A B2B email database: the four places the addresses come from, the accuracy figure to demand before you pay, and what United States law requires once you send

A B2B email database is a file of business contacts with work email addresses attached, and the single most important thing to know before buying one is that nobody collects these by asking. The addresses come from four places: pattern guessing against a company domain, scraping public profiles and websites, co-operative pooling where users of a tool contribute their own address books, and genuine first party registration. Most commercial databases are a blend of the first three. That is not illegal to buy in the United States, and it does not exempt you from anything: the Federal Trade Commission's own compliance guide states that the CAN-SPAM Act's requirements apply to commercial email generally, and it does not carve out business to business mail.

So there are two questions, and they are usually confused into one. The first is whether to buy a database at all. The second is which contract terms to insist on if you do. Below are both, plus the legal floor as published.

The four sources, and what each one is worth

How the address was obtained	What it predicts	The failure mode
Pattern inference from a company domain, for example first initial plus surname	Nothing about the person's interest, and often the right format for the wrong individual	Hard bounces and spam trap hits, which damage the sending domain itself
Scraped from public profiles, directories and company sites	Role and employer at the moment of scraping	Staleness. Senior people change jobs faster than any crawl cycle
Contributed address books, pooled from the vendor's own users	That somebody once emailed this person	You inherit other people's contacts and none of the context
First party registration on your own forms	Interest in a specific thing, dated	It is slow to build, which is exactly why people buy lists instead

Read that table once and the economics change shape. A purchased file is a prospecting input, not a mailing list, and the sensible way to use one is as research that feeds a small, targeted, carefully written approach rather than as fuel for a bulk send. The bulk send is the thing that burns the asset you cannot buy, which is your sending reputation.

The six terms to settle before you pay for a file

• A written accuracy or deliverability commitment, with a remedy. Not "95 per cent accurate" in a brochure, but a stated threshold in the contract and a credit if the file falls below it. A vendor that will not put a number in the agreement is telling you what the number is.
• The date each record was last verified, as a field. One timestamp for the whole file is a marketing claim. A per record date is a usable filter, and it lets you drop the oldest third before you send anything.
• How the data was collected, in writing. You are the sender and you will answer for the send. A supplier that cannot describe its own collection method per field is a supplier whose compliance position you have adopted without reading it.
• Suppression on request, for the whole file. When somebody opts out, they have to be suppressed in your system permanently, and the file you bought must not reintroduce them at the next refresh. Ask explicitly how the vendor handles a suppression you report.
• Licence scope and term. One time use, unlimited use, per seat, and whether you may retain records after the licence ends. These vary wildly between vendors and the difference is larger than the price difference.
• What happens to records for people outside the United States. If the file contains contacts in the United Kingdom or the European Union, a different consent regime applies to those rows and buying them does not transfer a lawful basis to you. Either exclude them or handle them separately.

What United States law actually requires, as the FTC publishes it

Read from the Federal Trade Commission's CAN-SPAM Act Compliance Guide for Business on 31 October 2026, the requirements are listed as follows, quoted:

• "Don't use false or misleading header information."
• "Don't use deceptive subject lines."
• "Identify the message as an ad."
• "Tell recipients where you're located."
• "Tell recipients how to opt out of receiving future marketing email from you."
• "Remember that subscribers and members can opt out of marketing emails, too."
• "Honor opt-out requests promptly."
• "Monitor what others are doing on your behalf."

Two mechanics in the same guide are worth quoting precisely because they are the ones people get wrong. On the opt-out mechanism, the guide states that you "must be able to process opt-out requests for at least 30 days after you send your message", and separately that opt-out requests must be honoured within 10 business days. Those are two different clocks and both apply: the unsubscribe link has to keep working for at least thirty days, and once somebody uses it you have ten business days to stop.

On consequences, the guide states that "Each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $53,088", in dollars, and notes that it was edited in January 2024 to reflect inflation adjusted penalty amounts. Read that as a per email figure rather than a per campaign one, because that is how it is written. Nothing on this page is legal advice, and a programme at any real scale is worth half an hour with a lawyer who can look at your actual sending setup.

The final bullet, "Monitor what others are doing on your behalf", is the one that bears directly on buying a list. Using an agency or a sending platform does not move the obligation. If a supplier sends on your behalf, you are still the advertiser.

The practical test, and when the answer is neither

• Buy when you know exactly which 300 companies you want, you need the right job titles inside them, and the file is going to feed a researched approach rather than a blast. At that scale the accuracy of each record matters more than the size of the database.
• Build when the product can be understood from a page. First party signups convert at a different order of magnitude and they carry a lawful basis you created yourself. The slow start is the whole cost and it is a one time cost.
• Neither when the honest answer is that nobody is looking for what you sell yet. A list does not fix absent demand, it just distributes the discovery problem across more inboxes. A founder led programme that starts the list before the product is a better first move, and the sequence for that is set out in start the list before the product.

Once there is a list, the programme design is a separate discipline and the role based structure that works for business audiences is covered in one list per buying role and four programmes. This page is about where the addresses come from; that one is about what to send them.

Protecting the thing a purchased file can damage

• Validate before you send, not after. Run the file through a verification service and drop every hard bounce risk. A high bounce rate on a first send is the fastest way to be filtered for months.
• Warm the sending domain. Start at low daily volume from a new domain or subdomain and raise it gradually. A cold domain sending thousands on day one is treated exactly as it looks.
• Separate the sending identity from your main domain. If prospecting mail damages a reputation, it should not be the reputation your invoices and support replies depend on.
• Authenticate properly. SPF, DKIM and DMARC published and aligned, before the first send rather than after the first deliverability problem.
• Send small batches you could defend one by one. The practical test for any prospecting email is whether you would be comfortable if the recipient forwarded it to a colleague with a comment.

Questions about buying a B2B email database

Is it legal to buy a B2B email list in the United States?

Buying business contact data is not itself prohibited, and sending to it puts you squarely inside the CAN-SPAM requirements quoted above, including identifying the message as an ad, giving your postal location, and providing an opt-out that keeps working for at least thirty days. The FTC guide does not create a business to business exemption. For contacts outside the United States a different regime applies and the purchase does not transfer a lawful basis to you.

What accuracy should I expect from a purchased file?

Expect the number the vendor will write into the contract with a remedy attached, and treat anything stated only in marketing material as unverified. The useful demand is a per record verification date rather than a single headline percentage.

Why did my sending reputation drop after one campaign?

Almost always hard bounces and spam trap hits from unvalidated records, sent at volume from a domain with no sending history. Validate the file, warm the domain and send in small batches, in that order.

Is a purchased list better than LinkedIn outreach?

They answer different questions. A file gives you coverage and lets you work systematically through a defined set of companies. A profile based approach gives you context and a warmer first touch at much lower volume. For a short target list the second usually wins; for a wide market the first is the only practical option.

Can I upload a bought list to my email marketing platform?

Check the platform's terms before you do, because several prohibit purchased lists outright and enforce it by suspending the account rather than by warning. Prospecting mail usually belongs in a dedicated sending tool, separate from the platform that mails your own customers.

How many records do I actually need?

Work backwards from the response rate you can live with and the capacity you have to follow up. A file of two thousand records nobody has time to follow up on produces fewer conversations than three hundred that get a researched second touch.

What the people on that list do before they reply to you

Every purchased record has the same weakness: the person on the other end has not heard of you. So the first thing a genuinely interested recipient does is look you up, and that step has quietly changed. Rather than typing your company name into a search box, a growing number of them ask an assistant what your company is and whether it is any good, and get back a short paragraph assembled from your site, review sites, directories and whatever press exists. If that paragraph is thin, confused or about a different company with a similar name, a good email has been wasted on a bad second impression. This is worth reading before a prospecting campaign rather than after it, because it is cheap to check and it is the only part of a cold programme you can fix in advance. AI Knows Us asks those questions across the main assistants and shows what each answer says about a company and which sources it was built from. It is not an email tool and it will not send anything; it tells you what the recipient finds when they check.