The legality of buying email lists varies by country and is often subject to regulations such as the CAN-SPAM Act in the United States and the GDPR in the European Union. These laws mandate that recipients must have given explicit consent to receive marketing emails, making many purchased lists non-compliant.