outbound
The List You Did Not Build
A purchased list is somebody else's data with your reputation attached. The costs show up in deliverability and consent before they show up anywhere else.
Buying a list is the fastest way to have ten thousand contacts and the fastest way to be unable to email anybody.
The argument against it is usually made on ethics, which is a conversation people have already decided about. The argument worth making is mechanical, because the mechanics are not a matter of opinion.
What a purchased list contains
Three populations, in unknown proportions.
Addresses that work and belong to people with no idea who you are. These generate complaints at a far higher rate than any list you built, because from the recipient's side the message is unsolicited in the fullest sense.
Addresses that no longer exist. Lists decay quickly as people change jobs. A list sold twice is a list that has decayed between the sales, and nobody re-verifies between resales.
Spam traps. Addresses operated by mailbox providers and anti-abuse organisations, which have never been used by a person and therefore cannot have opted in to anything. Mail arriving at one is evidence that the sender acquired the address without consent, and the reputational consequence is immediate and severe.
The third category is why the cost is not proportional. A list with a 2% complaint rate is a problem. A list with a handful of traps is a sending domain that has stopped working.
The reputation is attached to you
The authentication records that make your mail deliverable, discussed elsewhere, also make it attributable. DMARC, RFC 7489, exists precisely so a receiver can tie a message to a domain and act on it.
That attribution is one-directional. The list vendor's reputation is unaffected by what happens when you send to it. Yours absorbs all of it, and it is the same domain your invoices, your appointment confirmations and your password resets go out on, unless you separated those streams in advance.
This is the part that converts a marketing decision into an operational incident. A campaign to a bought list can stop a customer from receiving a receipt.
The compliance position is worse than it looks
Under United States email rules, a cold commercial message is not automatically unlawful, and the requirements in the FTC's compliance guide apply the same way they would to any other message: honest headers, honest subject, identification as an advertisement, a physical address, and a working opt-out honoured within ten business days.
Two things are harder with a purchased list.
The opt-outs have to survive the list. If a vendor sells you the same list again in a year, your suppression has to win. That requires suppression at the account level, applied on import, not a flag on the records you happened to have at the time.
Phone numbers on the list carry the telemarketing rules. The Telemarketing Sales Rule at 16 CFR part 310 and the national registry do not care where the number came from. A purchased contact list that includes mobile numbers is an obligation to scrub, not an asset to dial.
And if the list includes people outside the United States, their jurisdictions' rules apply to them, and several of those are opt-in regimes where the position is not ambiguous.
What works instead, with the same impatience
The objection to building a list is that it is slow. Three approaches are not.
Your own lapsed and closed-lost records. Every business has them, they are already yours, they have consent history attached, and they convert better than any cold list because the relationship existed. Almost nobody works them.
Publicly stated intent. Permits, filings, listings, job postings, storm and weather events: signals that a specific business or household has a need right now. Reaching out on the back of an observable event is cold outreach that is relevant, which is a different activity from reaching out because somebody appeared on a list.
Referral and partner introductions. Slower per contact and dramatically higher converting, and they carry consent implicitly.
None of these produce ten thousand contacts this afternoon. All of them produce contacts you can email next year.
If you are going to do it anyway
Two harm-reduction measures, since the decision is sometimes already made.
Send from a separate subdomain with its own authentication, kept away from the domain your transactional mail uses, so a reputation problem is contained.
Verify the list before sending, and send to the smallest viable segment first. If the complaint rate on five hundred is bad, you have learned it at a survivable scale rather than on the whole list, which is the difference between a mistake and an outage.