Under GDPR, an email address that identifies a person is personal data, and verifying it is processing. Processing needs one of the six lawful bases in Article 6. The basis that let you collect the list normally covers checking it too. Your verifier acts as your processor, so you need a signed data agreement with it. Our GDPR answer lists what to check in a vendor.
The US CAN-SPAM Act of 2003 sets rules for commercial email itself: honest headers and subject lines, a physical postal address and a working opt-out. It places no rule on checking whether an address exists. A valid result doesn't excuse a message from any of those rules either.
Canada's anti-spam law, in force since July 2014, is stricter about sending. You need consent, express or implied, before a sales email goes to a Canadian address. A verified address with no consent behind it is still off limits under CASL.
Discovery is where verification crosses a line. Guessing addresses from name patterns, then keeping the ones that answer 250, builds a list nobody gave you. ZapBounce's acceptable use policy forbids that. Every customer vouches for a lawful basis for each address, bought lists included.
Your verifier's own handling matters too. ZapBounce keeps uploads and results for 30 days by default. You can set the window per API key from 0 to 90 days. We never sell your addresses, add them to a shared database or contact anyone on your list. Our data processing terms name every sub-processor.
Related questions
Is it legal to verify a purchased email list?
Checking a list is processing, so you need a lawful basis to hold it at all. ZapBounce asks every customer to vouch for that basis, bought lists included. Mailing the list is a separate question under CAN-SPAM, CASL and GDPR.
Does CAN-SPAM allow email verification?
Yes. CAN-SPAM sets rules for the content and opt-out of sales email. It sets no rule on checking whether an address exists. Every message you send later still needs honest headers, a postal address and a working opt-out.
Does an email verification check contact the person under CASL?
No message reaches the person, because the SMTP check ends before the DATA step. CASL's consent rules apply to the sales email you send after that.
Is email list cleaning a legitimate practice?
Yes, and mailbox providers expect it. Amazon SES recommends keeping bounces under 2%, and Gmail asks senders to keep reported spam below 0.3%. Removing dead addresses is how senders stay inside those limits.