You almost certainly did sign up — just not in a way you'd remember. Competitions, wifi portals, receipt-by-email at checkout, gated downloads and pre-ticked "partner offers" boxes all create subscriptions. The rest arrive because a publisher was acquired, or because a company you dealt with sold its list. Unsubscribe from the ones you recognise, report the ones you don't, and give future signups their own address so the next one identifies itself.
The five routes onto a newsletter list
- A pre-ticked box. Still common outside the EU. You consented, technically, by not un-ticking it.
- A competition or giveaway. The prize is real; the list-building is the point. Entry terms usually disclose sharing with "partners".
- A gated download. The report or discount code was the cost of acquiring you.
- An acquisition. Customer lists are assets. You subscribed to a small publisher in 2019; a marketing group bought them in 2024; you're now on their list and, from their side, legitimately.
- A sale or share. The FTC puts it plainly: giving a company your address means "it might share or sell it to third parties." Source: FTC. Checked: 2026-08-19.
How to work out which
The mail itself carries some signal:
| What you notice | Likely route |
|---|---|
| They have your correct full name | A form you filled in, or a breach — not a bought bulk list |
| The footer names a parent company you don't recognise | An acquisition |
| Content matches something you bought once | That retailer, or one of its sharing partners |
| Address only, no personalisation | A bulk list |
| It references a competition or prize draw | You entered something |
If you use one address for everything, that's as far as inference goes. The full diagnosis.
What to do
- Recognise the sender? Unsubscribe. They're legally required to honour it, and afterwards they may not sell your address on.
- Never heard of them? Don't click. Mark as spam. For an operator ignoring the law, the unsubscribe link is a liveness check.
- Ignored your opt-out? Report it at ReportFraud.ftc.gov. The escalation path.
Stopping the next one
Everything above is cleanup. The preventive move is a different address per publisher.
Do that and the question stops being a mystery: a newsletter arriving at gardencentre@yourdomain.com from a company that isn't the garden centre tells you exactly who passed you on. You disable that one address and the mail stops, without unsubscribing from anything or asking anyone's permission.
It also makes the newsletters you do want manageable — each on its own address, each individually revocable. A newsletter setup that works.