Buying consumer email data in 2026 looks nothing like buying it in 2018. Sender-authentication tightening at Google and Yahoo, tenant-level reputation scoring at Microsoft, and receiving-side behavioral filters have raised the cost of a bad send materially. The data itself has split into two procurement shapes — single-match and multi-match — and the buyer who does not understand the difference between them buys the wrong file and watches their sender reputation evaporate. GSDSI's core email file publishes both shapes at scale (314M single-match, 585M multi-match records); this piece explains when each belongs in the mix.
A single-match email record pairs one verified email address with one confirmed consumer identity — usually HEM-plus-name-plus-postal, with a recency timestamp on both the email verification and the identity anchor. The email has been SMTP-validated (the address accepts mail at the domain level), the identity behind it has been resolved against a primary identity source, and the record carries a consent pedigree the buyer can document. Single-match is the file buyers run for primary outreach: welcome flows, transactional overlays, and the paid bulk sends that a warmed domain can actually deliver.
The operational anchor is verification recency. A single-match record verified 18 months ago and not re-checked is, in 2026, functionally a guess. The best-in-category files re-verify on a rolling 60–120 day cadence; anything beyond 180 days without re-verification belongs in a different bucket. The FTC's CAN-SPAM compliance guide frames the regulatory floor; Google's bulk-sender guidelines and Microsoft's sender-reputation best practices frame the operational one.
A multi-match email record pairs a single consumer identity with the list of email addresses that identity has been associated with over time — current, prior work, prior personal, lapsed and reactivated. The file is larger per identity (typical 1.8–2.2x the single-match count), but the use pattern is not bulk send. Multi-match is a waterfall-append tool: for reactivation campaigns, for when a primary address bounces or marks spam, for bridging a known identity to the current deliverable address without restarting acquisition. Using multi-match as a bulk-send source is the specific error that breaks sender reputation — addresses in the multi-match set are, by construction, historical and therefore overrepresented in the 'no longer monitored' cohort.
Email procurement arguments in 2024–2026 have converged on one point: the quality of the data matters because the cost of sending to bad data is no longer linear. A 5% bounce rate on a warmed tenant is not 5% wasted send; it is a reputation event that depresses inbox placement across every campaign for the following weeks. Sender-reputation scoring at Microsoft 365, Gmail, and the enterprise inbound filters now penalizes the whole tenant for the worst-performing domain in that tenant. The operational rules that follow:
Advertisers' general counsel offices have tightened the consent bar on email acquisition. The buyer asking 'where did this list come from' in 2026 is asking about documented opt-in provenance, not just opt-out compliance. The FTC's privacy enforcement record and state-level privacy laws (California, Colorado, Virginia, Connecticut, Texas) have made consent documentation a compliance artifact the buyer needs to retain, not just trust. Data providers who cannot produce the consent chain from end consumer to end buyer are increasingly the ones getting dropped in annual vendor review. A companion piece on what privacy-safe actually means when buying location data applies the same framework to the location-data side.
The decision rule: use single-match for any flow that will actually send to the address. Use multi-match to append into an existing first-party file, to rescue a bouncing record, or to reactivate a dormant account with a known identity. Never buy multi-match intending to run it as a bulk-send list — that is the single most reliable way to burn a warmed tenant in 2026. The B2C data solutions on GSDSI's catalog frame where single-match and multi-match fit into the larger audience-targeting and acquisition stack.