A file of 50,000 addresses costs between €5,000 and €22,500. Six months later, a third of those addresses no longer exist. Most of what’s left lands in spam, because nobody ever asked to receive your messages. So why does this shortcut stay so tempting every quarter, when the growth budget is hunting for a quick win?
Is Buying an Email List Legal?
It depends on who’s on the receiving end. A generic B2B address doesn’t require prior consent. In B2C, GDPR requires explicit consent. A purchased list can never prove it exists.
The CNIL, France’s data protection authority, handed out €486 million in fines in 2025, including €325 million against Google in September alone. The legal ceiling climbs to €20 million or 4% of global revenue, whichever is higher.
In a B2C Context
Consent has to be an opt-in, actively given, never a pre-checked box. The CNIL has treated pre-checked boxes as void for years now.
In a B2B Context
A generic address can be contacted without prior agreement, under legitimate interest. A named address requires a direct link to the recipient’s role and their company’s activity, plus a clear opt-out on every send.
The Listed Price Isn’t the Price You Pay
A qualified B2B contact sells for €0.10 to €0.35 on a direct purchase, up to €0.45 for a custom-built file. Rental runs around €80 to €350 per 1,000 addresses. Off-the-shelf packs list between €139 and €499 for 100,000 to 1.5 million contacts.
That price says nothing about what you actually receive. Between 20% and 30% of addresses in a purchased file are already invalid or outdated by delivery. Dropcontact measures 25% to 30% annual erosion on standard B2B databases, purchased or not. On a file left untouched since purchase, half has vanished within two years.
| Purchased list | Built in-house | |
|---|---|---|
| Listed price | €0.10 to €0.45 / contact | Time + tools, no fixed price per contact |
| Valid addresses at day 1 | 70% to 80% | 95%+ (opt-in verified at signup) |
| Proof of consent | Missing or unverifiable | Timestamped, provable under audit |
| Real open rate | Often under 10% | 20% and above, depending on industry |
| CNIL risk | High in B2C, real in B2B with named contacts | Low if the opt-in is logged |
What Gmail Does With Your Purchased List
Since February 2024, any sender pushing more than 5,000 messages a day to Gmail addresses has to stay under a spam complaint threshold of 0.3%, measured daily in Postmaster Tools. Cross that line and the sender loses access to the mechanisms that protect their reputation. It then takes seven straight days under the threshold to become eligible again.
A purchased list trips this threshold almost automatically. Recipients don’t recognize you. They click “report as spam” instead of hunting for the unsubscribe link, which is often missing or buried. Every report weighs heavier than a simple unsubscribe. Your sender reputation carries the mark, on that IP and that domain, for weeks.
This is usually where the symptom shows up without the cause being obvious. The open rate drops 30% in three months. Nothing changed in the content, the subject line, or the send time. The email SaaS shows a “delivered” status that doesn’t distinguish inbox from spam folder. One line in the Postmaster Tools report tells the whole story. Someone still has to think to open it. The list bought eight months ago is still sitting in the database. Nobody ever pulled it out.
What Happens in the 90 Days That Follow
- Deliverability drops before anyone internally notices, because the email SaaS dashboard keeps showing “sent” without distinguishing inbox from spam folder.
- Spam traps, addresses created or reactivated solely to catch reckless sending, start responding. One hit is enough to alert ISP filters.
- The complaint rate climbs past 0.3%. The sender drops out of Gmail’s protection mechanisms for at least seven days.
- The domain or IP lands on a public blocklist, which also blocks legitimate campaigns sent from the same infrastructure.
- The CMO asks why the open rate fell 30% in three months when nothing in the content changed. Nobody on the team has a clear answer that day.
Building a List That Holds Up
An organic list costs more upfront. A form. A lead magnet worth downloading. A double opt-in that confirms the signup instead of assuming it. Each step drops contacts along the way. That’s the point: keep only the ones who actually said yes.
You’ll say one more verification tool in the stack, next to the email SaaS and everything already running the CRM, starts to add up. Check one thing before deciding: the number of dead addresses your last send actually hit, not the number the dashboard shows. Most teams discover this figure after the fact, once sender reputation has already taken the hit. Filtering it beforehand costs a few minutes on a sample. Discovering it afterward costs weeks of deliverability to rebuild.
The same logic applies to an old database never cleaned since it was created. Before running the full list through a campaign, whether it came from a form redesign or a CRM import forgotten three years ago, test verification on a sample of a few hundred addresses. The hard bounce rate shows up before the mass send, not during. The gap between the two moments is measured in weeks of lost deliverability.
The Math You Don’t See at Purchase
€5,000 for a purchased file. 1,500 dead addresses inside it. A domain that takes three months to rebuild its reputation. The next campaign’s budget absorbing the bill. Nobody writes that line into the original spreadsheet.
Your list is degrading right now, purchased or not. Built with care, it degrades slower. You already know why.
