This article isn't legal advice. We're not lawyers; we run a temporary email service and spend every day thinking about where email addresses go and who ends up holding them. Below we've tried to explain the parts of the GDPR that concern your email address, as simply as an ordinary user needs. If you have a specific dispute, it's best to speak to a lawyer or contact your country's data protection authority directly.
Why does an email address count as personal data?
The GDPR's logic is simple. If a piece of information identifies you, on its own or combined with other information, it's personal data. An address like john.smith@... already carries your name. But even if your address is something like "catlover1987@...", the accounts opened with it, order records and delivery address put together usually make it easy enough to find you.
There's another point. In many systems today, your email address doubles as your username. So it's both a way to contact you and the key to your digital identity. It's no surprise the law considers it worth protecting.
Do work addresses count too?
A personal work address (firstname.lastname@company...) belongs to a specific employee, so the widely accepted view is that it's personal data as well. Generic addresses that aren't tied to one person, such as "info@" or "support@", may be treated differently. For borderline cases, it's worth getting an expert opinion.
On what basis can a website collect my email address?
Let's clear up a common misconception. The GDPR does not require consent for every kind of processing. Consent is only one of several legal bases listed in the law. For example, if processing is necessary to enter into or perform a contract (such as sending you your order details when you shop online), the company can use your address for that purpose. Complying with a legal obligation is another of these bases.
Consent, for its part, must be freely given, specific, informed and unambiguous. In practice that means:
- A "Keep me updated about offers" box shouldn't come pre-ticked.
- Getting the service shouldn't depend on agreeing to marketing. Making newsletter sign-up mandatory just to place an order is a questionable practice.
- It should be clear what you're agreeing to; vague wording like "for any purpose" hardly fits that definition.
The company also has a duty to inform you, which means it must tell you who is processing your data, for what purpose, who it may be shared with and what your rights are. That's why sign-up forms link to a "Privacy Notice" or "Privacy Policy". Hardly anyone reads it, but it's the clearest place to see where your address will end up.
What about marketing emails?
The promotional emails landing in your inbox aren't governed only by the GDPR; electronic marketing has its own rules as well, and the details vary from country to country. The general principle is that a business wanting to send you advertising or promotional messages normally needs your permission first, and every message should give you an easy way to opt out (unsubscribe). Under the GDPR you also have the right to object to your data being used for direct marketing at any time. Exceptions, such as messages to existing customers, depend on national rules, and we won't go into them here.
| Topic | Which rules? | What it gives you in practice |
|---|---|---|
| Collecting, storing and sharing your address | GDPR | Rights to be informed, to access your data, to have it erased and more |
| Advertising and promotional emails | GDPR plus national e-marketing rules | Permission normally required up front, opt-out in every message |
| Withdrawing your permission | GDPR (right to object, withdrawal of consent) | Unsubscribe links and requests sent directly to the company |
What rights do you have as a data subject?
The GDPR calls the person whose data is processed the "data subject". Broadly, you have the right to:
- find out whether your data is being processed and, if so, get access to it,
- learn the purpose of the processing and whether your data is being used in line with it,
- know who it has been shared with, including recipients in other countries,
- have incomplete or inaccurate data corrected,
- have it erased, under the conditions set out in the law,
- claim compensation if you've suffered damage because of unlawful processing.
How do I ask a company to delete my address?
- Open the company's privacy notice or privacy policy; it usually explains how to submit a request.
- Make your request in writing or through the channel the company specifies. Include the email address linked to your account so they can verify who you are.
- Say clearly what you want, for example: "I request that you erase the data associated with this address and remove me from your marketing lists."
- The GDPR expects the company to respond within one month, which can be extended in some cases. If you get no answer, or the answer isn't good enough, you can complain to your data protection authority.
So what does a temporary email have to do with this?
One of the GDPR's core principles is that data should be adequate, relevant and limited to what's needed for the purpose. This is usually called data minimisation. The principle is aimed at companies, but we can apply the same thinking to ourselves as users and not give a site data it doesn't really need.
Think about it. You fill in a form on a website to download a PDF. The site wants your address because it'll send the file there. You'll never deal with that site again. If you give your permanent address, it's now sitting on a marketing list and in that company's database. Later, sending erasure requests, withdrawing permissions and unsubscribing become your job. You have rights, yes; but using them takes time.
For one-off tasks like this, an address created with Geçici Mail does the job and then goes away on its own. There's no sign-up on our site, and we don't ask for your name or phone number; open the page and a random address is ready. Incoming emails are deleted automatically after 24 hours. In other words, on our side too, we try not to build up a permanent record that could be linked to you. If you're curious how it works, have a look at our article on what a temporary email is and how to use it.
When is a temporary email the wrong choice?
To be honest, using a temporary address everywhere isn't right. Your bank, government services, billed services, a company you're applying to work for, or an account you'll use for years all deserve your permanent address, because password resets, invoices and legal notices will be sent there. A temporary email only receives messages, it can't send, and the address goes out of use after a few hours. You can get back to it with your recovery key, but that's no reason to make it your main account. We cover the security side in more detail in is a disposable email safe.
FAQ
Is my email address personal data under the GDPR?
Yes. An email address that identifies you, directly or combined with other information, counts as personal data under the GDPR.
Does a website always need my consent to collect my address?
No. The GDPR has legal bases other than consent; for example, if it's necessary to perform a contract, your address can be processed for that purpose. Sending advertising emails, however, normally requires separate permission.
How do I withdraw permission for marketing emails?
Use the unsubscribe link at the bottom of each email, or contact the company directly and object to your data being used for direct marketing. You can do this at any time.
Can I ask a company to delete my data?
Yes, the GDPR gives you the right to request erasure. Submit your request through the channel given in the company's privacy notice; legal retention obligations may mean some records are kept for a while.
Does using a temporary email take away my GDPR rights?
No, your rights stay exactly the same. A temporary email simply keeps you from sharing your permanent address when there's no need, which means fewer situations where you have to exercise those rights later.