The legality of buying email lists varies by region and is subject to specific regulations like the CAN-SPAM Act in the United States and the GDPR in the European Union. Generally, it is legal to buy email lists, but using them without consent can lead to legal complications.