Northbeam Software: A Purchased List Is Damaging a Deliverable House File
Northbeam Software sells $4,800 annual subscriptions to mid-market finance teams. Its three-person marketing team bought a list of 12,000 finance-director contacts from a data broker for $3,500 to supplement a house list of 9,000 opted-in subscribers. The first send to the purchased list, promoting a webinar, produced an 18% hard bounce, a 0.4% spam-complaint rate (48 complaints), and a 0.6% click rate. The house list typically sees a 0.3% bounce, 0.02% complaint, and 2.4% click rate. Within a week, the sending domain began landing in spam folders for some house-list recipients, and Google Postmaster Tools shows a reputation drop. The CMO wants to send the second email in the sequence to the purchased list because we already paid for it. Roughly 2,100 of the purchased contacts have European Union email domains or country codes.
1. Diagnose the list-quality problem using the metrics, and explain why it threatens the house list.
Read the worked answer
The purchased file is not a marketing asset; it is a reputation liability. An 18% hard bounce against 0.3% on the house list means roughly 2,160 addresses were invalid, stale, scraped, or synthetically generated. A 0.4% complaint rate is twenty times the house rate and well above the informal 0.1% danger line at which mailbox providers throttle or block; 48 complaints from 12,000 sends is enough to trip content filtering. A 0.6% click rate against 2.4% confirms that even the delivered portion is disengaged.
The domain-level reputation drop is the real damage. Engagement signals pool across both lists, so junk recipients are degrading deliverability for the 9,000 opted-in subscribers who actually generate pipeline. For a business with a $4,800 annual contract value, that pipeline loss dwarfs the $3,500 purchase price.
The CMO's argument is a sunk-cost fallacy. The money is spent either way; the marginal cost of continuing is now measured in house-list deliverability and in future pipeline, not in the broker invoice.
2. Assess the legal exposure separately for the U.S. and EU contacts.
Read the worked answer
Liability sits with Northbeam as sender, not with the broker. For U.S. contacts, CAN-SPAM does not prohibit purchased lists, but it requires accurate routing and header information, a non-deceptive subject line, a functioning opt-out honored within 10 business days, and a valid physical postal address in every message. Penalties are assessed per message, so roughly 9,900 sends represent 9,900 exposures. The absence of affirmative consent is not itself a CAN-SPAM violation, but it is precisely why the complaint rate is high.
For the roughly 2,100 EU contacts the analysis changes. GDPR and the ePrivacy Directive require a lawful basis for electronic marketing; third-party purchased lists almost never carry valid consent, and legitimate interest is difficult to sustain for cold email to individuals. The broker's assurance that the list is GDPR-compliant is not a defense, because Northbeam must be able to show its own basis and must be able to operate data-subject access and erasure requests. Those contacts must be suppressed immediately regardless of what happens to the rest of the file.
Practical rule: the U.S. segment is legally permissible but commercially toxic; the EU segment is both.
3. Recommend a remediation plan, including what to do with the remaining purchased addresses.
Read the worked answer
Sequence matters more than any single step.
First, halt the sequence now; email two does not send. Second, segment hard: permanently suppress the 2,100 EU contacts and all hard bounces. Third, move any future prospecting to a separate subdomain with its own sending IP so reputational damage is contained and the primary domain keeps serving the house file.
Fourth, attempt a single plain-text re-permission message to the remaining U.S. addresses, stating that the address came from an acquired list and asking for confirmation to receive webinar invitations. Treat anything unconfirmed within 14 days as dead. Expect 5-15% confirmation; on roughly 7,700 remaining that is perhaps 400 to 1,100 salvageable contacts, worth far less than the deliverability being risked.
Fifth, replace this acquisition approach with first-party consent sources: content downloads, partner co-marketing where the partner sends, and webinar registration. Sixth, return to the broker with the bounce and complaint data and demand a refund and a provenance audit; an 18% hard bounce is a strong contractual argument. Put the recommendation to the CMO in writing with the Postmaster Tools evidence attached.