67Leads › Blog › Is buying an email list legal? CAN-SPAM, B2B email and texting, plainly

Is buying an email list legal? CAN-SPAM, B2B email and texting, plainly

By 67Leads Team · Published 5 Nov 2026 · Updated 5 Nov 2026 (US Central) · 7 min read

In the US, buying a list of business email addresses is generally legal; what the law regulates is how you send to it. CAN-SPAM covers every commercial email, business-to-business included, with penalties of up to $53,088 per email, and texting or autodialing those numbers brings in the TCPA. This is a plain-English summary, not legal advice.

Key numbers

7,075Email confirmed by the mail server
97%Share of verified emails that are not shared inboxes
130,779Local, not toll-free, phone
132,517Sellable businesses with a phone

Live from the 67Leads warehouse, computed 5 Nov 2026 (US Central) when this page was served. Sellable means graded as the trade, with a phone, opted-out businesses removed. Methodology.

Not legal advice

This guide summarises what US statutes and regulator pages say, with links to each one. It is written by the 67Leads team, not by a lawyer, and it does not know your business. If you are about to send at volume, text business numbers, or sell into a state with its own rules, pay a lawyer for an hour. It is cheaper than any of the penalties below.

Is it legal to buy an email list?

No US federal law bans buying or selling a list of business contact details. The rules bite at the point of use: the email you send, the call you make, the text you send. So the useful question is not "can I buy this list?" but "can I send this email to these people, and can I prove where the addresses came from?"

Two exceptions matter on the buying side:

Harvested and guessed addresses. CAN-SPAM makes it an aggravated violation to "assist in the origination" of an unlawful message by providing addresses that were taken by automated means from a website carrying a notice that it will not give, sell or transfer addresses, or that were generated "by combining names, letters, or numbers into numerous permutations" (15 USC 7704). A list built by guessing first.last@ patterns is exactly that second case. Ask any seller how the addresses were obtained.
Data broker laws. Some states regulate the seller. California fined a Nevada marketing company, ROR Partners LLC, $56,600 for failing to register as a data broker (California Privacy Protection Agency). That is the seller's problem, but a seller who ignores it may ignore other things too.

What CAN-SPAM requires of every commercial email

The Federal Trade Commission's guide is short and worth reading in full (FTC CAN-SPAM guide). Its key points:

"The law makes no exception for business-to-business email." A cold email to a plumbing company is covered just like a newsletter to consumers.
Each separate email in violation can cost up to $53,088.
Both the sender and the company being advertised can be held liable. Hiring an agency does not move the risk off you.
No false or misleading header information, and no deceptive subject lines.
Identify the message as an advertisement.
Include a valid physical postal address.
Tell recipients how to opt out, keep the opt-out working for at least 30 days after you send, and honour it within 10 business days.
Once someone opts out, you may not sell or transfer their address.
Monitor anyone who sends on your behalf.

None of this requires the recipient's permission in advance. CAN-SPAM is an opt-out law for email: you may send the first message if it follows the rules, and you must stop when asked.

State email laws that catch out senders

Several states add their own rules, and some have been used to sue over subject lines. Washington's Commercial Electronic Mail Act allows $500 per violating email without proof of loss, and an Indiana case against Ulta let a misleading-subject-line claim proceed, holding it was not preempted by CAN-SPAM (Kelley Drye). Whether those laws reach business-to-business email has not been settled in the sources we read. The safe habit is simple: no fake "Re:" or "Fwd:" subjects, and no subject line that promises something the email does not deliver.

Texting and calling business numbers: the TCPA

This is where the money is. The Telephone Consumer Protection Act and the FCC's rules say:

Calls to mobile numbers made with an autodialer, a prerecorded voice or an artificial voice need "prior express consent", whether the person is a business or not, and "the term 'call' includes a text message" (47 CFR 64.1200, 47 USC 227).
Damages are $500 per violation, up to $1,500 if wilful, with no cap.
The national Do Not Call rules protect residential subscribers, and telemarketing calls are limited to 8am to 9pm local time.

Why it matters for local business lists: a small contractor's listed number is very often the owner's own mobile. A list can tell you a number is local rather than toll-free, but not whether a person carries it in their pocket. Treat every number as possibly a mobile.

Texas goes further. Since 1 September 2025, Senate Bill 140 treats text messages as telephone solicitations under Chapter 302 of the Business and Commerce Code (SB 140). A seller soliciting a purchaser in Texas needs a registration certificate, with a $200 filing fee and a $10,000 security (§302.106, §302.107). The "commercial sales" exemption only covers business buyers who will resell the item or use it in manufacturing or recycling (§302.056). An agency texting Dallas roofers to sell them marketing does not fit it.

So: email to business addresses under CAN-SPAM is the low-risk channel. Hand-dialled calls during business hours are next. Automated texting is the high-risk one.

Outside the US

If any of your recipients are outside the US, different laws apply. GDPR covers organisations established in the EU and those processing data of people in the EU (GDPR Article 3). Canada's CASL allows implied consent where a person has "conspicuously published" their address without saying they do not want messages, and the message is relevant to their business role (CASL s.10(9)(b)). 67Leads holds US businesses only, which keeps this simpler.

What to ask before you buy a list

Use these questions on any seller, including us:

Where do the addresses come from? "Read from the company's own website" is a clear answer. "Proprietary sources" is not.
Are any addresses generated by pattern? If yes, walk away: that is the dictionary-permutation case in the statute above.
What does "verified" mean, and when was it checked? A mailbox check against the mail server is one thing. A syntax check is another. Ask for the date.
How do opt-outs work? A business that asks to be removed should be removed from every future list, not just yours.
Who is the seller? A real company name, terms of use and a privacy policy are the minimum.

How 67Leads handles this

We hold US business contact data from public business listings and company websites. Emails are read from the company's own site, never generated from a name pattern, and then checked against the mail server without sending anything. Today 7,075 businesses in the warehouse have an email the mail server confirmed, and 97% of those are not shared inboxes like info@. We say "unverified" when the check could not decide.

Any business can be removed at /remove, and the removal holds when the business is seen again. Our terms prohibit using the data in breach of CAN-SPAM, the TCPA or do-not-call rules, and our privacy policy describes what we hold. The methodology page explains each field.

130,779 of the 132,517 businesses have a local, not toll-free, number. 67Leads does not send texts or place calls for you, and email is the channel we would start with.

A safe default for cold email to local businesses

Send from your real business, with your real name and postal address in the footer.
Write one short, relevant email per business. Do not send to addresses you guessed.
Use an honest subject line that describes what the email is about.
Put a plain "reply stop and I will not email again" line in every message, and honour it the same day.
Keep a suppression list and check every new list against it before you send.
Do not text or autodial numbers from a purchased list.
Check your sending domain is set up properly with our SPF and DMARC checker and run your copy through the spam word checker.

Questions

Is cold emailing businesses legal in the US?

Yes, if each email follows CAN-SPAM: honest headers and subject, a postal address, a working opt-out honoured within 10 business days, and identification as an ad. The FTC is explicit that business-to-business email is covered.

Do I need consent to email a business?

Not under CAN-SPAM, which is an opt-out law. Other countries differ, and texting or autodialing a mobile number in the US does need prior express consent under the TCPA.

Is it legal to text business phone numbers?

Texts sent with an autodialer to mobile numbers need prior express consent, and many small-business numbers are mobiles. Texas also requires registration for text solicitations. Get advice before you text any list.

Get 67 leads free

No card. Search is free with contacts masked.