Clean sources, ranked#
| Source | What you get | Points to watch |
|---|---|---|
| Business's own website | General address (info@, hello@), the business's own words | Prefer generic addresses; check the law for named ones |
| Google Maps listing | Business name, category, website link | Platform terms limit storing most content beyond the place ID |
| Events and trade shows | Contacts who met you | Ask and record whether you may follow up by email |
| Your website (inbound) | People who asked for something | Clear sign-up wording; confirmed opt-in where needed |
| Referrals | Warm introductions | The introducer should have checked the contact is happy to hear from you |
| Existing customers | Addresses from a sale | Soft opt-in rules where they apply; easy opt-out each time |
General guidance; the rules for each country and legal form still apply.
Why bought lists cause trouble#
- Age: people change jobs and businesses close, so many addresses bounce
- Origin: sellers rarely show where each address came from or whether the people were told
- Consent: claims that a list is “opted in” rarely cover your company and your offer
- Deliverability: dead addresses and spam traps damage your domain's reputation quickly
- Accountability: as the sender, you are responsible for the data and the emails, not the seller
Public doesn't mean free to use#
In the UK, the ICO is clear that you can't assume someone agrees to direct marketing just because their details are public. If an address identifies a person, data protection law applies even in a business context: you need a lawful basis, you must tell them where you got their data, and you must respect objections.
A practice manager's work email on the practice's own website is a very different source from a private address collected by a scraper from a forum.
Record source and basis for every address#
- Where the address came from (URL, event, form) and when
- Whether it is a generic or a named address
- The recipient's country and legal form, where it matters
- Your basis for contacting them (consent, soft opt-in, legitimate interests, a country's B2B rules)
- Any opt-out or objection, kept permanently on a suppression list
- A date to delete the lead if nothing happens
Clean the list before you send#
- Remove duplicates and addresses that are already on your suppression list.
- Drop role addresses that clearly aren't for sales enquiries, such as invoices@ or careers@.
- Remove addresses for countries or legal forms you may not email.
- Send in small batches first and remove every hard bounce immediately.
FAQ
Is it legal to buy a B2B email list?
Buying a list isn't illegal in itself in many countries, but using it often is risky: you must still meet e-marketing and data protection rules for every address, and most lists can't show how the data was collected.
Where can I find business email addresses legally?
On the business's own website, from people who give you their details at events or through your site, from referrals and from your own customers, always within the rules of the recipient's country.
Can I scrape email addresses from websites?
Collecting a business's published general address for a relevant first contact is common practice where the law allows it. Scraping named personal addresses in bulk raises data protection questions and may break site terms.
How do I keep my B2B email list clean?
Remove bounces at once, keep every opt-out on a permanent suppression list, delete leads who don't respond after a set period, and re-check the source before reusing old data.
Sources
- Business-to-business marketing · Information Commissioner's Office (ICO)
- Sender Requirements & Recommendations · Yahoo
- Policies and attributions for Places API · Google for Developers
- Regulation (EU) 2016/679 (GDPR) · EUR-Lex