Buying B2B contact data is legal in most cases, but the rules follow the data and the message, not the purchase. Before you buy, check where the vendor got the records, which privacy and email laws apply to the people on the list, and whether your CRM can honor opt-outs and deletions.
This guide covers the questions we ask vendors, the 2026 California changes that affect data brokers, what changes for EU and UK contacts, and how to set up your CRM so a purchased list does not turn into a compliance problem. It is practical guidance, not legal advice, so involve your counsel for your specific situation.
Is it legal to buy B2B contact data?
In the United States, buying business contact data is generally allowed. What you do with it is where the rules apply. Email is the clearest example. The FTC's CAN-SPAM guide states that "the law makes no exception for business-to-business email." Every commercial message needs accurate header and subject lines, a valid physical address and a working way to opt out.
The same guide adds two points buyers often miss. You cannot hand off your responsibility by hiring another company to send the emails, and you cannot sell or transfer the addresses of people who opted out. Each separate email that breaks the rules can bring penalties of up to $53,088.
If you plan to use AI tools to write or send outreach, the rules stack up further. We covered those in AI sales prospecting rules to set before you send.
What should you ask a data vendor before you buy?
A good vendor answers these quickly and in writing. A vague answer is a warning sign.
- Where did the records come from? Ask for the collection methods, not just "public sources."
- When was each record last verified? Ask for a verification date per record, so you can see how fresh the list really is.
- Are you registered as a data broker in California? If the vendor sells data about people it has no direct relationship with, California law likely treats it as one.
- How do deletion and opt-out requests reach us? Ask how removals flow to data you already bought.
- Does the list include people outside the U.S.? EU and UK contacts bring different duties.
- What does the contract promise? Look for written warranties on lawful collection, and decide with counsel what happens if those promises turn out to be wrong.
How does California's Delete Act affect purchased lists?
It mainly changes life for the vendor, and that affects what you receive. The California Privacy Protection Agency defines a data broker as a business that knowingly collects and sells personal information of consumers it has no direct relationship with. Data brokers must register each year.
Starting August 1, 2026, registered brokers must use the state's Delete Request and Opt-out Platform, known as DROP. They must access it at least once every 45 days and process the deletion requests waiting there, subject to limited exceptions. Beginning in 2028, brokers also face independent audits every three years.
For a buyer, the practical point is simple. People on a broker's list can now ask for deletion through one state platform. Ask your vendor how those deletions affect records already delivered to you, and get the answer into the contract.
What changes if the list includes EU or UK contacts?
More than most U.S. teams expect. Under UK GDPR, when you get personal data from someone other than the person, the UK Information Commissioner's Office says you must give them privacy information within a reasonable period and no later than one month. If you use the data to contact them, you must do it by the first communication. That notice must include the source of the data.
In practice, that means your first outreach email to a purchased UK contact needs a clear privacy notice that names where you got their details. EU rules follow the same pattern. You also need a lawful basis for using the data, documented before you send. If you cannot explain that basis in plain words, leave those contacts out of the import.
How should your CRM handle purchased records?
This is where most problems start or stop. We set up purchased data with five controls:
- A staging list. Purchased records land in a separate list or object first, never straight into your main contact table.
- Suppression before import. Every record is checked against your opt-out and do-not-contact lists before it becomes active. Otherwise a purchase can quietly re-add people who already said no.
- Source fields. Each record carries the vendor name, purchase date and verification date. When someone asks where you got their data, you can answer.
- No overwrites. Purchased data cannot replace consent, owner or status fields on existing records.
- Fast opt-out handling. CAN-SPAM gives you 10 business days to honor an opt-out, and your opt-out method must work for at least 30 days after you send. Build the flow so it updates the CRM automatically, in hours rather than days.
It also helps to filter the list against your ideal customer profile before import. Fewer, better records are easier to keep compliant.
What are the most common mistakes?
- Importing the whole file into the main database on day one.
- Skipping the suppression check because the vendor said the list was "clean."
- Letting an agency send from your domain without seeing their opt-out process.
- Keeping no record of where each contact came from.
- Never removing records that stop responding. Set a review date and either re-verify or archive them.
If a purchased list does produce interest, route those contacts the same way as any other signal. Our guide to routing B2B buying signals shows how.
Frequently asked questions
In the U.S., buying one is generally legal. Sending to it must follow CAN-SPAM, which has no exception for business-to-business email, plus any state or international rules that apply to the people on the list.
CAN-SPAM does not require prior consent, but it does require honest headers and subject lines, a physical address and a working opt-out honored within 10 business days. Other countries can be stricter.
DROP is the Delete Request and Opt-out Platform run by the California Privacy Protection Agency. Starting August 1, 2026, registered data brokers must check it at least every 45 days and process deletion requests.
Put them in a staging list, check them against your suppression lists, record the vendor and dates on each record, and block them from overwriting existing consent or owner fields.
Sources
- FTC: CAN-SPAM Act, A Compliance Guide for Business
- California Privacy Protection Agency: Information for Data Brokers
- ICO: Right to be informed
Planning to load purchased data into your CRM?
We set up staging lists, suppression checks, source fields and automated opt-out handling, so new data grows your pipeline without putting your sender reputation or compliance at risk.
