Buy Email List? What It Costs, What's Legal, and What to Build Instead

TL;DR

Buy a list only when you need a file this week and the seller can show where each record came from. For cold outbound to a defined buyer, build the list from your own search instead. BookYourData sells 1,000 contacts for $299, while 1,000 verified work emails built from a Sales Navigator search cost about $18.20 in credits at WizLeads' entry plan, plus the Sales Navigator seat.

You can buy an email list, and BookYourData's pricing page sells 1,000 contacts for $299 and 100,000 for $5,499. What no seller can hand you is consent. Where UK, EU or Canadian law requires it, it has to be consent to you, and a purchased file does not supply it.

You are about to pay for a file of strangers' addresses, so three questions matter. What does it cost, what does the law let you do with it, and what happens when you hit send?

Below we cover one vendor's real price ladder, what its guarantee covers, what four regulators say, why files fail on send, and what to build instead.

What does it cost to buy an email list?

At BookYourData, one credit buys one contact, and the price per contact falls as the pack grows. A 1,000-contact pack costs $299 and a 100,000-contact pack costs $5,499, which is $54.99 per 1,000. The smallest pack, 250 contacts for $99, costs $396.00 per 1,000, about a third more than the 1,000 pack.

These are list prices in US dollars from BookYourData's pricing page, and the page says credits do not expire. The per-1,000 column is our arithmetic. These are unit costs, not bills.

Credit-pack records come from BookYourData's database of 500M+ profiles. BookYourData also sells a private build it calls BeSpoke: from $499 for 1,000 records, delivered within three business days, with a public source link on every row and the promise "Yours alone, never resold." That is about 1.7 times the $299 pack, and it shows what sourcing and exclusivity cost when a seller offers them.

LeadsPlease, Melissa and Salesgenie also sell business lists, on per-record or subscription terms. Read each seller's own page before you compare, and compare on one basis: dollars per 1,000 records you can actually send to.

The pack price buys the file. It does not buy a lawful basis to email each person, a source you can name, or protection against the weeks between the seller's export and your first send.

What do the guarantees cover?

A list guarantee covers less than its headline. BookYourData promises 97% deliverability, and its two pages describe the remedy differently. The pricing page's FAQ says that for a wrong or outdated record it refunds "the credits spent on that contact." Its guarantees page sets a list-level test instead: if deliverability comes in below 97%, you send the report showing the list's hard-bounce rate and it adds free data credits until 97% is met. Either way it is a deliverability promise, not an accuracy one.

An address can accept mail and still belong to someone who left the company, and under the list-level test a 1,000-contact pack can carry 30 hard bounces before anything comes back. Both pages pay the remedy in data credits.

The record can be a work address or a personal one. The page describes the email as "Direct work or personal email" and notes that not every record carries every field. The UK section below shows why that matters: a personal address is an individual's, and individuals need consent. The ICO's own example is a conference delegate who gave a personal address instead of a work one, and it says an organiser emailing that address without consent would breach PECR.

BookYourData also says every export gets real-time verification, which is the vendor's claim, and verification does not tell you who consented to what.

Guarantees differ in scope. Salesgenie's satisfaction-guarantee page says "Lists purchased for fax and email are not covered." Before you pay any seller, ask four things:

• Which list types or channels does the guarantee exclude, and is email one of them?
• Does it promise deliverability or accuracy?
• Is the remedy cash, credits or a replacement?
• How long do you have to file a claim, and what counts as one?

Is it legal to buy an email list?

The short answer differs by country. US law sets rules for each message and does not ask for prior consent. UK law lets you email companies, and sole traders only with their consent or under the soft opt-in for existing customers. EU rules for individuals and Canadian rules ask for consent that a bought file does not supply on its own. This is information, not legal advice, and the pages below are each regulator's own guidance.

United States: the law governs what you send. The FTC's CAN-SPAM compliance guide says: "The law makes no exception for business-to-business email." Its rules apply to each message, including an opt-out you must honour within 10 business days, and prior consent is not among them. Each email in violation can draw penalties of up to $53,088, and once someone opts out you cannot sell or transfer their address, even inside a mailing list. Harvesting addresses and dictionary attacks sit on the guide's list of aggravated violations with criminal penalties, so the way a seller collected a file matters to you.

United Kingdom: companies yes, sole traders no. The ICO's business-to-business marketing guidance says PECR's email rule does not apply to corporate subscribers: companies, LLPs, Scottish partnerships and some government bodies. Sole traders and other partnerships count as individuals, who need specific consent or the soft opt-in. If you cannot tell which a contact is, the ICO says to treat it as an individual's, and it gives a personal email address as an example of one. The ICO marks this guidance as under review after the Data (Use and Access) Act.

For a bought list, the ICO's page on using marketing lists says everyone on it must have consented to that type of message from you. "Generic consent covering any third party will not be enough." Read with the B2B page, that consent rule covers the individual subscribers above, not corporate ones. UK GDPR still applies to named business contacts, with privacy information due within one month of getting their data from a third party.

European Union: consent for individuals, notice for everyone. The EDPB's guidelines on legitimate interest say email marketing to individuals cannot rest on legitimate interest where the ePrivacy rules require consent, and that national rules may go further for professionals. GDPR also requires a privacy notice that includes where the data came from. A seller's list rarely supplies either.

Canada: a sold list is not consent. The CRTC's CASL FAQ says that when a third party sells a list of addresses, this "would not create implied consent on its own." It adds that an address you can find only through specific queries in a corporate database is not conspicuously published. CASL asks for consent, identification and an unsubscribe in every message, and, if you rely on an address having been conspicuously published, the records it says to keep include where you found each address and when. It lists maximum penalties of $1 million per violation for an individual and $10 million for a business, and notes that the page is staff information, not legal advice and not binding on the Commission.

California: check whether the CCPA covers you. California's Attorney General says the exemption for business-to-business personal information expired on 31 December 2022. For a covered business, work contacts of California residents can therefore be in scope. The Delete Act adds duties for data brokers, so a file you bought earlier does not receive deletions the seller processes later.

The rules differ by country, and in the UK, the EU and Canada one question decides a lot: where did this address come from? A seller who cannot answer it for each record has not sold you a file you can safely send to.

Why bought lists fail once you send

Platforms and mailbox providers push back before any regulator does.

Mailchimp's acceptable use policy bars sending to purchased, rented, third-party or publicly available data lists of any kind. HubSpot's anti-spam policy bars contacting purchased, rented, borrowed or third-party lists, email-append and enrichment-service lists included, where doing so breaks the law or another party's terms. Its consent rules ask that every recipient gave express, verifiable consent. Neither clause stops at bought files, so a list you build meets the same terms on those two platforms. Google's sender guidance says not to buy addresses from other companies, though that page is about personal Gmail accounts, not Google Workspace. Yahoo's says not to purchase mailing lists.

Ask the question on Reddit and the replies say the same. In a thread on where to buy an email list, the answers call sold files scraped addresses and say the people on them will report you for spam. That is opinion, not data, but it matches what Spamhaus and the platforms say.

Spam traps come with the file. Spamhaus says a seeded trap shows that a sender is scraping addresses or buying from someone who does. Trap owners never reveal them, and Spamhaus warns against hunting for them, because removing a trap treats the symptom and leaves the data problem in place.

A bought file is also not reserved for you. A cold-email video makes the point that a purchased list is not taken off the shelf when you buy it, so other buyers mail the same people. The people on it are probably getting cold email all the time, as the video puts it, and yours is one more. BookYourData's own wording points the same way: it sells BeSpoke builds as "Yours alone, never resold," a promise the pricing page makes for BeSpoke and not for the credit packs.

Files also age. People change jobs and companies close, so a file starts going stale on the day it is built. Even a fresh database export needs checking: in our test of 1,000 real-estate decision-maker emails sourced from Apollo, six verifiers each rejected between 112 and 330 of them. Those are rejection counts, which mix catch-all and unknown verdicts with dead addresses, so they show how much of a file a verifier will hold back, not how fast it ages.

No mailbox provider publishes a bounce threshold, so your sending platform sets the limit you will hit first. That is a reason to verify just before you send.

If you buy anyway: a due-diligence checklist

If a ready-made file still wins on speed, run these checks before you pay and again before the first send.

1. Ask where and when each record was collected. The CRTC's record list for conspicuously published addresses starts there, and BeSpoke's public source link on every row is what an answer looks like. A seller that says "proprietary sources" has not answered.
2. Ask whether the seller had consent to sell. The ICO says as a general rule you can sell a list only with the consent of the people on it.
3. Get the guarantee terms in writing. Know whether it covers deliverability or accuracy, whether the remedy is credits or cash, and whether email is covered at all.
4. Split UK contacts by subscriber type. Companies and LLPs sit outside PECR's email consent rule. Sole traders, personal addresses and unknowns count as individuals.
5. Write the first email to carry who you are, how to opt out and where you got the data. The EU needs the source and CASL needs identification and an unsubscribe.
6. Screen the file against your suppression list, and honour opt-outs within 10 business days. The FTC says you cannot sell or transfer an opted-out address, so a seller's file should already exclude them.
7. Check your platform's terms, verify on the day you send, then mail a small segment first. On Mailchimp or HubSpot the answer to the terms question is already no, for a built list as much as a bought one.

Build the list instead

For cold outbound, building means a Sales Navigator search for your ideal customer, a scrape of it, and a pass that finds and verifies work emails, all on the day you send. A cloud scraper that takes your Sales Navigator search URL covers the second step, and WizLeads' email finder covers the third.

Define the ideal customer in Sales Navigator. You need Sales Navigator access to build the search URL. Core is $119.99 a month on LinkedIn's compare-plans page, and what each Sales Navigator plan costs per seat is covered in its own guide. A new account can take LinkedIn's 30-day trial. A people search returns at most 2,500 results, so a larger ICP is split across several searches. WizLeads' Smart Link Splitting does that automatically on the Agency plan and above.

Scrape the search. WizLeads scrapes it for 1 credit per lead with your LinkedIn account connected, or 2 credits per lead account-less. At the rates below, 1,000 verified emails need about 1,667 leads, so one search covers the job. A 5,000-lead task takes 15 to 20 minutes.

Find and verify the work emails. WizLeads finds a work email from a first or full name plus a company website. It charges 3 credits per email found and nothing for a miss. Plan on a 50 to 60% find rate and size on 60%. In a test of how often a finder returned a verified email on the same 1,000 leads, WizLeads returned 670.

Bought rows are BookYourData's list prices from its pricing page. Built rows are per 1,000 verified work emails and use WizLeads' plan prices, 1 or 2 credits per lead scraped and 3 per email found, at a 60% find rate.

These are unit costs for credits only, not bills. They leave out the Sales Navigator seat, the plan minimum and the 2,500-result cap. The records also differ: a BookYourData record may be a personal address, while a WizLeads email is a work email found from a name and company website.

One month with a seat costs $158.99, which is Core at $119.99 plus Freelancer at $39. That pays for the 1,000 emails and leaves about 5,333 credits, roughly 1,143 more. If you already pay for Sales Navigator, the credits are the whole marginal cost, and the 667 leads without a found email stay in your file for LinkedIn outreach. One run on a 10,000-credit balance covers about 2,500 leads connected or 2,000 account-less, because WizLeads holds 3 credits per row until a task finishes, so larger jobs run in batches.

Set side by side, the $299.00 pack costs 16.4 times the $18.20 connected-account figure. Even the 100,000 pack at $54.99 is about 3.0 times $18.20 and 4.8 times Agency's $11.55. The comparison is rough, since the two files are different products, but even the $158.99 month with a new seat is about half the $299 pack.

Buying still wins in three cases. A file arrives today with no search to run, it can reach people who are not on LinkedIn, and at volume the price drops to $54.99 per 1,000. A built list is scoped to your own search, found on the day you send, and comes from a source you can name.

FAQ

How can I find a list of company email addresses?

Three routes. Rent access to a contact database and export from it, buy a ready-made file, or build the list yourself: define your ideal customer in Sales Navigator, scrape the search, then find and verify the work emails. Building costs about $18.20 per 1,000 verified work emails in credits at WizLeads' entry plan, plus the Sales Navigator seat, and it only reaches people on LinkedIn. Whichever route you pick, ask where each address came from, because UK, EU and Canadian rules turn on that.

Buy or build: how to decide

Buy only if you need a file this week, the seller shows a source for each record, and you will email US companies or UK corporate subscribers. If the list is for cold outbound to a defined buyer in those markets, build it from your own search and verify on the day you send. For the EU, Canada or UK sole traders, building does not settle the consent question either: where those rules ask for consent, it has to be consent to you, and neither a bought file nor your own search supplies it on its own.