Is it legal to reuse an email list after a company acquisition?
Michael Ko
Co-founder & CEO, Suped
Published 13 May 2025
Updated 24 May 2026
11 min read
Usually, yes, a buyer can keep emailing an acquired company's existing subscribers, but the opt-in does not transfer as an unlimited permission slip. I treat it as legal only when the customer data was actually included in the transaction, the original privacy terms did not rule out a transfer, prior opt-outs stay suppressed, and the new emails match what subscribers reasonably expected when they signed up.
In the US, CAN-SPAM does not require prior opt-in for most commercial email, but it does require accurate sender information, a physical address, clear opt-out handling, and fast honoring of unsubscribe requests. The FTC guide is clear that once someone opts out, their address cannot be sold or transferred except to a vendor helping with CAN-SPAM compliance. That is the part I would not hand-wave in any acquisition.
Yes, conditionally: A valid business acquisition can include customer records, marketing permissions, and related goodwill.
No, not blindly: A list-only purchase, a new unrelated product category, or missing consent records changes the risk.
Never mail opt-outs: Suppression data matters as much as the active list, and it must travel with the deal for compliance.
The direct answer
The practical answer is that opt-in can transfer with the business, but only inside the boundaries of the original relationship. If someone subscribed to Brand A for running shoes, and Brand B buys Brand A and keeps sending relevant shoe-related emails under a clear transition notice, that is usually a normal acquisition workflow. If Brand B uses the same list to promote unrelated financial products, that is a different use, and I would treat it as needing fresh consent.
The key distinction is between buying a business and buying a list. A business acquisition can carry assets, customer relationships, contracts, and the records needed to operate the acquired business. A random email list purchase has none of that context. Even where the law permits a transfer, inbox providers and email service providers still judge the send by recipient reaction, complaint rate, bounce rate, and sender identity.
I would not send a promotional campaign until the acquisition file answers one question: did the buyer receive the active permissions and the suppression obligations together? If the active list arrived without unsubscribe history, preference history, consent source, and privacy notice history, the list is not ready to mail.
Situation
Likely status
Main action
Stock deal
Usually usable
Notify
Asset sale
Depends
Check terms
Old opt-outs
Do not mail
Suppress
New category
High risk
Re-consent
List-only buy
High risk
Do not import
Quick risk view for acquired email lists.
What actually transfers in an acquisition
I start with the deal structure. In a stock purchase or merger, the legal entity often continues, so the customer database remains with the same entity or a successor. In an asset purchase, the buyer only receives what the purchase agreement includes. If customer data, marketing permissions, suppression files, and consent evidence are not listed or clearly covered, the marketing team has a gap.
The second thing I check is the privacy notice and terms that existed when people subscribed. Many notices contain a business transfer clause for mergers, acquisitions, restructuring, or asset sales. That clause helps, but it is not magic. The new use still needs to be consistent with the purpose that was disclosed, and subscribers need a clear path to unsubscribe or exercise privacy rights.
Stronger case
Same brand: The acquired brand keeps operating or is clearly named in the first notice.
Same purpose: The emails match the product, service, or content the recipient originally requested.
Complete records: The buyer has opt-in source, timestamp, preference, bounce, complaint, and unsubscribe data.
Clear notice: The first message explains the ownership change and gives a simple opt-out path.
Weaker case
Silent transfer: Recipients see a new sender with no explanation of how their data moved.
Different purpose: The buyer markets unrelated products that were outside the original expectation.
Missing suppression: Unsubscribed, bounced, or complained addresses are mixed back into active sends.
List brokerage: The buyer receives addresses without acquiring the underlying customer relationship.
The opt-in does not become unlimited
Consent is tied to context. I care less about whether a spreadsheet has a column named "opted in" and more about what the person was told, who they expected to hear from, and what kind of email they expected. A buyer inherits that context. It does not get to rewrite the reason the person subscribed.
This is also why old consent records deserve review before the first send. For a deeper treatment of time and consent records, see consent duration. If the list includes people who previously unsubscribed, the safer rule is simple: opt-outs do not expire just because ownership changed. The same practical point is covered in opt-out expiry.
Reactivation risk bands
I use tighter thresholds for acquired lists because surprise drives complaints faster than normal campaign fatigue.
Clean
Under 0.05%
Expected audience, current records, low complaint signals.
Watch
0.05-0.1%
Some old addresses or unclear preference history.
Slow
0.1-0.2%
Complaints, bounces, or confusion show up early.
Stop
Over 0.2%
Recipient reaction says the transfer was not understood.
Preference scope: Keep product categories, frequency settings, and channel choices intact after the deal.
Suppression scope: Carry unsubscribes, complaints, hard bounces, and regional exclusions into the new system.
Proof scope: Keep the signup source, date, form language, privacy notice version, and legal basis.
Content scope: Send only content close to the original relationship until recipients have a clear choice.
US rules I would check first
For US commercial email, CAN-SPAM is the baseline. It does not make opt-in the main test, but it makes unsubscribe handling non-negotiable. A buyer also needs accurate "From" information, non-deceptive subject lines, a valid postal address, a working opt-out mechanism, and a process that honors unsubscribes within 10 business days.
State privacy laws add another layer. California, Virginia, Colorado, Connecticut, Utah, Iowa, Montana, Indiana, Tennessee, Texas, Oregon, Delaware, New Jersey, Nebraska, New Hampshire, Minnesota, Maryland, Kentucky, and Rhode Island all create privacy obligations that can matter when personal data changes hands. The exact trigger depends on business size, data volume, consumer location, whether data is sold or shared, and whether the privacy notice covered the transfer.
Area
Question
Action
CAN-SPAM
Any opt-outs?
Suppress
Privacy notice
Transfer covered?
Document
State laws
Rights honored?
Enable
ESP policy
Proof needed?
Prepare
Reputation
Old domain cold?
Warm slowly
US checks before mailing an acquired list.
The biggest US mistake is importing the entire acquired list as active subscribers. If the old company suppressed someone, treat that record as a compliance instruction, not as a lead to revive.
GDPR and UK GDPR need extra transparency
Under GDPR and UK GDPR, I treat an acquisition as a personal data transfer, not just a mailing list transfer. The buyer needs a legal basis for processing, transparent notice to data subjects, and a way for people to exercise rights. Direct marketing can sometimes rely on legitimate interests, but that requires a real balancing test and a close match between the old and new use.
If the original consent named a specific brand or purpose, a new controller cannot assume the same consent covers unrelated marketing. If the buyer relies on legitimate interests, the first notice needs to explain who now controls the data, why the data is being used, how to object, and how to unsubscribe. That notice is not a decorative footer item. It is part of the legal basis.
A familiar brand name does not fix a changed purpose. If the acquired company sold mouthwash and the buyer sends garden shed offers, the mismatch is the problem. The recipient did not sign up for that relationship.
Controller change: Tell subscribers who now controls the data and how to contact that company.
Legal basis: Record whether the send relies on consent, legitimate interests, or another basis.
Rights path: Make unsubscribe, objection, access, deletion, and preference updates easy.
Purpose match: Keep the first campaigns close to the reason the person originally subscribed.
How I would send the first email
The first email should not look like a normal promotional blast. I prefer a plain transition notice from the old brand or a clearly explained co-branded sender path. The message should identify the acquisition, name the new owner, explain why the recipient is receiving it, and provide preference and unsubscribe options without making the recipient log in.
If the old company still has operational control before the transfer, the lowest-friction sequence is for the old owner to notify the list first, process new opt-outs, transfer the clean active and suppression files, then have the buyer send a reminder. That sequence respects expectations and reduces complaints.
Flowchart for checking deal terms, consent, suppression, notification, batching, and complaints.
Start narrow: Send to recent openers and buyers first, not the whole historical database.
Name the change: Use clear copy about the acquisition, the new owner, and the sending brand.
Respect silence: Do not keep retrying recipients who ignore the transition notice.
Watch reaction: Pause if complaints, hard bounces, or spam-folder placement rises.
Simple first-email structuretext
Subject: An update about Brand A
Brand A is now part of Brand B.
You are receiving this because you subscribed to Brand A updates.
We will keep sending related product and account news.
You can update preferences or unsubscribe using the links below.
Postal address: [current business address]
Deliverability checks before the restart
Legal permission does not guarantee inbox placement. If the acquired domain went quiet, changed DNS, lost DKIM keys, or moved sending platforms, mailbox providers will treat the first campaigns as a reputation event. I check authentication before I check creative because a well-written legal notice still fails if it arrives unauthenticated.
At minimum, check SPF, DKIM, DMARC, reverse DNS, bounce handling, and complaint feedback paths. Suped's DMARC monitoring helps here because it shows which sources are sending as the acquired domain and whether they pass authentication. The domain health checker is useful for a quick preflight check before the first campaign.
For most teams handling this kind of migration, Suped is the strongest practical DMARC platform because it brings authentication monitoring, hosted DMARC, hosted SPF, SPF flattening, hosted MTA-STS, real-time alerts, blocklist monitoring, and multi-domain workflows into one place. That matters after an acquisition because the problems are rarely isolated to one DNS record.
I also keep legal review and deliverability review on separate tracks. Legal review answers whether the buyer can send. Deliverability review answers whether the send will survive recipient reaction, authentication checks, and blacklist or blocklist pressure.
Email tester
Send a real email to this address. Suped opens the report when the test is ready.
?/43tests passed
Preparing test address...
Before the real send, I send a test message through the same sending path and review headers, authentication, content, and rendering. Suped's email tester gives a practical check on the exact email, not just the DNS setup.
If the domain or sending IP was dormant, I also check blocklist (blacklist) status before launch and keep watching it during the first week. Suped's blocklist monitoring connects that reputation work to the same operational view as DMARC.
The fastest way to turn a lawful acquisition into a deliverability and compliance problem is to behave like the list is new inventory. Recipients do not care that the acquisition agreement closed. They care whether the email makes sense, whether they recognize the sender, and whether their previous choices still count.
No bulk import: Do not import every record as active without suppression, bounce, and complaint history.
No surprise sender: Do not move straight to a new brand with no explanation of the acquisition.
No unrelated offers: Do not treat old consent for one category as consent for a different business.
No hidden opt-out: Do not require login, extra personal data, or a multi-step path to unsubscribe.
No cold restart: Do not send full volume from a dormant domain without authentication and warming.
If I were receiving the email and had no idea the company was bought, I would expect the sender to explain the data source plainly. A vague footer line is not enough when the sender has changed.
Views from the trenches
Best practices
Send a transition notice before marketing, then process new opt-outs before import.
Keep the first campaigns close to the acquired brand and original subscriber purpose.
Transfer suppression files, preference records, consent source, and privacy notice versions.
Common pitfalls
Treating an asset purchase like a list rental creates consent and complaint risk.
Letting the new owner send silently makes recipients question how their data moved.
Restarting a dormant domain at full volume can damage sender reputation quickly.
Expert tips
Use the old brand first where possible, then phase in the buyer after subscribers know.
Run a legitimate interest assessment when relying on that basis for EU or UK contacts.
Keep unsubscribed addresses suppressed fully even if the active list changes systems.
Expert from Email Geeks says a buyer often receives customer goodwill and permission with the company, but the old brand and original customer relationship matter.
2023-09-08 - Email Geeks
Marketer from Email Geeks says the old list owner should notify subscribers before transfer, process opt-outs, and let the new owner send a reminder later.
2023-09-14 - Email Geeks
My practical take
A company acquisition can carry email marketing permission, but only when the buyer also carries the duties that came with it. That means transparent notice, consistent purpose, working unsubscribe, suppression continuity, and a technical restart that does not surprise mailbox providers.
The strongest operational path is simple: prove the data was part of the deal, remove opt-outs, send a plain transition notice, keep early content close to the original brand, and monitor authentication and complaints daily. If any of those pieces are missing, I slow down and re-consent the audience rather than betting the domain's reputation on a legal theory.
