Can consent be transferred or inherited (e.g., list purchase)?

Under GDPR and CASL, consent is not transferable. When a subscriber opts in to Company A's newsletter, that consent doesn't authorize Company B to email them-even if Company B purchases Company A's list. The consent was specific to the original sender; a different sender requires new consent from each individual.

Purchased lists violate this principle fundamentally. The people on that list never agreed to hear from you specifically; their relationship was with whoever originally collected their address. Emailing them without consent violates GDPR (potentially triggering massive fines), destroys deliverability (spam complaints spike immediately), and damages brand reputation (you're the unwanted stranger in their inbox).

Corporate acquisitions create legitimate questions: if Company A acquires Company B, what happens to B's subscriber consent? Generally, notification and re-consent campaigns are recommended. At minimum, inform subscribers that their data has transferred to new ownership and give them easy exit options. Some regulators require explicit re-consent for the new entity. There's no legitimate shortcut to building an email list-purchased lists and inherited consent both create legal exposure and deliverability disasters.