By Nicolas Avila · October 9, 2026

Purchased lists: why they destroy your delivery

Photo: Avila Ops Tecnologia

Purchased email lists do not generate customers and harm delivery of everything sent afterward, including requested quotes. The reason is mechanical: nonexistent addresses, trap addresses and thousands of people who never heard of you. One send produces enough bounces, spam reports and complaints for Gmail to downgrade your domain that same day.

The tempting offer usually arrives before major occasions: “5,000 local contacts for R$ 200 to launch your Carnival campaign.” The calculation looks good until tomorrow’s email to a real customer lands in spam.

What exactly happens when you email a purchased list?

Three things happen at once.

1. Bounces. Purchased lists are resold for years. Some addresses were deactivated. Each bounce tells providers you email nonexistent people, a classic permissionless-list signal.
2. Spam traps. Gmail, Outlook and security companies maintain addresses never subscribed to anything. Mail reaching them must come from harvested lists. A few hits can block the domain.
3. Spam reports. People who did not ask report it. Google treats one report per 1,000 emails as a warning. Purchased lists normally exceed this substantially.

Combined results create a low reputation score, explained in What sender reputation means. The score does not distinguish campaigns from work email. It applies to the whole domain.

Are purchased lists legal in Brazil?

The LGPD requires a legal basis for processing personal data, and email is personal data. Commercial communication to strangers using lists of unknown origin is difficult to justify under any legal basis. People also have the right to know where you obtained their address, and you cannot answer.

This is not just theory. An ANPD or Procon complaint can become proceedings costing more time than the campaign would generate. For service data precautions, see avilaops.com/guias/como-usar-ia-no-atendimento-sem-violar-a-lgpd.

What should you do instead?

Build your own smaller, more valuable list. Small businesses already collect email in these places:

• Invoices and orders: buyers supplied emails; ask permission for news at purchase.
• WhatsApp: after service, ask whether they also want email notices.
• Website forms: one field, clear wording about messages and a consent checkbox.
• Counter and events: a sheet or signup QR with the same wording.
• Unaccepted quotes: people who requested quotes can receive follow-up about that request; ask before adding them to news lists.

Every send needs an immediately functioning unsubscribe link. Three hundred willing recipients generate more sales than 5,000 strangers without costing domain reputation. Each name also needs source, consent date and purchase records. That is CRM work rather than an isolated spreadsheet.

What to do now

If you purchased a list, do not send. If you already sent, stop, remove bounced or reporting addresses and return to engaged recipients only. Organize your own list and learn how many messages become sales: avilaops.com/crm-para-pequenas-empresas or contact us on WhatsApp: wa.me/5517997811471.

Frequently asked questions

What if the purchased list is verified or segmented?

Verification removes invalid addresses, reducing bounces. It does not remove traps or create permission. Recipients still did not ask, and reports remain high. The badge changes price, not results.

Can I email contacts from a WhatsApp group or trade show?

Only if they asked. Sharing a group or exchanging cards is not campaign consent. Send an individual permission request; yes responses join with date and source recorded.

Is an old company list safe?

It depends on age. Contacts engaged within six months are safe. Those inactive for over a year need small-batch reengagement beginning with a message asking whether they still want emails. Remove nonresponders.