Your email address usually lands in data broker files without you ever handing it to a data broker. The Federal Trade Commission’s 2014 study of nine large brokers found that data brokers “do not obtain this data directly from consumers,” and that most of what they hold comes from other brokers rather than from an original source[1]. Your email travels the same routes as the rest of your profile: companies you did business with, public records, and brokers trading lists with each other.
Where Brokers Get Your Email
- Companies you buy from or sign up with. Retailers, newsletters, apps, and free services collect your email at checkout or registration. Some share or sell customer data to marketing partners, which is usually disclosed only deep in a privacy policy. The FTC also describes the trade running the other way: businesses can buy their own customers’ email addresses from data brokers so they can send them email solicitations[1].
- Other data brokers. This is the biggest pipe and the hardest to see. Seven of the nine brokers in the FTC study provided data to each other, and the agency concluded it would be “virtually impossible” for a consumer to work out how a given broker obtained their data[1].
- Public and semi-public records. Some professional license lookups, business filings, and court documents list an email as contact information. Anything you post publicly on a social profile, personal website, or forum can be collected too; one broker in the FTC study analyzed content from over sixty social media sites, news sources, homepages, and blogs to build consumer profiles[1].
Data Append: The Source Most People Miss
You do not have to have leaked your email anywhere for a broker to connect it to you. The FTC describes “data append” products in which a broker’s client supplies a customer’s name and mailing address, and the broker fills in that customer’s email address or phone number from its own files. The match also runs in reverse: start from an email address and the broker returns a name and postal address[1]. Because your name and address are often already public through property records or voter rolls, a broker only needs one past link between that name and your inbox to keep attaching it to new lists. In one of the report’s worked examples, a broker appends email addresses to a retailer’s customer list so it can match those customers against another website’s registered users[1].
Scale is what makes this hard to escape. The FTC report describes one of the brokers it studied, Rapleaf, as having at least one data point associated with over 80 percent of all U.S. consumer email addresses, and as supplementing email lists with each address owner’s age, gender, marital status, and thirty other data points[1]. Those figures are from 2014 and describe one company, but the business model has not gone away. Brokers also sell fraud-screening products that report whether an email address has existed for a period of time or has a history of transactions behind it[1], which gives them a commercial reason to keep old addresses on file long after you stop using them.
Data Breaches Are a Separate Problem
A breach is a different exposure path from a broker listing, and the two get confused. When a company you once signed up with is breached, its user list, often including your email and sometimes a password, can circulate among spammers and fraudsters for years. Have I Been Pwned is a free breach search and notification service: enter an email address and it lists the known breaches that address appears in[2]. That tells you which passwords to change and what phishing to expect. It does not remove anything from a people-search site, and finding your email on a people-search site is not evidence you were breached.
What You Can Actually Control
- Use a separate email for sign-ups and purchases. Keep your primary address for banking, medical, and personal contacts. If a broker matches the sign-up address, it does not expose the inbox that matters.
- Check your breach history. Look up each address you use on Have I Been Pwned[2], change passwords on the affected accounts, and turn on two-factor authentication wherever it is offered.
- Ask a broker where it got your email. If you live in California, the CCPA lets you ask a business to disclose the categories of personal information it holds about you and “the categories of sources” it collected them from, up to twice a year, free of charge[3]. A source category will not name the exact company, but it tells you whether the address came from public records, a marketing partner, or another broker.
- Opt out of the people-search sites that list your email. This is the only step that removes an existing listing. Work through our opt-out checklist. Expect some friction: California’s Attorney General notes that the right to delete comes with many exceptions that let businesses keep some information[3].
- Turn on Global Privacy Control in your browser. California’s Attorney General describes GPC as a “stop selling or sharing my data” switch that covered businesses must honor as a valid opt-out request[3]. It limits future sales by the sites you visit; it does not reach brokers that already have your address. See our guide to GPC.
The Bottom Line
Your email is rarely exposed in one dramatic event. It is assembled the same way the rest of your broker profile is: from companies you did business with, public records, append services that match an already-public name and address to a known email, and brokers selling to each other. Compartmentalizing which email you use where limits future exposure; opting out directly is what removes what is already listed.
Sources
- Federal Trade Commission. Data Brokers: A Call for Transparency and Accountability (May 2014). Study of nine data brokers: executive-summary findings that brokers do not obtain data directly from consumers, obtain most of it from other brokers, and that seven of the nine provide data to each other; the data append marketing products and worked example; the Rapleaf and PeekYou profiles; and the fraud-detection product that checks an email address’s age and transaction history. ftc.gov
- Have I Been Pwned. Free data breach search and notification service; checks whether an email address appears in a known data breach. haveibeenpwned.com
- State of California Department of Justice, Office of the Attorney General. California Consumer Privacy Act (CCPA). Describes the right to know, including the categories of sources a business collected personal information from, up to twice a year free of charge; the right to delete and its exceptions; the right to opt out of sale or sharing; and the Global Privacy Control signal covered businesses must honor. oag.ca.gov
