--- title: "How to Check What a Site Does With Your Email First" date: "2026-11-05" author: "Ahsan Luqman" canonical_url: "https://aliasfleet.com/blog/how-to-check-what-a-site-does-with-your-email-first" tags: ["Email Privacy", "Privacy Policy", "Email Aliases"] description: "A short pre-signup check of a privacy policy, signup boxes, sale opt-out and breach history decides whether an email address is safe to hand over." --- # How to Check What a Site Does With Your Email First A short pre-signup check of a privacy policy, signup boxes, sale opt-out and breach history decides whether an email address is safe to hand over. A pre-signup email check is a short routine run before an address is given to a website. It covers four checks, the sharing clause, consent boxes, sale opt-out and breach history, plus a warning on later changes. It ends in one of three outcomes: the real address, a dedicated alias, or refusal. The five-minute figure is a practical estimate, not a measured average. The check exists because an address handed over at signup is difficult to take back. Once entered, it is copied into databases, forwarded to other companies and sold onward, and none of that is visible from the signup form. The privacy policy states what happens next, but it is long and written in legal language, so the routine reads only the parts that govern the address. ## Privacy policy sharing clauses The check starts with the privacy policy, usually linked in the site footer. The relevant part is the section on sharing, disclosure or third parties, often headed with a phrase about sharing. Searching the page for "share" and then for "third part" reaches it directly. The clause names the recipients, or at least their categories, and the purpose of each transfer. Under the UK GDPR, a site must tell people who it will give their information to and why, at the point it collects the data. The [ICO states this duty in its guidance on the right to be informed](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-common-issues-might-come-up-in-practice/). Where a site collects data with the intention of selling it to third parties or sharing it with them, it must say so in the privacy information it provides. Articles 13 and 14 require controllers to provide information about "the recipients or categories of recipients of the personal data". Categories must be as specific as possible, covering type, industry, sector and location. Generic labels such as "business partners" were found not to give people enough information in an ICO enforcement decision, as [a Mayer Brown analysis](https://www.legal500.com/intelligence/united-states/privacy/personal-data-sharing-what-information-about-recipients-do-we-need-to-provide-to-individuals-under-the-gdpr) records. The [ICO's Data Sharing Code of Practice](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/sharing-personal-data-in-databases-and-lists/) adds a further point. The transfer of a database or a list of individuals counts as data sharing whether money changes hands or not, so handing a customer list to another organisation counts as sharing even without payment. A clause that promises never to "sell" data is therefore not a promise never to share it. A policy with no sharing section, or one that describes sharing only in vague terms, leaves the question unanswered, and that gap is itself an answer. ## Signup form consent boxes The second check is the signup form itself. Every box is read before the form is submitted, including boxes below the email field and on the confirmation screen. A pre-checked box is the most common pattern: the box is already ticked when the form loads, so doing nothing counts as agreement, and the text beside it often covers partner offers or sharing details with selected third parties. The FTC has warned that a pre-checked box does not constitute affirmative consent, in its negative-option marketing policy statement. [Kelley Drye's summary of that statement](https://www.kelleydrye.com/viewpoints/blogs/ad-law-access/ftc-to-increase-enforcement-on-subscription-services) quotes the footnote directly: a pre-checked box "does not constitute affirmative consent". Unticking a pre-checked box removes that consent. The box is often worded so that unticking it feels like losing something, with phrases such as "keep me updated" or "send me offers". Where a form has more than one box, each one is read separately: one box may cover the site's own emails, while a second covers partner marketing. Some forms place the sharing consent in the terms and conditions link instead of a box, so that link is opened at least once for a long-term signup. ## Sale and sharing opt-outs Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, California residents can direct a covered business to stop selling or sharing their personal information. The business must display a link titled "Do Not Sell or Share My Personal Information" on its website, usually in the footer. [LegalClarity's guide to the right](https://legalclarity.org/do-not-sell-my-personal-information-under-the-ccpa/) states that once the request is submitted, the business has 15 business days to comply, and it cannot penalise the person for exercising the right. [Cookiebot's guide](https://www.cookiebot.com/us/do-not-sell-my-personal-information/) confirms the same deadline and notes that the business must also notify third parties it sold or shared the data with. "Sell" and "share" have specific meanings under the CCPA. A sale is a transfer for money or other valuable consideration, while sharing is a transfer for cross-context behavioural advertising even when nothing is paid. A site that hands browsing data to an advertising network has therefore shared it under the CCPA although no payment was made. The opt-out covers both acts and stops future sales and sharing. It does not delete data already held; deletion is a separate request under a different part of the CCPA. The CCPA does not apply to every business. It covers for-profit businesses operating in California that meet at least one threshold: revenue above $26,625,000, the personal information of 100,000 or more California consumers or households, or 50 percent or more of annual revenue from selling or sharing personal information. A site below all three thresholds is not covered and carries no such link. A browser-level version also exists. [Global Privacy Control](https://globalprivacycontrol.org/) is a browser signal that tells every site visited not to sell or share personal information. When it is switched on, the browser sends the HTTP header `Sec-GPC: 1` with each request. Brave and the DuckDuckGo browser send it by default and Firefox has a built-in setting, according to [UniConsent's explainer](https://www.uniconsent.com/global-privacy-control). Under the CCPA regulations, covered businesses must treat the signal as a valid opt-out request. ## Breach history [Have I Been Pwned](https://haveibeenpwned.com) is a free breach search service run by security researcher Troy Hunt. A search by site name or email address shows whether the address appeared in a known breach and what data was exposed. As of 5 November 2026 the homepage lists 1,049 breached websites and 17,847,746,941 pwned addresses. A site in that list has already lost its users' addresses at least once. The [AliasFleet guide to reading a HIBP result](https://aliasfleet.com/blog/how-to-check-if-your-email-was-leaked) explains how to read each breach entry, including the date, the data classes and the difference between verified, unverified and fabricated breaches. A clean result is not a guarantee: a breach has to be found, verified and loaded before it shows up, and many breaches are never detected. Breach history is therefore one input to the decision, alongside the policy and the form. ## Policy changes after signup A privacy policy read at signup is a snapshot, and policies change. On 13 February 2024 the FTC addressed this in a post titled "AI (and other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive". [The post states](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive) that it may be unfair or deceptive for a company to adopt more permissive data practices, for example to start sharing consumers' data with third parties, and to only inform consumers of this change through a surreptitious, retroactive amendment to its terms of service or privacy policy. The post cites two enforcement cases, Gateway Learning in 2004 and a genetic testing company in 2023, in which policies changed to wider sharing without notification or consent. The date line at the top of a policy is checked alongside the sharing clause. A policy updated after signup can add sharing terms that were absent when the address was given. The OkCupid case shows the limit of the policy check. On 30 March 2026 the FTC alleged OkCupid shared personal information, including profile photos and location data, with Clarifai Inc., an AI company that fit no category its privacy policy disclosed, in a transfer of nearly three million user photos with no payment and no written agreement. [The account of the complaint](https://www.jdsupra.com/legalnews/ftc-cracks-down-on-privacy-policy-3334542/) states the details. A clean policy check reduces risk, and it does not prove that a site keeps its promises. ## Outcomes of the check The checks above lead to one of three outcomes, set out in the table below. The real address is reserved for sites that need it for recovery and fraud alerts, the alias covers sites that share data but still offer something worth using, and refusal covers sites that fail the check. | Check result | Outcome | | :--- | :--- | | Policy names no third-party sharing, boxes are unticked, no breach history | Real address | | Policy shares with partners or advertisers, or the site has a breach history | Alias for that site | | Policy sells data broadly, or sharing is with unnamed partners for their own marketing | Refusal | The real address is for sites that need it: a bank, a government service, an employer. Recovery and fraud alerts depend on an address the owner controls directly. The alias is for everything else that passes the check but still shares data: a shopping site, a newsletter, a forum, a free trial. The alias receives the same mail the real address would receive, and it can be switched off when the site starts sending mail it should not. The [AliasFleet guide to how aliases work](https://aliasfleet.com/blog/how-email-aliases-actually-work) describes the mechanism: the alias is a forwarding address, mail sent to it arrives in the real inbox, and replies go out from the alias. The [guide to how spammers get addresses](https://aliasfleet.com/blog/how-do-spammers-get-your-email-address) sets out the four supply lines behind a shared address: breaches, scrapers, brokers and guessing. Refusal is for sites that fail the check badly and offer little in return: a quiz site that sells data to unnamed partners, a download gate that demands an address for a file, a competition that shares entries with sponsors. The exception is a service in this group that is wanted despite the result. An alias is used instead of the real address, and spam on that alias is expected. ## AliasFleet and the pre-signup check AliasFleet is an email alias service. It provides one forwarding address per site, so each site holds a different address and the real inbox address is never exposed. [AliasFleet](https://aliasfleet.com) offers a free tier with 10 active aliases, 3 managed subdomains, and 1 verified destination inbox. When spam arrives on an alias, the alias names the site that shared the address, and the alias can be switched off in one click. The service does not prevent a site from sharing the alias address. It limits what the sharing exposes: a breach exposes that alias and nothing else, while the real address stays out of every database the site touches.