# Can You Buy an Email List for Marketing in the UK?

> Source: https://prontx.com/insights/can-you-buy-an-email-list-uk/ | Publisher: ProntX | Last updated: 2026-11-14

## Summary

You can buy an email list in the UK, but you can rarely use it legally: under PECR, people on the list must have given consent that names your business and covers email, the soft opt-in never applies to bought lists, and Google's sender guidelines tell senders not to purchase email addresses at all.

Can you buy an email list in the UK? You can buy one, but you can rarely use it. Under PECR, everyone you email as an individual must have given consent that names your business and covers email marketing. The soft opt-in never applies to bought lists, and Google’s sender guidelines say not to purchase email addresses.

That answer surprises a lot of business owners, because list brokers still advertise "GDPR compliant" data by the thousand. This guide explains what the rules actually say (as of November 2026), where the narrow exceptions are, what happens to deliverability when you mail a cold list, and what we at ProntX recommend doing instead.

## Key takeaways

- Buying a list is not unlawful in itself. Emailing individuals on it without valid consent is.

- Valid consent must name your organisation (not "trusted partners"), cover email, and be recorded so you can prove who consented, when and how.

- The soft opt-in only covers contacts you collected yourself during a sale or negotiation. It never covers a bought list.

- Limited companies can be emailed without consent under PECR, but sole traders and ordinary partnerships are treated as individuals.

- Since the Data (Use and Access) Act 2025, the ICO can fine up to £17.5 million for certain PECR failures.

- Gmail tells senders not to buy addresses and to keep spam complaints below 0.1%. Cold lists rarely manage that.

## What do UK rules say about buying an email list?

The rules allow you to use a bought list for email only if the people on it gave valid consent to receive marketing from you, by email. Two laws apply together: the Privacy and Electronic Communications Regulations (PECR), which control how you send electronic marketing, and the UK GDPR, which controls how you handle the personal data in the list.

The Information Commissioner’s Office (ICO) is direct about this. In its [guidance on the PECR email marketing rules](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-direct-marketing-using-electronic-mail/how-do-we-comply-with-the-pecr-electronic-mail-marketing-rules/), it says organisations normally must have consent before sending unsolicited electronic mail marketing to individual subscribers. That consent must be freely given, specific, informed and unambiguous, and the ICO notes that consent is not transferable from one organisation to another.

In practice, that rules out most lists on the market. A person who ticked a box on a competition site agreeing to hear from "selected partners" did not consent to hear from you.

## When could a bought email list be lawful to use?

A bought list is only usable for emailing individuals when every record passes the ICO’s checks. The ICO says you must check that the consent:

- named your organisation, not just "trusted partners" or similar;

- clearly covered the method of electronic mail marketing;

- was freely given, specific, informed and unambiguous; and

- is recorded so you can demonstrate who consented, when and how.

If the consent does not name you, or does not cover email, the ICO says it is not valid and you must not send marketing emails to those people. Very few brokers can show that your business was named at the point of sign-up, because the list was gathered before they knew you existed. That is why we tell clients to treat bought consumer email data as unusable unless the seller can prove otherwise, record by record.

## How does the soft opt-in work, and why doesn’t it cover bought lists?

The soft opt-in is an exception that lets you email your own customers without fresh consent, and it only covers contact details you collected yourself. The ICO lists five conditions for the products and services soft opt-in. All five must be met:

- you obtained the person’s contact details yourself;

- you did so while selling, or negotiating to sell, a product or service;

- you only market your own similar products and services;

- you gave them a chance to refuse or opt out when you collected their details; and

- you give them a chance to opt out in every message after that.

A bought list fails the first condition straight away. The ICO puts it plainly: there is no such thing as a third-party marketing list that is compliant with the soft opt-in.

Charities now have a second route. The charitable purposes soft opt-in, added by the Data (Use and Access) Act 2025, commenced on 5 February 2026 according to the ICO. It covers people who expressed an interest in, or offered support for, the charity’s purposes, but only for details obtained on or after that date, and again only details the charity collected itself.

## Can you email bought B2B contacts?

Sometimes, yes. PECR treats business email differently: the ICO says you can send unsolicited electronic mail marketing to corporate subscribers without consent or a soft opt-in. A limited company is the typical corporate subscriber.

There are two catches. First, sole traders and ordinary partnerships are treated as individuals, so they need consent in the same way as consumers. A B2B list full of small trades and local firms will contain many of these. Second, you must never hide your identity and must give a valid address for people to opt out, in every message. Named addresses at a company also carry personal data, so the UK GDPR still applies to how you store and use them. The ICO’s [business-to-business marketing guidance](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/) is the place to check your specific case.

## What changed under the Data (Use and Access) Act 2025?

The main change is the size of the penalty. The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and the ICO’s summary, updated on 19 June 2026, says all of its provisions affecting data protection law and PECR are now in force.

| 
Area | 
Position as of November 2026 | 
Source | 

| 
Maximum PECR penalty | 
Up to £17.5 million for certain failures to comply | 
ICO DUAA summary, Schedule 13 | 

| 
Threshold for a fine | 
The need to show "substantial damage and distress" has been removed | 
ICO DUAA summary, Schedule 13 | 

| 
Messages in scope | 
Emails and texts that were sent, even if not necessarily received | 
ICO DUAA summary, PECR changes | 

| 
Charity soft opt-in | 
Available for details obtained on or after 5 February 2026 | 
ICO PECR email guidance | 

| 
Bought lists and soft opt-in | 
Never compliant | 
ICO PECR email guidance | 

The "sent, not necessarily received" point matters for bought lists. Many addresses on old lists bounce, and those messages can still count.

## What happens to deliverability if you email a bought list?

Even where a list is lawful, mailing it usually damages your ability to reach the inbox. Google’s [email sender guidelines](https://support.google.com/a/answer/81126) list "Don’t purchase email addresses from other companies" and "Don’t send messages to people who didn’t sign up" among the practices to avoid.

Google also sets hard numbers. It asks senders to keep the spam rate reported in Postmaster Tools below 0.1% and never to reach 0.3% or higher. People who never asked to hear from you report spam far more readily than subscribers do, and the damage lands on your domain, which also sends your invoices, quotes and order confirmations.

If you send close to 5,000 messages or more to personal Gmail accounts in a day, Google treats you as a bulk sender, permanently. Bulk senders need SPF, DKIM and DMARC set up, one-click unsubscribe on marketing messages, and Google recommends honouring unsubscribes within 48 hours. Blasting a large purchased file is one of the quickest ways to hit that threshold with a poor reputation.

## Should you buy an email list? A decision checklist

Work through these questions before paying for any data. If you answer "no" to any of the first four for a consumer or sole-trader list, do not email it.

- **Named consent:** can the seller show that each person agreed to hear from your business by name?

- **Method:** did that consent cover email specifically?

- **Records:** can they give you the date, wording and method of each opt-in, so you could show the ICO?

- **Freshness:** is the data recent enough that people would remember agreeing?

- **Subscriber type:** for B2B data, have you removed sole traders and ordinary partnerships, or got consent for them?

- **Suppression:** have you screened the list against your own "do not contact" list?

- **Domain risk:** would you send from a domain you can afford to damage, with authentication in place?

- **Opt-out:** does every message identify you and include a simple, free unsubscribe that does not need an account?

For most small and mid-sized UK businesses, the honest result of that checklist is that bought data is not worth the money or the risk.

## What are better ways to build an email list in the UK?

The better route is to collect consent yourself, where people already meet you. These are the methods we use most often when setting up email programmes at ProntX:

- **Checkout and enquiry forms.** Collect details during a sale or quote, offer an opt-out there and then, and you can rely on the soft opt-in for similar products and services.

- **A sign-up form with a real reason to join.** A useful guide, early access or a members’ price works better than "subscribe to our newsletter". Leave the consent box unticked.

- **Lead generation ads.** Paid social and search ads can send people to a form that asks for named consent to email from you.

- **Events and in-person sales.** Use a clear consent line on paper or tablet forms, and record when and how each person signed up.

- **Confirm new sign-ups.** A confirmation email filters out typos and fake addresses before they hurt your sender reputation.

- **Welcome flow.** Send a short automated sequence straight after sign-up, while people still remember you.

A list built this way grows more slowly, but every address belongs to someone who chose to hear from you. That is what drives opens, clicks and sales, and it keeps your domain safe for everyday business email. If you are working out what a properly run programme costs, our breakdown of [email marketing costs in the UK](/insights/how-much-does-email-marketing-cost-uk/) covers software, setup and management. For a comparison of where email fits next to other channels, see [social media vs email marketing](/insights/social-media-vs-email-marketing/).

## How ProntX handles list building

We do not buy or rent consumer email data for clients, and we do not recommend it. When we take on an [email marketing programme](/email-marketing/), we start by auditing how existing contacts were collected, separate soft opt-in customers from consented subscribers, set up SPF, DKIM and DMARC, and build sign-up points and automated flows that grow the list lawfully. Smaller firms can see how this works at a lighter scale on our [email marketing for small businesses](/email-marketing/small-business/) page.

Management starts from £450 a month on a rolling monthly contract, and you keep ownership of your list and your email platform account. If you want a second opinion on a list you already hold, or on a broker’s offer, ProntX can review it and tell you plainly what you can and cannot send. You can find out more about [how we run email marketing](/email-marketing/) and request a free growth audit.

*This article explains the rules in general terms and is not legal advice. Check the current ICO guidance or take legal advice for your specific situation.*

## Frequently asked questions

### Is it illegal to buy an email list in the UK?

Buying the list is not the offence. Sending marketing emails to the people on it usually is, unless each person gave consent that names your organisation and covers email marketing. The ICO says consent to 'trusted partners' or similar wording is not valid, so most lists sold to UK businesses cannot be used for email to individuals.

### Can I email a list of business contacts I bought?

PECR lets you send unsolicited marketing emails to corporate subscribers, such as limited companies, without consent. Sole traders and ordinary partnerships count as individuals, so they need consent. You must still identify yourself and give a working opt-out, and the UK GDPR applies to any personal data you hold, so do proper checks before you use a B2B list.

### What does 'GDPR compliant list' actually mean?

Often very little. Buying a list does not move responsibility for consent to the seller; it stays with you as the sender. Ask the seller for the exact consent wording, the date and method each person opted in, and proof that your business was named. If they cannot show that, treat the claim as marketing copy, not evidence.

### Can I use the soft opt-in for a bought list?

No. The ICO states plainly that there is no such thing as a third-party marketing list that is compliant with the soft opt-in. The soft opt-in only covers contact details you collected yourself while selling, or negotiating to sell, a product or service, with an opt-out offered at that point and in every message after.

### How much can the ICO fine for unlawful marketing emails?

The Data (Use and Access) Act 2025 lets the ICO impose penalties of up to £17.5 million for certain PECR failures, and the ICO says all of the Act's data protection and PECR provisions are now in force as of June 2026. Fines are only part of the cost, because spam complaints also damage your sending domain's reputation.

### Can I scrape email addresses from websites or LinkedIn?

Scraped addresses are no better than bought ones. The ICO says that just because someone's contact details are publicly available, it does not mean they have consented to your direct marketing. For individuals you still need specific consent, and Google's guidelines also tell senders not to email people who did not sign up to hear from them.

### How quickly can I build my own email list?

It depends on your traffic and offer, but most businesses can start the same week. Add a sign-up form with a clear reason to join, collect consent at checkout and in enquiry forms, and offer an opt-out wherever you rely on the soft opt-in. A smaller list of people who asked to hear from you will usually earn more than a large bought file.

## Contact

Free growth audit: https://prontx.com/free-audit/ | Phone: 020 3048 4022 | Email: info@prontx.com