Find Out Who Sold or Leaked Your Email Address in 5 Steps

You can find out who sold or leaked your email address with confidence only if you gave that company an address nobody else had. On a main address you’ve used for years, you can usually narrow the field but not name a culprit: it sits in dozens of customer databases, and a spam message rarely points back to the one that let it go. What you can find out is who is mailing you and through which service, whether a company leaked your address in a known breach, and, in the EU and UK, what a company says about where it got your address. CatchNone, for iPhone, iPad, and Mac, makes that address-per-company setup the default: each message is badged with the alias it reached, so the next leak points to its source.

The steps, in order:

1. Find the first unwanted message and the exact address it reached.
2. Read its headers to identify the sender and its mailing service.
3. Check Have I Been Pwned for a breach that included the address.
4. Ask the sender where it got your address, and ask the company you suspect which companies it gave your address to.
5. From now on, give every company its own address.

Can you find out who sold your email address?

Sometimes. It depends on the evidence:

• Headers show who sent a message and through which service (a passing DKIM signature proves which domain signed it), not where the list came from.
• A breach record proves one company lost your address, without ruling out others.
• A legal request can make a company say what it knows about the source, if it knows (in California, only as categories).
• A random address you gave one company only points straight at a source: mail from anyone else on it means it left that company, whether sold, shared, or stolen.

A sudden flood of spam can have other causes; see why spam can surge all of a sudden. For how addresses spread in the first place, through sales, breaches, harvesting, and guessing, see how spammers get email addresses.

Step 1: Find the first message and the address it reached

Search for the unfamiliar sender and find the oldest result: the first message is the closest to the moment your address changed hands. Check exactly what it was sent to and how it greets you. An old address or a typo you used once, a +tag version of your address, a misspelling of your name from one signup form, or a detail only one company knew all point to a source.

In the EU and UK, also read that first message’s footer and privacy link. Under the GDPR (Art. 14), a company that got your data from someone else must tell you “from which source the personal data originate”. If it uses the data to contact you, the deadline is “at the latest at the time of the first communication”. If the first message didn’t say, point that out in your Step 4 request.

Step 2: Read the headers

Headers are the hidden lines above a message. They name the sender and the service that carried the mail, which tells you whom to write to in Step 4.

How to see the headers

Paths from each vendor’s help pages, as of September 2026:

Gmail’s shortcut: on the web, click the Down arrow below the sender’s name to see Mailed by and Signed by, the domains that sent and signed the message.

A worked example

An illustrative, trimmed header set. Your address is k7qm-2xrd@example.com, a random address you gave only to a garden shop. The brand is dealsdaily.example.net, and mailer.example.org is the mailing service it uses.

Delivered-To: k7qm-2xrd@example.com
Received: from out-7.mailer.example.org (out-7.mailer.example.org [192.0.2.25])
        by mx.example.com; Thu, 24 Sep 2026 09:14:02 +0000
Return-Path: <bounce-7f3a@mailer.example.org>
Authentication-Results: mx.example.com; dkim=pass header.d=mailer.example.org
DKIM-Signature: v=1; a=rsa-sha256; d=mailer.example.org; s=s1; ...
From: Deals Daily <news@dealsdaily.example.net>
To: k7qm-2xrd@example.com
List-Id: Weekly offers <weekly.dealsdaily.example.net>
List-Unsubscribe: <https://unsub.mailer.example.org/u/abc123>

Here the sender is Deals Daily, sending through mailer.example.org, and the address it reached is the random one you gave only to the garden shop, so that’s where it left. The headers can’t say how Deals Daily got it: they name the sender, never the seller. ICANN Lookup shows an unfamiliar domain’s registration record, though owner details are mostly redacted.

Step 3: Check whether a company leaked it in a breach

Have I Been Pwned (HIBP) shows which breaches and spam lists include an address. As of September 25, 2026, it lists 1,038 breached websites and more than 17.8 billion breached accounts (an address in several breaches is counted once for each).

• A breach names the service that lost the data and when: a strong lead if the spam started soon after.
• A spam list means your address turned up in data used for targeted spam. These lists “are often aggregated from multiple sources”, so they rarely name the original company. Entries from pastes, and breaches HIBP flags as fabricated or unverified, are weaker still.
• Sensitive breaches show only after you sign in and verify that you receive mail at the address.

A clean result means only that the address isn’t in a breach HIBP has loaded, not that nobody sold it. Turn on the free Notify Me alerts. If you use per-company addresses on your own domain, Domain Search shows which of them appear in which breach, after you verify the domain (larger domains normally need a subscription). Google’s dark web report, recommended in older guides, was discontinued in early 2026.

Step 4: Ask the companies directly

EU and UK: ask where it came from, and where it went

The right of access lets you ask two companies two questions:

• Ask the sender where it got your address. GDPR Article 15(1)(g) gives you “any available information as to their source”, and transparency guidelines endorsed by the European Data Protection Board say a company that got your data elsewhere should name the specific source unless it can’t.
• Ask the company you suspect which companies it gave your address to. Under Article 15(1)(c), the EU Court of Justice ruled in Österreichische Post (C-154/21) that a company must name the actual recipients on request, unless it can’t yet identify them or the request is manifestly unfounded or excessive. The UK’s data protection regulator, the ICO, says the same under UK GDPR.

Neither request forces anyone to name a seller: a company can say it doesn’t know, or that the data came from several sources (Recital 61), though an evasive answer is grounds for a complaint. Use the contact details in each company’s privacy notice, and skip outright spammers, since replying confirms your address works.

Here is a request you can copy (leave out item 4 when you write to the company you suspect):

Subject: Access request under Article 15 GDPR

Under Article 15 of the GDPR (or UK GDPR), for my email address, you@example.com, please tell me:

1. Where you obtained it, naming the specific source (Art. 15(1)(g)).
2. Which recipients you disclosed it to, by name (Art. 15(1)(c)).
3. What personal data you hold about me, with a copy.
4. Why your first message to me, on [date], did not name that source (Art. 14(2)(f) and 14(3)(b)).

I also object to direct marketing (Art. 21). Please reply within one month (Art. 12(3)).

[Your name]

Answers are usually free (deadlines are in the table below). Once you object to direct marketing, your data can no longer be used for it.

If the answer is missing or evasive in the UK, complain to the company first: for complaints made since June 19, 2026, the Data (Use and Access) Act requires it to acknowledge yours within 30 days. Then, within three months of your last meaningful contact with the company, complain to the ICO. In the EU, Article 77 lets you complain to a data protection authority.

United States: California and Oregon

A California CCPA “right to know” request returns the categories of sources and of third parties, plus the personal information held, but won’t name who sold your address. Answers are free. You can also tell a business to stop selling or sharing your data, or ask it to delete what it collected from you. The law covers only businesses above set thresholds, such as annual revenue over $26,625,000 (as of September 2026).

If you live in Oregon, a company covered by its privacy law must, on request, give a list of specific third parties it disclosed data to, though it may list those that received any personal data rather than yours (ORS 646A.574). These rights come from state law, so what you can ask for depends on where you live.

California residents can also use DROP, the Delete Request and Opt-out Platform, to send one deletion request to every registered data broker. It opened on January 1, 2026, and since August 1, 2026, brokers must process requests at least every 45 days. It reaches only data brokers, businesses you have no direct relationship with, not the shop you gave your address to.

Anyone can search the data broker registries of California, Vermont, Texas, and Oregon. Search them for the sender’s company name and the domains from Step 2. A match tells you the sender is a registered data broker, one of the businesses DROP reaches if you live in California.

What each request can get you

Anywhere: the mailing service

The mailing service named in DKIM-Signature d=, Return-Path, or List-Unsubscribe has its own rules. Mailchimp’s Acceptable Use Policy, for example, bans sending to “purchased, rented, third-party, co-reg, publicly available data, or partner lists of any kind”, and its abuse desk asks for “the full email header” (both checked September 25, 2026). Send the service’s abuse desk the full headers. It won’t tell you who sold your address, but it can stop the sender from using its service.

What to do once you know

• Retire the address. Give the company that leaked it a new address, or close the account, then turn off or delete the old one. Keep it working until any access request is answered, since the reply or an identity check may come to it. If it’s your main address, use filters.
• Make it stop. Send the Article 21 objection (EU, UK), unsubscribe from legitimate US senders, or opt out of sale and sharing and use DROP (California). If unsubscribing has failed before, read why unsubscribe doesn’t work.
• Report it at ReportFraud.ftc.gov in the US, with the ICO’s spam email tool in the UK (it doesn’t reply individually), or to the mailing service’s abuse desk, and mark it as spam in your mail app.
• If it was a breach, secure the account too (see the FAQ).

Do companies sell your email address, and is it legal?

Yes, some do. The FTC says: “When you give a company your email address, it might share or sell it to third parties.” In the US, federal law allows it until you opt out. In the UK and EU, a company needs your consent to email you from a bought list, and in the UK it generally needs your consent to sell one.

• United States: under federal CAN-SPAM, a company needs no consent to send you marketing email. Once you opt out, it has 10 business days to stop, and it can’t sell or transfer your address. California adds an opt-out of sale, and its “sell” includes renting or making data available for “other valuable consideration”, so a swap with a partner can count with no money involved. “Sharing” is a separate term, for cross-context behavioral advertising.
• UK: under the Privacy and Electronic Communications Regulations (PECR), a company can email people on a bought list only if they “specifically consented to receive that type of message” from it; generic consent to any third party isn’t enough, and selling a list generally needs the consent of the people on it (ICO guidance, under review after the Data (Use and Access) Act). Different rules apply to addresses at companies.
• EU: the ePrivacy Directive allows marketing email only with “prior consent”, apart from a seller marketing similar products to its own customers, an exception a list buyer can’t use.

Why the plus trick is weak evidence

The “Gmail trick” is to sign up with a tagged address, such as you+shopname@example.com for you@example.com, and watch which tag turns up in spam. Google’s own description shows the weakness: “Messages sent to your current address or any variation with the plus sign, all arrive in your current inbox.”

• Your real address is in plain sight. Delete the tag and mail still reaches you, and the evidence is gone.
• The tag means nothing to the sender. Only your provider interprets the part before the @ (RFC 5321, §2.3.11), and the separator varies by system (RFC 5233).
• It proves less than it seems. A tagged address in spam shows it left that company, not whether it was sold, shared, or breached. And if no tagged spam arrives, that clears no one: the tag may simply have been removed.

The dot trick, signing up as your.name for one company and yo.urname for another, is weaker still: Gmail ignores dots in personal addresses, so anyone can remove them (on work or school accounts, dots do count). Plus addressing is still good for filtering; the plus addressing guide covers where it works.

Step 5: Make the next leak name itself

The reliable method works forward: give each company its own address that doesn’t contain your real one. Mail from anyone else at the address you gave one shop tells you where it left, and you can turn off that address alone.

• CatchNone gives each company its own alias and badges every message with the alias it reached, so a sold address shows up without reading headers. @catchnone.com addresses need Premium; a domain you own works on the Free plan too.
• Alias services such as Apple’s Hide My Email (with iCloud+), DuckDuckGo Email Protection, SimpleLogin, addy.io, and Firefox Relay forward to your inbox. Email alias services compared covers the differences.
• A catch-all on your own domain accepts mail for any address there, so you can invent one per signup. Cloudflare Email Routing, for example, is available on free and paid plans (as of September 2026) and has a catch-all rule. See what a catch-all email address is for the trade-offs.

Prefer random addresses to guessable ones like gardenshop@example.com, which a spammer could invent on a catch-all, and note which address went where.

CatchNone: every message shows the address it reached

CatchNone is built for Step 5. You give each shop, newsletter, or account its own alias, and every message in the app is badged with the alias it reached. When a stranger mails the address you gave only the garden shop, the badge shows where it left, with no headers to read. Activity points out mail on an alias you’ve marked as not in use and first-time senders, and you can switch a leaked @catchnone.com address off, so senders get a bounce while your other aliases keep working.

With Premium you get random @catchnone.com addresses such as abcde-12345@catchnone.com, with no domain, DNS, or mailbox to set up, and even Bcc’d mail is attributed. Or use a domain you own whose mail your provider already delivers to an inbox: the app reads that mailbox read-only, over IMAP or JMAP, directly from your device, with up to 10 aliases on the Free plan and no limit on Lite and Premium. CatchNone is available for iPhone, iPad, and Mac.

It works forward, not backwards on addresses you used before, and it has no breach database or leak detection: the badges and Activity’s notes are evidence for you to weigh. On your own domain it reads only the inbox, and only mail whose To, Cc, or Bcc names an address on your domain, so spam filed as Junk won’t appear. Marking an alias there as not in use only labels it, so block a leaked address at your provider. @catchnone.com messages are deleted 30 days after they arrive, so flag any you need as evidence to keep the full text on your device.

FAQ

What should I do if a company leaked my email address?

Look the address up on Have I Been Pwned to see which breach it was in and what else leaked with it. Change that site’s password and every place you reused it, and turn on two-step verification. Expect phishing that quotes the leaked details, and don’t follow links in messages that mention the breach. If you gave that company an address of its own, retire it and give the company a new one.

Does LinkedIn or Google sell my email address?

Neither says it sells your personal information, but LinkedIn says it shares it for cross-context advertising. Its California privacy disclosure says “We Do Not Sell Your Personal Information” and lets Californians opt out of that sharing. Google’s Safety Center says “We never sell your personal information to anyone”, and its privacy policy (effective May 26, 2026) says it shares personal information outside Google only in listed cases, the first being with your consent. All three pages were checked on September 25, 2026. For other companies, read the policy and treat “sell” and “share” separately.

Who buys email addresses?

Data brokers, list brokers, and marketers; the state registries above list registered brokers. The trade can be open: in the Österreichische Post case, Austria’s postal operator said it offers personal data “to trading partners for marketing purposes”, and later listed recipients including “mailing list providers”. That case was about data held by a postal operator, not email addresses.