Email privacy has two halves, and almost all the attention goes to the wrong one. The first is message privacy — whether the contents can be read in transit or at rest, which encryption addresses. The second is address privacy — who holds your address, what they do with it, and whether you can revoke it. For most people the second is the live problem, and encryption does nothing for it.
Why the address is the problem
Consider what one address accumulates over fifteen years. Several hundred organisations hold it. Some sold it. Some were breached. Some were acquired by companies with different marketing ideas. Some published it somewhere a crawler found it.
None of that is affected by whether the messages were encrypted. The exposure happened because the address itself is a durable, unique, portable identifier — which is exactly what makes it useful to you and equally useful to anyone assembling a profile.
Your address is, in practice, a permanent username you hand to strangers and can never rotate. That's the actual privacy problem.
What "private email" usually means, and why it's not enough
| What it protects | What it doesn't |
|---|---|
| Encrypted providers — message contents from the provider and from interception | Who has your address, or what they do with it |
| Spam filters — your attention, by sorting mail | The number of parties holding your address |
| VPNs — your network traffic and IP | Nothing about email. Your address is in the message, not the connection |
| Tracker blocking — whether senders learn you opened it | Whether they can reach you at all |
| Data removal — records already held by brokers | What you hand over at the next signup |
| Per-service addresses — who can reach you, and attribution | Message contents; anything already leaked |
Each row is useful. None is a complete answer, and anything sold as one is overselling.
The five ways an address escapes
- Voluntary disclosure that gets shared onward. The largest category, and mostly lawful. The FTC's consumer guidance states it directly: "When you give a company your email address, it might share or sell it to third parties." Source: FTC. Checked: 2026-08-19.
- Breaches. Out of your control, discovered late, and permanent once the data circulates.
- Scraping. Anything published in plain text is collected automatically.
- Aggregation. Brokers combine sources and resell. Email is their preferred join key because it's stable and unique — see how data brokers get your email address.
- Guessing. Predictable addresses at large providers get hit without any leak occurring.
What you can actually control
Being precise about this matters, because the difference between "controllable" and "not" determines where effort is worth spending.
You control
- Which address you give to each organisation, from now on.
- Whether that address keeps working.
- Whether your address is published anywhere public.
- Whether your domain registration publishes your name and postal address — use WHOIS privacy.
- How much additional data you attach to each signup.
You don't control
- What a company does with an address you already gave it.
- Whether it gets breached.
- Who buys it if the company is sold.
- Whether leaked data ever leaves circulation. It doesn't.
Every practical strategy follows from that split: act decisively on the first list, and treat the second as damage limitation rather than something to solve.
A setup that holds up
- Separate identities by purpose. One address for people who know you. Different addresses for organisations. Never the same one for both.
- One address per organisation. This single habit provides attribution and containment at once. How to run it.
- Keep the filter on. Filtering and address control are complements, not alternatives.
- Check your exposure once. Run your address through a breach service, and search your own name to see what's published. How to interpret the result.
- Deal with published records separately. If your home address is on people-search sites, that's a removal problem, not an email one. Whether you need a service.
- Turn on WHOIS privacy if you register a domain, or you'll have solved one exposure by creating another.
- Use a password manager and unique passwords. The reason a leaked address becomes an account takeover is almost always a reused password.
What no email setup can do
- It can't make you anonymous. You typed your real name and card details into the form next to the address. Aliasing hides your inbox, not your identity — and a domain only you use is itself a consistent identifier.
- It can't retract anything. Data that has circulated cannot be recalled, by you or by any service you pay.
- It can't stop determined targeting. This is a defence against bulk data trading, not against someone specifically interested in you.
- It can't reach non-email data. Your phone number, address and public records are separate problems.
Anyone promising more than this is selling.
Where to start
If you do one thing: stop giving the same address to everything. Everything else here is refinement. The mechanics are in email aliases explained, the wider anti-spam picture is in how to stop spam emails, and the shortest practical list is how to protect your email address.