An email address given to an online survey panel is the address that runs the account. Panel privacy policies permit that address to be shared with partners and, in some cases, sold, and two panels have had member data exposed since 2024, with a third leak possible but unconfirmed. Invitations, reward balances and payout confirmations all travel to the address on file, and the panel keeps it for the whole membership. A working address is required, and the form of it that limits the exposure is an address used for that panel alone.
Survey scams and the FTC warning#
An unsolicited survey invitation that promises a reward deserves a check before anything is clicked. The US Federal Trade Commission warned in an alert dated 8 August 2022 that unexpected texts claiming to come from the Postal Service, Costco or The Home Depot, and offering a survey to claim a free gift card or a power tool, are impersonation scams. The messages direct the reader to a link, ask for answers to questions, and then demand payment for shipping. People who followed those steps found unauthorised charges on their accounts instead of a reward.
The FTC advises never to click links in unexpected texts, including ones asking for surveys to get free items, and to contact the company through a website or phone number already known.
The test holds for every survey invitation, not only for text messages. A genuine panel never asks a member for a password, a card number, a one-time code or any payment. A request for a password, card number, code or payment is not part of a genuine survey.
How panel membership works#
Joining a survey panel creates a membership that runs for months. A member registers once, completes profile questions, and then receives invitations at intervals. Rewards build up as points, which are redeemed for PayPal transfers, bank transfers or gift cards. Survey Junkie describes the arrangement as members sharing opinions while its parent company DISQO packages the resulting data for market research clients. Across all of that, the email address is the link between the account, the invitations and the payout.
An inbox that stops receiving mail after a few days breaks the arrangement. Invitations stop arriving, password resets go nowhere, and payouts cannot be confirmed. The panel therefore needs an address that keeps working for the life of the membership. The choice is not whether to give an address, but which address to give.
Privacy policies of four panels#
The four panels covered here take different positions on the address. The table below gives the position of each panel, and the subsections that follow give the wording behind each row.
| Panel | What happens to the email address |
|---|---|
| Prolific | Researchers never receive it; participants are identified by a Prolific ID only |
| YouGov | Shared with the companies that provide the technology used to send survey invitations, under contractual safeguards |
| Swagbucks | May be disclosed to partners or sold, with a Do Not Sell or Share opt-out offered |
| Survey Junkie (DISQO) | Sold and shared for cross-context behavioural advertising |
Prolific#
Of the four panels, Prolific restricts the address most tightly. According to its data protection guidance, a researcher receives neither a participant's name, email address nor physical address, and is barred from requesting direct identifiers. A Prolific ID is the only identifier a researcher sees. Account data, including email addresses, is processed to run the service and pay rewards, but the address itself is not passed to the researcher.
YouGov#
YouGov passes the address on, but to a narrower set of recipients than Swagbucks or DISQO. Its compliance page says panel member email addresses go to the companies that provide the technology used to send survey invitations, with contractual safeguards against other uses. Client results are aggregated under its privacy notice, with directly identifiable data such as names removed before delivery, and identifiable insights are provided only with the panellist's permission.
Swagbucks#
Prodege operates Swagbucks. Its privacy policy, effective 1 September 2025, treats an email address as Personal Information and permits disclosure to affiliates, vendors, advertisers, merchants, survey partners, joint business ventures and other trusted third parties. The policy also states that the company may disclose or sell aggregate or individualised information about the user. The US State Privacy Notice in the same policy says the company may sell or share Personal Information, and provides a Do Not Sell or Share or Target opt-out request.
Survey Junkie and DISQO#
DISQO, a consumer insights company, owns Survey Junkie. DISQO's privacy policy, last updated 26 September 2025, says the company sells and shares personal information for cross-context behavioural advertising. Survey Junkie's own page says responses are collected directly by the party conducting the research, while DISQO packages data for its clients for market research purposes. Researchers receive the responses, and personal information is sold and shared for advertising.
Every panel needs the address to run the account. Some panels keep it inside the service, while others pass it to partners, advertisers and data buyers under terms the member accepted at signup. The privacy policy is the only document that says which kind a panel is, and none of the four panels publishes how many member addresses it has sold or shared in a given year, so the scale of lawful sharing cannot be measured from public sources.
Breach record#
Sharing under a policy is one route out of a panel database. A breach is the other, and survey panels have been breached repeatedly.
SurveyLama, a paid survey site, lost data in a breach in February 2024. The exposure covered 4.4 million customer email addresses, together with names, physical and IP addresses, phone numbers, dates of birth and passwords stored as salted SHA-1, bcrypt or argon2 hashes. Have I Been Pwned added the breach on 2 April 2024, and SurveyLama told the service it had already notified users by email. A larger SurveyLama dataset of about 15.8 million rows was the subject of an unverified claim reported on 3 October 2026, but the reporting states there is no independent evidence that it is authentic or newly obtained, and it may be recycled 2024 material. It is not treated here as a second breach.
In October 2026, two Japanese panels were hit in the same month. GMO Research and AI operates the survey panel infoQ. Attackers gained unauthorised access from 2 October 2026 through a vulnerability in software used on the site, and the intrusion was discovered on 3 October after members reported problems with their points. The first notice, published 5 October, gave a maximum of 948,498 records. The second report, published 14 October, confirmed that personal data of 894,082 members was taken, including email addresses, names, dates of birth, addresses, phone numbers and encrypted passwords. The attackers also converted 611 members' points into Amazon gift codes worth 2,869,500 yen, which the company said it would compensate in full. All member passwords were invalidated on 7 October.
A fortnight later, Qzoo, a survey site run by Monitas Inc., reported unauthorised access that began on 17 October 2026, with the database viewed and updated through SQL injection. A summary of the company notice of 21 October puts about 400,000 records in scope, which is all records held in the Qzoo system. The database that may have been affected held names, dates of birth, addresses, phone numbers, email addresses, member IDs and passwords, bank account numbers, branch names and account holder names, and survey answers including income and occupation. The company states that the leak is at the possible stage and the exact items are still being identified, so the Qzoo figures describe a scope, not a confirmed loss.
Two panels had member data exposed since 2024, and a third reported a possible leak in October 2026. A panel database holds the fields that make phishing convincing: a name, an address, a date of birth and a record of what the person does for small rewards. The infoQ attackers did not only copy the database. They used it, converting points into gift codes inside the service itself.
Uses of a sold or leaked list#
A list of addresses from a survey panel differs from a scraped list in one respect. Every address on it belongs to a real person who signed up, confirmed the address and answers surveys for small payments. That makes the list useful for spam, phishing and sale to other marketers. A phishing message sent to a panel list can quote the panel name, the member's name and the points balance. The methods spammers use to obtain addresses and the way phishing uses a leaked address are covered in the AliasFleet guides on how spammers get an email address and how phishing uses a leaked email.
One alias per panel#
The setup that fits the facts is one alias per panel. An email alias is a forwarding address that delivers mail to the primary inbox. The panel receives a working address that stays live for the life of the membership, so invitations and payouts arrive as normal. The primary inbox address is never given to the panel, so it never appears in the panel's database or in a breach file. The steps are described in the AliasFleet guide on how to set up an email alias.
The alias also identifies the source of any leak. When spam or phishing starts arriving at the alias created for one panel, the panel is identified by the address itself. The alias can then be paused or replaced, which stops the mail. The panel account still exists, because the alias is the address on the account. This is the same principle as using a different email for every website: the address itself becomes the record of where it was given.
Managed aliases from AliasFleet forward to a verified destination inbox. An alias created for a survey panel serves as a persistent identity for that panel rather than a short-lived inbox, and it keeps working for as long as the membership lasts, which is what a panel account requires. Pricing for paid plans is listed on the AliasFleet pricing page, and the free plan includes 10 active aliases.
An alias covers the email address only, not the rest of the profile. The panel still holds the member's name, date of birth, address, phone number and survey answers, and a breach exposes those fields whether the email address is an alias or not. The alias also does not stop the panel from sharing the alias itself with partners under its policy. What the alias does is confine the damage to one address that belongs to one panel, and make the source visible when the address is misused. Reading the policy before joining and using the opt-out where one is offered reduces the rest of the exposure. When a breach does happen, the AliasFleet guides on checking whether an email was leaked and what to do when an email is in a data breach give the order of steps.
What should you give a panel?#
A panel cannot function without a working address. The primary inbox address should not be that address, because the policies allow the address to travel and the breach record shows that it does. One alias per panel gives the panel an address that works for invitations and payouts, and gives the member an address that names the panel when it appears somewhere it should not.
