Google’s sender guidelines say it directly: “Don't purchase email addresses from other companies. Don't send messages to people who didn't sign up to get messages from you.” The reason given is that recipients may mark the messages as spam, after which future messages to the same recipients are marked as spam too. The same guidelines require the share of messages marked as spam to stay below 0.3%. What that limit means in practice: why a newsletter goes to spam.
The law: a consumer’s consent does not pass to the buyer
Under Article 13 of the ePrivacy Directive, email for the purposes of direct marketing may be allowed only in respect of subscribers or users who have given their prior consent. The only exception is your own customer: an address obtained from a customer in the context of a sale may be used to market your own similar products, as long as the customer can object free of charge both when the address is collected and in every message. A bought list is neither.
List sellers often answer that the address owners consented to “partners”. The European Data Protection Board has addressed this in its consent guidelines. Paragraph 65 of Guidelines 05/2020 says that if the data is to be transferred to or processed by other controllers who wish to rely on the original consent, “these organisations should all be named”. A general mention of partners is not enough: the buyer’s name would have had to appear when the consent was given.
The GDPR adds one more obligation. Its Article 14 covers personal data not obtained from the person themselves and requires telling them about the processing, including the legal basis and how long the data is kept. The general rules with sources: email marketing and GDPR.
Business addresses: national law decides
Article 13(5) of the ePrivacy Directive applies the consent rule to natural persons and leaves the protection of legal persons to national law. That is why the answer for business addresses differs by country.
- Finland allows marketing to a company’s generic address, such as info@, without prior consent, as long as the recipient can object in every message. A firstname.lastname address, however, is treated by the Finnish data protection ombudsman (page in Finnish) as a natural person’s address as a starting point.
- Norway requires consent for a named work address; a generic address such as post@ does not need it.
- Denmark and Germany apply the rule to every recipient, generic company addresses included.
Every named address on a bought business list therefore has to be assessed on its own. The national provisions and the authorities’ wording: B2B email marketing and double opt-in by country.
What to do instead
A legal list comes from two sources, and both are quicker than they sound.
- Your own customers. Addresses obtained in the context of a sale may be used to market your own similar products without separate consent, provided the customer could object when the address was collected and can object in every message.
- Your own signup form with double opt-in. A subscription collected by form and confirmed by email is consent you can prove afterwards. In MailerLite and ActiveCampaign confirmation is on by default according to their own help pages; in the others you switch it on yourself. How confirmation works and what each country requires: double opt-in.
- An old list of unclear origin. If the list contains addresses whose consent you cannot show, do not import them into a new tool as they are. How to go through the list: email list cleaning.
A list you build yourself fits on free plans at first. Which ones are enough, and for how long: free email marketing.
What we have not checked
This page reports what the law, the European Data Protection Board’s guidelines and the tools’ terms say. We do not know how strictly each tool enforces its terms in practice or how quickly an account is closed: that would be a measurement result, and there is no measurement. Nor do we give legal advice: whether a particular list is lawful depends on how and to whom consent was given. How we compare.