You can email a purchased list in the United States. CAN-SPAM doesn't require recipients to opt in first. What stops most people isn't the law. It's the platforms and the mailbox providers: Mailchimp and its peers ban the upload, and Gmail, Yahoo and Outlook punish mail that people mark as spam.
This guide covers what the law requires, what the big mailbox providers enforce now, and the setup that keeps a purchased list from burning your domain.
Is it legal to email a purchased list?
In the US, yes. The FTC's CAN-SPAM guidance doesn't require prior consent for commercial email. It does require that you:
- Use accurate “From,” “To” and routing information, and a subject line that reflects the message.
- Identify the message as an ad.
- Include a valid physical postal address.
- Give a clear way to opt out, keep it working for at least 30 days after you send, and honor requests within 10 business days.
Penalties run up to $53,088 per email. Hiring a company to send for you doesn't move the liability: both the sender and the business being promoted can be held responsible. And once someone opts out, you can't sell or transfer their address.
Outside the US, the rules are built around consent or another lawful basis. Canada's CASL, the EU's GDPR and ePrivacy rules, and the UK's PECR all work this way, and the treatment of business addresses differs by country. Don't send a purchased list to recipients in those regions without advice from a lawyer. None of this is legal advice.
Why Mailchimp, HubSpot, Constant Contact and Klaviyo say no
Mailchimp's acceptable use policy prohibits purchased, rented and third-party lists, and HubSpot, Constant Contact and Klaviyo all require permission-based contacts too. That's a platform rule, not a legal one. CAN-SPAM doesn't ask for opt-in, but these services built their businesses around it.
There are two reasons the rule is enforced. These platforms pool sending reputation across customers on shared IPs, so one sender's complaints affect everyone. And they judge accounts on complaint rates, which purchased lists push up because the recipients never asked for the mail. The review often happens after you've uploaded the list and built the campaign, which is why accounts get suspended mid-send.
What Gmail, Yahoo and Outlook enforce
Since February 2024, Gmail and Yahoo have required authentication and low complaint rates from anyone sending to their users. Outlook.com added matching requirements for high-volume senders in May 2025. The parts that matter for a purchased list:
- Authentication. Gmail requires SPF or DKIM from every sender. Once you send more than 5,000 messages a day to personal Gmail accounts, it requires SPF, DKIM and DMARC (a policy of
p=noneis enough), and your From domain has to align with your SPF or DKIM domain. Yahoo asks bulk senders for the same three. - One-click unsubscribe. Marketing mail from bulk senders needs RFC 8058
List-Unsubscribeheaders and a visible unsubscribe link in the body. Yahoo expects unsubscribes processed within two days. - Spam rate. Gmail says to stay below 0.10% and never reach 0.30%. Yahoo's ceiling is 0.3%. That's about one spam complaint per 1,000 delivered emails.
- What happens if you miss. Google says unauthenticated mail may be marked as spam or rejected with a 5.7.26 error.
That 0.10% line is what the setup below is built around. Ten complaints in 10,000 sends puts you at the limit, so the work is keeping your mail away from the people most likely to report it: verify the list, target tightly, and ramp slowly.
How to email a purchased list, step by step
1. Find out where the list came from
Ask the vendor how the records were collected and when. If they can't name the source, it's a scrape, and scraped data is the likeliest to be full of spam traps and dead addresses. MailClickConvert won't send data it can't source, and you shouldn't either.
2. Send from domains that aren't your main domain
Register separate domains for outreach, set up SPF, DKIM and DMARC on each, and let them sit unused for about 30 days before the first campaign. Across the accounts we've run, that aging period is the best predictor of whether a program works. If a purchased list damages a sending domain, you retire that domain. Your company's primary domain, the one your invoices, replies and customers depend on, stays clean.
3. Verify every address before the first send
Run the whole list through verification: syntax, DNS and MX records, SMTP checks, disposable domains, role addresses like info@ and sales@, and known spam traps. Remove what fails and keep it suppressed. Bounces damage a new sender's reputation quickly, and a purchased list is where most of them come from.
MailClickConvert checks every address against a database of more than 100 million spam traps, hard bounces and complainers, built from 20 billion delivered emails. If you want to see what's in your file before you spend anything sending to it, send us 10,000 records and we'll verify them free.
4. Warm up and ramp over four to six weeks
Don't send the whole list on day one. Start with the segment most likely to care and a small daily volume, then raise it in steps while bounces and complaints stay inside your limits. The rule that works: don't increase volume until the last step ran clean. Four to six weeks is typical for a large list. How warmup works here.
5. Write one email to one person
Plain text, short, no heavy template. Say who you are, why you picked them (their role, their company, something specific to them), and ask for one thing. If there's a natural way to say where you found their details, say it. “Who is this?” is the most common reason cold recipients complain.
6. Build compliance in from the start
Every message needs your physical address, a visible unsubscribe link, and a List-Unsubscribe header that supports one-click. Suppress opt-outs across every campaign automatically. The law gives you ten business days and Yahoo expects two, so manual handling is a risk you don't need.
7. Set stop rules before you launch
Agree the numbers that pause a campaign before you send anything: hard bounces above 2% and complaints approaching 0.10% are common lines. Check your sending domain in Google Postmaster Tools, which shows the spam rate for mail delivered to Gmail. Look at results by mailbox provider. If Gmail is healthy and Outlook isn't, you have one thing to fix instead of a vague problem.
What to look for in a platform
A purchased list needs a platform whose terms accept it. Past that, check for:
- Dedicated IPs rather than a shared pool, so other customers' sending can't affect your reputation.
- Verification built in, not a separate tool you have to remember to run.
- Throttling and ramp controls, so you set the pace instead of the platform.
List-Unsubscribeheaders, suppression and complaint processing on by default.- Inbox placement testing, so you see where mail lands before a full send.
MailClickConvert was built for this. Plans start at $249 a month and include dedicated IPs (2 to 100+), verification credits, free sending domains and warmup, with sending from 100,000 up to 200 million emails a month. A deliverability team diagnoses problems when placement moves. If you also need the data, we can supply a targeted list. To weigh other options honestly, see how we compare.
Questions people ask about emailing purchased lists
Can you use Mailchimp with a purchased list?
No. Mailchimp's acceptable use policy bans purchased, rented and third-party lists, and breaking it can get your account suspended. Use a platform whose terms accept purchased data, ideally one with dedicated IPs so other customers' sending can't affect your reputation.
Can you get fined for emailing a purchased list?
Not for using a purchased list as such. CAN-SPAM penalties, up to $53,088 per email, apply to messages that break its rules: no physical address, no working opt-out, misleading headers or subject lines. Follow those and CAN-SPAM isn't your problem. The more common risk is deliverability, which is why the setup above matters more than the law.
How many emails can you send to a purchased list per day?
There's no fixed number. Your ceiling depends on domain age, reputation and how each mailbox provider responds, so start small and ramp over four to six weeks. Mailbox-based outreach tools safely send roughly 30 to 50 emails per mailbox per day, which is why large lists need dedicated IPs instead.
Should you verify a purchased list before sending?
Yes, every time. Purchased lists are where most bounces, spam traps and stale addresses come from, and verification is the cheapest way to find them before they hit your sender reputation.
Do purchased lists actually work?
They can, and targeting decides it more than size. A smaller list cut to a specific role, industry and region, with a specific offer, outperforms a large generic one. A broad list with a generic pitch is what drives complaints.