Is Buying Email Lists Legal? CAN-SPAM, GDPR & CASL

The short answer: yes, buying and using B2B email lists is legal in most jurisdictions. The longer answer requires understanding which regulatory framework applies to your specific recipients.

United States: CAN-SPAM Act

CAN-SPAM requires no prior consent for B2B email. Every message must include a valid physical address, honest subject line, and functional unsubscribe link honoured within 10 business days. California's CCPA adds data handling obligations but does not prohibit cold email outreach.

European Union: GDPR

GDPR permits B2B cold email to business addresses under legitimate interest (Article 6(1)(f)). Include a clear unsubscribe link and honour opt-outs within 30 days. Sending to personal email addresses (Gmail, Yahoo) requires explicit consent.

Canada: CASL

CASL requires express or implied consent. Implied consent exists for 24 months after a commercial transaction. If a contact published their email in a business context, one professionally relevant outreach is generally permissible.

Best Practices Universally

Target business email addresses only. Include company name and physical address in every email. Make unsubscribe prominent and functional. Honour all opt-outs immediately. Keep messaging relevant to the recipient's professional role.

Australia: Spam Act 2003

Australia's Spam Act 2003 requires consent for commercial electronic messages to Australian recipients. Inferred consent applies when the email address is conspicuously published and the message is relevant to the role associated with the address. B2B cold email to business addresses on published company websites generally qualifies as inferred consent under the Spam Act.

Singapore and APAC Considerations

Singapore's Personal Data Protection Act (PDPA) governs commercial email. B2B cold email to business contacts is generally permitted under legitimate purposes, but recipients must be given a clear unsubscribe option and the sender must identify themselves clearly. Many APAC countries follow similar frameworks — target business addresses and provide easy opt-out.

Building a Compliance Process

For any campaign using purchased B2B data: document your legitimate interest assessment before sending, include your company name and physical address in every email, implement a real-time unsubscribe link, maintain a suppression list, and keep records of your verification and compliance checks. These steps satisfy CAN-SPAM, GDPR legitimate interest, and most other frameworks simultaneously.

Common Myths Debunked

Myth: 'You can't buy email lists for GDPR countries.' False — GDPR permits B2B cold email under legitimate interest with proper documentation. Myth: 'All cold email is spam.' False — spam is unsolicited bulk email sent without relevance or unsubscribe options. Relevant, targeted, compliant B2B outreach is not spam legally or technically. Myth: 'You need explicit consent for B2B email.' False under CAN-SPAM and GDPR legitimate interest — consent is required for consumer email and EU direct marketing to individuals.

CAN-SPAM in Detail: What It Actually Requires

The CAN-SPAM Act of 2003 is the US federal law governing commercial email. It is an opt-out law — prior consent is not required before sending commercial email to any address, business or consumer. What it requires: (1) A valid physical postal address (PO boxes do not count — this must be a real business address). (2) Honest, non-deceptive subject lines that accurately reflect the content of the email. (3) Clear identification of the email as a commercial message (though this does not require a specific label — it is assessed holistically). (4) A functioning opt-out mechanism that works for at least 30 days after the email is sent and must be honoured within 10 business days. (5) No false or misleading header information — the 'From' field and routing information must be accurate.

Violations carry penalties up to $51,744 per email in violation. The FTC is the primary enforcement body. Enforcement focuses on systematic violators sending high volumes of deceptive commercial email — not on individual companies running targeted B2B outreach campaigns with accurate sender information and working opt-out links. The FTC has never pursued enforcement action against a company for sending genuinely targeted, professionally written cold email with accurate sender identification and a working opt-out.

GDPR and the Legitimate Interest Basis

GDPR does not prohibit B2B cold email in the EU. What it requires is a lawful basis for processing the personal data involved — and for B2B cold email, that basis is Legitimate Interest (Article 6.1f) in most cases. To rely on legitimate interest, three tests must be satisfied: (1) Purpose test — you have a genuine legitimate purpose (commercial prospecting is explicitly recognised). (2) Necessity test — the processing is necessary to achieve that purpose (there's no way to reach a business prospect without using their contact information). (3) Balancing test — your legitimate interest is not outweighed by the data subject's rights and interests.

The balancing test is where most analysis is required. For B2B cold email to a corporate email address at a registered business, the balancing test generally favours the sender when: the email is relevant to the recipient's professional role (not just their employer's industry), the sender's identity is clearly disclosed, and opt-out is simple and promptly honoured. The EDPB and most national DPAs have confirmed this analysis. A German manufacturing executive receiving an email about industrial software, from an identifiable company, with a simple opt-out link, is not having their rights materially overridden by that communication.

Germany is the exception — UWG §7 applies on top of GDPR and German courts have set a higher threshold. Italy also applies stricter standards. Outside these jurisdictions, legitimate interest is well-established as the correct basis for targeted B2B cold email in the EU.

CASL: Canada's Stricter Framework

CASL (Canada's Anti-Spam Legislation) is the world's strictest major email marketing law. Unlike CAN-SPAM's opt-out model, CASL requires opt-in consent — either express or implied — before sending any Commercial Electronic Message (CEM). The practical implications are significant for companies purchasing Canadian B2B data.

Implied consent exists in four circumstances: (1) An existing business relationship — the recipient has purchased from you or made an enquiry in the past 24 months. (2) A published business email — the recipient's email is conspicuously published in connection with a business role without a statement prohibiting commercial messages. (3) A referral from someone with a business relationship with both parties. (4) The recipient has given express consent at any point that has not expired.

The 'conspicuously published' standard for implied consent is key for cold outreach to Canadian contacts. If a company lists an email address on their company website, in a trade directory, or on LinkedIn in connection with a professional role, without a "no commercial email" notice, that constitutes implied consent under CASL for a CEM relevant to that professional role. This is why purchased Canadian B2B lists built from public business directories generally qualify — the contacts have published their addresses in a business context.

CASL penalties reach C$10 million per day per violation — significantly higher than CAN-SPAM. Enforcement has focused on bulk spammers and companies that ignore opt-out requests. The CRTC has pursued enforcement actions against Canadian domestic companies primarily; its jurisdictional reach over foreign companies remains legally complex.

What 'Purchasing' an Email List Actually Means Legally

The phrase 'buying an email list' conjures images of grey-market data sold on USB drives — lists harvested through dubious means and sold repeatedly to anyone. That image describes one end of the spectrum. The other end is purchasing a database compiled from public business registries, opt-in data partnerships, and professional directory listings — with documented data provenance, quarterly re-verification, and compliance documentation. Legally, the provenance and collection methodology of the list determine whether using it constitutes a legal risk or a normal business practice.

When evaluating a list provider's legal risk, the relevant questions are: (1) How was the data collected? Public business registries and conspicuously published professional profiles are legally lower-risk than scraped or traded consumer data. (2) Has the data been collected under a privacy policy that permits B2B use? (3) Is the data regularly verified and updated? (4) Does the provider have GDPR or equivalent data processing agreements available? (5) Is the data specific to business contacts at corporate email addresses, not personal email addresses of private individuals?

A database of corporate email addresses sourced from company websites, Companies House, SEC filings, and similar public business registries is fundamentally different legally from a list of personal email addresses harvested without notice. The former is the standard model for reputable B2B data providers including LeadsBlue, Apollo, ZoomInfo, and others; the latter is what regulators and legislators actually target.

Practical Compliance Checklist

The following practices keep B2B cold email campaigns compliant under CAN-SPAM, GDPR (legitimate interest basis), and CASL (implied consent), which collectively cover the majority of the world's B2B outreach opportunities.

Data handling: Use only B2B data from documented sources (public registries, company websites, professional directories). Do not purchase lists compiled from scraped personal data, consumer databases, or undocumented sources. Maintain a record of where your contact data originated. If using GDPR-covered data, maintain a simple Legitimate Interest Assessment document.

Email setup: Accurate sender name and email address (no spoofing). Real business postal address in the email footer. A functional, single-click opt-out mechanism. Honour opt-outs within 10 business days (CAN-SPAM) or immediately (best practice). Add opted-out addresses to a suppression list that persists across all campaigns.

Content: Subject lines that accurately describe the email content. Commercial purpose that is apparent (no disguising marketing as a personal message). Content relevant to the recipient's professional role. No false or misleading claims about product or service.

Targeting: Send to corporate email addresses at registered businesses, not personal email addresses of private individuals. For EU contacts, ensure the email is genuinely relevant to the recipient's professional function at their employer. For German contacts specifically, add extra rigour to the relevance assessment given UWG §7.

The Risk in Context

Regulatory action against companies for targeted B2B cold email campaigns is rare in every jurisdiction covered in this guide. The documented enforcement actions that generate headlines — the €746M fine against Amazon, the €1.2B against Meta — involve systematic, large-scale personal data processing violations at companies with hundreds of millions of users, not cold email campaigns to business contacts. The enforcement bodies (FTC, CNIL, ICO, CRTC) have neither the capacity nor the political mandate to pursue companies for sending a thoughtful, targeted cold email sequence to 3,000 contacts in their target market.

The realistic risk profile for a well-run B2B cold email campaign is: a recipient who did not want your email reports it to their email provider's spam filter (1-2 per 1,000 sends in a well-targeted campaign), a small number of contacts express discomfort and opt out (which you honour immediately), and one or two contacts per year may email to ask where you obtained their data (which you can answer accurately because you sourced it from public business registries). None of these escalate to regulatory action when you're sending a legitimate commercial offer to business contacts with honest identification and a working opt-out.

The actual risk events that trigger regulatory action are: continuing to send to contacts who have opted out (document and honour all opt-outs), using deceptive sender identification (use your real company name and domain), sending content that is misleading or fraudulent (be accurate in what you offer), and buying and using personal data from clearly non-compliant sources (know your data provider's collection methodology).