Who sold my email address?

Nobody stole your email address.

I know that’s the assumption. Breach, hacker, leak, dark web. It’s the comfortable explanation, because it makes you a victim of a crime instead of a party to a transaction.

The truth is more boring and more insulting: you gave it to somebody, and they sold it. Legally. Under terms you accepted.

Four Hops To A Stranger

The collector gets it first. The site you actually dealt with—the store, the newsletter, the coupon, the contest, the quote form.

The broker buys or licenses it next. List brokers deal in segments: homeowners in Ohio, 45 to 65, who requested insurance quotes in the last 90 days. You’re one row in a file of forty thousand.

The appender enriches it. This is the step nobody knows exists, and it’s the one that explains everything. Appenders match your email against other datasets to fill in what it didn’t come with—full name, phone number, mailing address, age range, homeowner status, estimated income. An address that arrived alone leaves with a dossier attached.

The buyer finally emails you. By now you’re several transactions removed from the company you originally trusted. Which is exactly why the sender’s name means nothing to you.

Why Nobody Will Just Tell You

Each hop is a separate business relationship with its own contract. None of them owe you an answer unless a law in your state compels one.

And here’s the honest part: by the fifth hop, most of them genuinely couldn’t tell you. Files get merged, deduplicated, appended, and resold so many times that provenance degrades into noise. The company emailing you today may have bought a list from a company that bought a list. Nobody kept the chain of custody, because nobody was ever asked to.

Your data has a supply chain. It just doesn’t have a receipt.

Two Ways To Actually Catch Them

Tag your addresses. If your provider supports plus-addressing—you+homedepot@gmail.com —use a different address for every company. When spam lands at you+dentist@gmail.com, you have named the seller with certainty. Some sellers strip the tag before reselling, so this catches many cases, not all. Aliases work better if your provider offers them.

Correlate the timing. New categories of spam almost always trace to something you did two to six weeks earlier. Mortgage offers appearing out of nowhere, and the only mortgage-adjacent thing you did was a rate calculator? That’s your answer, with more confidence than you’d think.

Why Unsubscribing Does Nothing

Unsubscribe stops one sender. It does nothing to the underlying record.

Your address is still in the file. The file still gets sold. The next buyer has never heard of your unsubscribe, and there’s no mechanism that would tell them.

You’re treating a symptom in a system that reproduces.

To actually reduce the flow you have to work the source: identify the original collector, send a deletion and do-not-sell request to that company in writing with a deadline, and stop feeding new copies into the machine.

That last part is the one you control completely, starting today. Every form you fill by hand is a fresh record entering the supply chain. PRYVC fills them from one profile, logs who got what and when, and sends the formal deletion requests to the companies already holding you—with a tracked deadline, not a hopeful click on an unsubscribe link.