It's not expressly illegal to buy an email list. However, GDPR laws prohibit you from sending marketing/ promotional emails to people who have not given you consent.

When you buy an email list, you're spamming people with junk email. If people on your email lists did not sign up for promotional emails from you, they would mark your messages as spam.

Most reputable email marketing service providers prohibit users from sending emails to bought lists. This is because bought lists are often composed of invalid and fake email addresses, leading to email deliverability problems.

Most businesses that advertise their lists on sale have low-quality lists with invalid or fake email addresses, making it difficult to reach out to the target audience.

The people on your purchased email list don't know you, and they're not interested in your product.

When you buy an email list, you're not the only one using it. Other people are also using the same list and sending unsolicited emails.