How to find out which site sold your email

Spam from companies you have never heard of means your address got out somewhere. If you use one address for everything, you usually cannot prove which site it was. But a few clues often point to it in ten minutes, and one habit makes the answer obvious from now on.

Five clues to check today

1. Look your address up in data breaches

Data breaches are one of the most common ways an address gets out. Have I Been Pwned is a free site that checks your address against known breaches. Type your email and it lists every breach it knows of that included it, with the name of the site and the date. If a shop or app you used shows up just before the spam started, that is your likely source.

2. Read the small print at the bottom

Marketing emails from real companies usually say why you get them, down in the footer. Look for a line like "you are receiving this because you signed up at" or the name of a list. The unsubscribe page often names the company that holds your address, even when the email itself does not.

3. Check who the email was sent to

Look at the To line. If you ever gave a site a tagged address, like yourname+shopname@gmail.com, the tag tells you who passed it on. Gmail delivers anything with a plus sign after your name to you, which is what makes this work. If the To line shows someone else or nobody at all, you were copied in quietly along with many others.

4. Think back to when it started

Spam rarely starts out of nowhere. Think about what you signed up for in the days before: a contest, a free download, a coupon, a new app. Sites that give something away in return for your email are the usual suspects, because collecting addresses is the whole point.

5. Ask the company where it got your address

If you live in the EU or the UK, privacy law (GDPR) lets you ask a company what it holds about you and where it came from, and it has to answer within a month. Reply to one of its emails, or use the contact on its site, and ask where it got your address. Spammers will not answer, but real brands usually do.

Why you often cannot prove it

Your address can get out in more ways than one site selling it. Lists get shared with partners, sold and sold again, leaked in breaches, and copied from public pages where your address appears. Once it is on one list it spreads, and every copy looks the same. That is why the clues above point to a likely source rather than a sure one.

With one address for everything, you can only guess. With one address per site, the spam tells you.

How to know for sure next time

Give every site an address of its own. Each address then goes to one place only, so the first spam that reaches it names the site that let it out.

• With freemail you make a new address in one click, up to 10 on the Free plan. Each one never expires, so the site can still send you a password reset later, and only you can open it.
• With the Gmail plus trick, like yourname+site@gmail.com, you keep using your real inbox. It is free, but it has two gaps: a spammer can cut off the part after the plus, and some sites refuse addresses with a plus sign.

There is a full guide to setting this up in stop spam emails before they start.

Make an inbox for your next signup

What to do once you know

• If the site had a breach, change your password there, and anywhere else you used the same one.
• Unsubscribe from real companies you once signed up with.
• Do not click anything in obvious junk. A click tells the sender that someone reads the address.
• Mark the rest as spam, so your filter learns what to catch.
• If you still want an account on that site, move it to a fresh address of its own.

Common questions

Can I see who sold my email address

Not directly, because spam does not come with a record of who sold the address. A data breach check, the email's footer and the timing usually point to a likely source. Giving each site its own address is the only way to know for sure.

Is it legal to sell my email address

It depends on where you live. In the EU and the UK, a company generally needs your consent to send you marketing email, and you can ask where it got your address. In the US, marketing emails mostly have to include a working way to unsubscribe. Either way, mail from a company you never heard of is a sign your address was passed on.

How do I find out if my email was in a data breach

Search for it on Have I Been Pwned. It is free and lists every known breach that included your address. You can also ask it to email you if your address shows up in a new one.

Will a new email address stop the spam

It stops new spam, as long as each new address goes to one site only. Your old address keeps getting whatever is already on lists. Keep your real address for people and important accounts, and give everything else an address of its own.