Six things a lot of people believe, each of which leads to the wrong action: that incognito mode affects email, that a VPN protects it, that unsubscribing is always dangerous, that an encrypted provider solves spam, that deleting an account deletes your data, and that any of this makes you anonymous. Correcting them is mostly about redirecting effort toward the things that work.
Myth 1 — Incognito mode has anything to do with email
Private browsing stops your browser keeping local history and cookies. It doesn't affect what a website records server-side, and it has no bearing whatsoever on an address you type into a signup form.
Sign up in incognito and the company has your address exactly as they would otherwise. The only thing that changed is your own browsing history.
Myth 2 — A VPN protects your email
A VPN encrypts the network connection. Your email address travels inside the message, and the recipient reads it identically either way. It doesn't reduce spam, doesn't affect who holds your address, and doesn't touch data brokers.
A genuinely useful tool for a different job, and one of the most consistently over-sold products in this category. The full explanation
Myth 3 — Never click unsubscribe
The half-truth that costs people the most effort. For a legitimate company, unsubscribing works and is legally required — in the US, honoured within 10 business days, after which they also may not sell or transfer your address. Source: FTC. Checked: 2026-08-19.
The advice is right for one category only: senders you've never dealt with, running campaigns that ignore the law. For them, clicking anything confirms the address is live.
So the rule isn't "never click" — it's "click for companies you recognise, never for ones you don't." Telling them apart
Myth 4 — An encrypted provider solves spam
Encryption protects message contents from interception and from the provider. It does nothing about who has your address or what they do with it.
Move to the most privacy-respecting provider available and hand the new address to three hundred organisations, and you'll receive exactly as much spam as before. The two problems are unrelated: one is about the message, the other about the address. Both halves
Myth 5 — Deleting your account deletes your data
Deleting an account usually removes your ability to log in. What happens to the underlying records depends on the company's retention policy and its legal obligations — and it does nothing at all about data already shared with or sold to third parties.
Deletion is still worth doing; it stops future accumulation. Just don't mistake it for erasure. Why permanent removal isn't available
Myth 6 — Aliases make you anonymous
The one we're most obliged to correct, given what we sell. An alias hides which inbox receives the mail. It does not hide you — you typed your real name into the same form, usually with a delivery address and card details.
A custom domain used by one person is in some respects less anonymous than a shared masking domain, because it's a consistent identifier across every service you use it on. The boundary
What's actually true
Unique passwords and two-factor authentication decide whether a leak is a nuisance or a compromise. A different address per organisation decides whether spam is attributable and revocable. Not publishing your address decides whether it gets harvested. Removal helps with records already published, and doesn't stay done.
Nothing here makes you anonymous, and nothing recalls data in circulation. Anyone promising either is selling something.
More: the checklist, ordered by impact · how to protect your address