The legality of using purchased lists varies depending on the jurisdiction. In the United States, the CAN-SPAM Act regulates commercial emails, requiring businesses to include opt-out mechanisms and accurate header information. In the European Union, the GDPR imposes stricter rules, emphasizing the need for explicit consent before sending marketing emails.