If you haven't ensured people have signed up themselves and using dual opt-in then the list is pretty much useless and should not be used. Any serious ESP will suspend accounts of customers sending mails to purchased lists.
In that, I focus on what you might call ethics. But as for the legality aspect:
Through most of the civilised world (at a minimum, those that I know of definitely: AU, NZ, all EU, UK, CA), sending unsolicited commercial messages at all is illegal, with very little in the way of exception or subtlety. The USA’s CAN-SPAM Act is the outlier, unusually permissive, by being largely opt-out rather than opt-in like everyone else. (And frankly it’s not at all uncommon for the USA to be an outlier in a bad way among first-world countries.)
And taking the legality aspects further, it’s common for people to ignore restrictive laws that aren’t being particularly seriously enforced, and spam legislation is often like that around the globe. Just because lots of people are doing it doesn’t even mean it’s legal.
For example, the ICO (UK) has the following to say:
You must be very careful before using bought-in lists for recorded calls, texts or emails. You can only use them if all the people on the list specifically consented to receive that type of message from you. Generic consent covering any third party will not be enough.[1]
[1] https://ico.org.uk/for-organisations/guide-to-pecr/electroni...
> The simplest definition of spam is unsolicited email.
It's not just Europe that you'll get called on this.
However most ESPs won't block you unless it has an impact on them, they're getting paid per email sent, spam or not.
If you use a purchased list and end up getting a bunch of spam complaints, and you tell your ESP you bought the list, then I promise you they won't be very happy.