Stores Asking for Email? What to Give Them Instead

Stores asking for your email at checkout usually say it’s for the receipt. The same address can also put you on their marketing list, link your card to a customer profile, and let ad platforms and data brokers connect it to the rest of your details. At the register, the email is for the receipt and the marketing, not the payment, so you can usually decline and take a paper receipt. Online, you need an address for the order, so give that store a separate address of its own: one you can cut off without touching your other mail, and can still read when a warranty claim comes up years later. CatchNone gives each store its own address and badges every message with the alias it reached, so you can see which store shared yours, on iPhone, iPad, and Mac.

Laws and steps below were checked on September 25, 2026. This is general information, not legal advice.

Why stores ask for your email and phone number

The receipt is the reason you hear at the register. It’s rarely the only use:

• Receipts and order updates. Online, the store needs a contact. In the EU, the seller must confirm the contract “on a durable medium” (Consumer Rights Directive, Article 8(7)), usually by email.
• Linking your card to you. The payment company Square says: “Your email address or phone number is attached to your payment card.” After one e-receipt, paying with that card at other Square sellers sends receipts to the same address automatically (Square), and Square shares your “masked” contact details with those sellers so they can send receipts and, unless you opt out, marketing (Square).
• Marketing. Target’s privacy policy (updated August 15, 2026) lists “in-store receipt messages” among its marketing channels and says “We merge data collected from multiple sources” (Target).
• Loyalty programs. Points and member prices are paid for with your details. California’s Attorney General found retail loyalty programs offering discounts “for the collection of consumers’ personal information” without the notice state law requires (California AG).
• Ads. Stores can upload customers’ email addresses and phone numbers to Google’s Customer Match, which “will target ads to those customers and other customers like them” (Google Ads Help).

What happens to your address after you give it

It goes into a customer file, and from there it can travel. The FTC warns that a company “might share or sell it to third parties” (FTC). It has also documented “data append” products: a company gives a data broker a customer’s phone number or email address, “and the data broker could provide the customer’s name and address” (FTC report, 2014, p. 24).

Opening marketing emails can spread it further. A 2018 Princeton study found that about 30% of mailing-list emails “leak the recipient’s email address to one or more of these third parties when they are viewed” (PoPETs). To stop that, see how to block email tracking pixels. And the customer file can be breached.

Stores asking for your email: do you have to give it?

Usually not. At the register, you can ask for a paper receipt instead. Online, the store needs an address for the order, but it doesn’t have to be your main one. What changes from place to place is what a store may send you afterward and, in California, whether it may ask at all when you pay by credit card.

California’s credit card rule

The law names “the cardholder’s address and telephone number,” and the California Supreme Court held in 2011 that a ZIP code counts too, because with your name it can be used to find your full address (Pineda v. Williams-Sonoma). Email is less settled. In 2013, a federal court predicted that an email address would count, but said that whether collecting one for an e-receipt fell under the law’s exceptions “requires further factual development.” The case was later dismissed by agreement (Capp v. Nordstrom).

The rule has exceptions for “shipping, delivery, servicing, or installation of the purchased merchandise, or for special orders,” and doesn’t cover online purchases of downloads (Apple v. Superior Court). It applies only when you pay by credit card, which it defines as a device for buying “on credit” (§1747.02), so paying cash takes you outside it, and paying by debit card may too. The store may check ID, such as a driver’s license, but not record the details. You, the Attorney General, or a district or city attorney can seek penalties of up to $250 for a first violation and $1,000 for each one after.

The UK and EU soft opt-in

In the UK, a store may email you marketing without your consent only if all of these apply (ICO):

• it got your details directly from you, during a sale or negotiations for one;
• it markets only its own similar products;
• it offered a simple way to refuse when it collected the address;
• it offers that way to refuse again in every message.

The EU rule is similar, and national laws can be stricter: Ireland adds a 12-month limit that restarts with each marketing email you don’t opt out of (DPC).

The ICO’s own example is a customer who gives an email for a jeans receipt and gets a footwear promotion the next day. The receipt was fine; the promotion wasn’t, because “Consent for an e-receipt doesn’t cover sending direct marketing.” Whatever the basis, you can object to direct marketing at any time, and the store has to stop.

What to say at checkout

• Anywhere: “Paper receipt, please.” If you’re told the email is required, ask: “Is it needed to complete the payment?”
• UK and EU, if you want the e-receipt: “Receipt only, no marketing, please.” Once you’ve refused at collection, the store can’t rely on the soft opt-in for that address.
• California, paying by credit card: “I’d rather not.” The store can look at your ID but can’t record it.
• US, asked to sign up for texts: “No thanks.” The consent form must say signing up isn’t a condition of buying, and replying STOP ends it later.
• Online: before you pay, find the marketing checkbox and set it to no. It may be worded as an opt-out, like the ICO’s compliant example: “I do not want to receive marketing emails about your clothing ranges.”

Why stores want your phone number, and the rules for texts

Stores ask for a phone number for the same reasons as an email: Square attaches either one to your card for receipts, Google’s Customer Match takes phone numbers as well as email addresses, and a data broker can turn either into your name and address. A number is also harder to replace. You keep it for years, and you can’t make a new one for every store.

Texts have their own rules. In the US, you can revoke consent “by using any reasonable method” (47 CFR 64.1200(a)(10)), and you can report unwanted texts by forwarding them to 7726 (SPAM) (FTC). In the UK, PECR’s definition of electronic mail includes text messages (regulation 2), so the email rules apply, and the ICO notes that consent to marketing calls doesn’t cover texts. If a form insists on a number and you’re in the US, Google Voice gives you a second one “for calls, texts, and voicemails” (Google Voice Help).

Do you need an email for receipts, returns, and warranties?

In a store, rarely. A paper receipt proves a purchase as well as an email does, and other records can stand in for both. What matters is keeping some proof for as long as a claim is possible.

Returns: without a receipt, it depends on the store. Target, for one, can look up purchases made with its own cards and with Visa, Mastercard, American Express, and Discover credit cards (Target Help). In the UK, the government tells shops that proof of purchase “could be a sales receipt or other evidence such as a bank statement or packaging,” and customers have up to six years to claim for a faulty item (five in Scotland) (GOV.UK). In the EU, the seller must repair or replace faulty goods for free, and you can claim for at least two years (Your Europe).

Warranties: in the US, a full warranty can’t require you to return a registration card (16 CFR 700.7), but a limited warranty can (FTC). Either way, the FTC’s advice is to “save your product receipt with the warranty” (FTC). In the UK, a manufacturer’s guarantee may not be valid if you didn’t register (Citizens Advice). Registration mail needs an address you’ll still read.

Where to keep proof: in an inbox you’ll keep. Google can delete an account that hasn’t been used for two years (Google), and a work or school address goes when you leave. For big purchases, save a PDF of the receipt with the manual.

Unsubscribing doesn’t stop receipts

Under CAN-SPAM, messages that confirm a purchase or give “warranty, recall, safety, or security information about a product or service the recipient bought” are transactional, not marketing (FTC). They can keep arriving after you unsubscribe. The reverse matters too: switching off an address stops the recall notice along with the promotions, so change the email on the store account first.

What email should you use for online shopping?

The best email for online shopping is a separate address for each store, if you’ll keep up with it, delivered to an inbox you’ll keep for years. When spam starts, the address it reached names the source (how to find out who sold your email address). A single email just for shopping is the simpler second choice: it moves promotions out of your main inbox but can’t tell you which store leaked it.

For every option ranked by protection and effort, see ways to keep your email address private, ranked. An address that isn’t on your Google account also makes it harder for an uploaded customer list to be matched to you by email. How shopping fits with the rest of your mail is in how many email accounts you should have.

Set up a separate email for shopping that doesn’t flood your inbox

1. Pick the inbox that receives shopping mail: one you’ll still open in five years. If it’s a separate account, make your main address its recovery email, and open it at least once a year; Google counts reading mail as activity.
2. Give each store its own address. In CatchNone, name a new alias after the store, choose Create & Copy, and paste it in. In Safari on iPhone with iCloud+, tap an email field, then Hide My Email above the keyboard. In an Apple Pay payment sheet (iOS 17 or later), tap Contact, then choose Hide My Email; it appears only when the store requests an email there (Apple Support). Without iCloud+, create one in DuckDuckGo Email Protection or SimpleLogin, which both have free plans, and paste it in. On a domain you own with catch-all delivery, type a new name at checkout, such as shopname@example.net.
3. Label each address with the store’s name, so a receipt search, or a leak, points to one place.
4. Decline marketing at checkout.
5. Filter each store’s mail into a folder or label by the To address (steps for Gmail, Outlook, and iCloud Mail). In CatchNone there’s nothing to set up: every message is already badged with its alias, and the Inbox can show one alias at a time.

Don’t use a store address for your bank, your card issuer, or any account’s recovery email. Keep those on your real address.

Get the signup discount without years of promotions

1. Sign up with an address for that store alone.
2. Use the code on your order.
3. Once the order confirmation arrives, unsubscribe from the marketing; receipts and shipping updates keep coming. Google recommends that bulk senders to Gmail act within 48 hours (Google).
4. If promotions continue, move the store account to a new address, or wait until returns and warranty claims no longer depend on the old one, then switch it off.

Don’t use new addresses to claim a first-order code twice; the offer’s terms may forbid it. If a store ignores your opt-out, see why unsubscribe doesn’t work.

When a store leaks or sells your address

Recent retail breaches exposed the same details checkouts ask for. Data allegedly taken from clothing retailer Carhartt in August 2026 included 12.9 million unique email addresses with names, phone numbers, and physical addresses. Hallmark (an alleged breach, March 2026) and Canadian Tire (October 2025) exposed the same kinds of details. To see whether your address was in one, search it at Have I Been Pwned.

With one address per store, spam at the address you gave one store points to that store, or to someone it shared its list with. What you can do next depends on where you are:

• EU and UK: object to marketing and ask for erasure, which Article 17(1)(c) of the GDPR grants once you’ve objected (EU, UK). The store may keep your address on a suppression list so it doesn’t contact you again, as the ICO advises (ICO). Don’t count on a breach notice: Article 34 requires one only when a breach is “likely to result in a high risk” to you (UK). If the store doesn’t act, complain to it first, then to the ICO or your country’s data protection authority.
• California: ask a business covered by the CCPA to delete your information and not to sell or share it (§1798.105, §1798.120). A CCPA damages claim covers an email address only when it leaked “in combination with a password or security question and answer” (§1798.150).
• Elsewhere in the US: unsubscribe; the store then can’t sell or transfer your address. Several states also give you a right to have larger businesses delete your data, Virginia for example (Va. Code §59.1-577); the store’s privacy policy says how to ask.

Wherever you are, finish by giving the store a new address in your account settings and switching the old one off.

Where CatchNone fits

CatchNone gives every store its own address, available for iPhone, iPad, and Mac. Name an alias after the store, choose Create & Copy, and paste it at checkout. Every message is badged with the alias it reached, so if strangers write to one store’s alias, you know that address was shared. Remote images, including most tracking pixels, stay blocked until you load them. After you confirm, Unsubscribe sends a list’s one-click request from inside the app when the list supports it. Otherwise it hands your mail app a pre-addressed email that the store will see came from your main address, or, if there’s no email option, opens the sender’s web page.

With Premium, random @catchnone.com addresses need no domain, DNS, or mailbox to set up, their promotions stay out of your main inbox, and switching one off makes senders get a bounce, receipts included. Each message to them is kept for 30 days after it arrives, and if Premium ends, their mail is deleted on arrival until you subscribe again and open the app, so save receipts you’ll need with Share… as .eml files. Or use aliases on a domain you own, up to 10 on the Free plan and unlimited on Lite and Premium: that mail stays in your own mailbox at your provider, and CatchNone reads it straight from there. On your own domain, CatchNone reads the inbox only, and marking an alias as not in use is a label: block a store’s address with a rule at your mail provider. CatchNone is receive-only by design, so write to a store’s support from your usual account and quote the order number.

FAQ

Why am I getting email receipts from stores I never gave my email to?

Your card may be linked to your email. Square, for example, attaches the address you gave for one e-receipt to your card and sends receipts when you pay with it at other Square sellers. To stop them, select Manage Preferences at the bottom of a Square receipt and turn off Receive automatic receipts, or turn off single businesses under Businesses visited. To unlink the address, select Not Your Receipt?, then Unlink next to your email address (Square). To stop the marketing too, turn off Subscribe to marketing emails from Square and all Square sellers you visit in your Square profile (Square).

Can I use my work or school email for shopping?

It’s better not to. You lose the mailbox when you leave the job or the school, and with it the receipts, warranty registrations, and password resets for every store account. Use a personal address or one address per store instead.

Is it illegal for a store to ask for my email?

Usually not: the law mostly regulates the marketing that follows, except California’s credit card rule, which may cover an email address a store records when you pay by credit card in person.