Is Buying an Email List Legal? How to Build a Compliant B2B List in the UK, US, France and UAE

Is it illegal to buy an email list?

The texts we read do not ban the purchase. They regulate what you do with the addresses afterwards, and several of them make a bought list a poor foundation. Four tests come up in every country in different words: where the data came from, what lets you email this person, what you must tell them, and whether you stop when they object.

What do the UK rules mean for a bought list?

PECR regulation 22 requires, for individual subscribers, that the recipient has told the sender they consent to such emails being sent by, or at the instigation of, that sender. A list seller who says its contacts have opted in to third-party offers has not obtained consent for you in particular. For corporate subscribers, which regulation 2 defines to include companies and Scottish partnerships, regulation 22 does not require consent, so a list of company directors is a different legal question from a list of sole traders. Our UK cold email guide explains the split.

The harder part is UK GDPR. You are collecting personal data from a third party, so Article 14 applies. You must give the person your identity, your purpose and legal basis, the legitimate interest you rely on, their rights and the source of the data, within a reasonable period and at the latest within one month, or at the first communication if you are using the data to contact them. Article 14 has exceptions, including where giving the information is impossible or involves disproportionate effort. In our view that is hard to argue for a list you are about to email, since you can put the notice in the email itself. You also need a lawful basis under Article 6, usually the legitimate-interests balancing test in 6(1)(f), and you must stop on Article 21 objection.

What about the US and France?

In the US, the FTC's guide does not address buying lists, and CAN-SPAM does not require prior permission. What it does say is that once someone opts out, you cannot sell or transfer their address, except to a company you hired to help you comply, and that you stay responsible for email sent on your behalf. Section 7704(b)(1) also treats sending to addresses harvested from websites that prohibit it, or generated by combining names and letters, as an aggravated violation. A seller that built its list that way hands you the liability.

In France, the CNIL says B2B email prospecting does not need prior consent in general, as long as the message relates to the person's profession and they can object simply and free of charge. Its page adds a point that applies directly to bought data: if the company bought the data from a third party, it must make sure the person was told their address might be used for prospecting and that they can object. Other EU countries have their own rules, which we have not verified.

What is the position in the UAE?

Unsettled, and on our reading the strictest of the four. The English text of Federal Decree-Law 45/2021 (the PDPL) says in Article 4 that processing personal data without the data subject's consent is prohibited, with listed exceptions. The English text we read lists exceptions such as public interest, legal claims, contract performance and data the person made public themselves (Article 4(2)), and none of them is a general legitimate-interests ground like UK GDPR Article 6(1)(f). Item 11 of that list refers to other cases set by executive regulations, which we have not reviewed. Article 6 requires the controller to be able to prove consent. Article 17 lets a person object to and stop processing for direct marketing.

Three further points. Article 2(2)(g) excludes companies in free zones that are subject to their own data-protection legislation, so ADGM and DIFC entities follow their own regimes, not the federal PDPL. TDRA's Unsolicited Electronic Communications policy (version 1.0, 2009, the version we read) defines spam as marketing electronic communications sent without the recipient's consent, defines address harvesting, and states that consent follows an opt-in procedure unless an annex says otherwise, but it is addressed to telecoms licensees. And the UAE Government's data protection page describes the same general consent rule. We found no UAE text that expressly says whether a purchased business email list may be used for cold email. Whether a work email address that someone published counts as data made public under Article 4(2) is a question for counsel, not for us.

Which list sources carry the least risk?

How do you build a B2B list you can defend?

1. Define who you may email. Write the target as a role in a type of company, and keep a record of why that role would reasonably expect your message.
2. Record the source for every address. Source, date and who collected it. If you cannot answer "where did you get my email" in one line, do not send.
3. Sort by recipient type. In the UK, separate sole traders and England, Wales and Northern Ireland partnerships from companies before the first email. In the UAE, separate free-zone entities, which follow their own regimes.
4. Put the notice in the first email. Your identity, why you are writing, how you found them and a link to a privacy notice.
5. Check suppressions at import and at send. See how in our guide to suppression lists.
6. Use only the fields you need. Name, role, company and work address are enough for most B2B outreach.
7. Send within the sending rules. US senders also need the CAN-SPAM basics: the eight rules.

We are building cold email into MAJ Leads now, so this is the list-building standard we are building to, not a report on live sending. Where the product stands today is on how it works, and plans are on pricing.