Guide
"Where did you get my email?" How to answer, with templates
It is a fair question, and in the EU and the UK it is also a right. Answer it plainly and quickly.
Short answer
Tell them exactly where the address came from, what you hold about them, and offer to delete it. GDPR gives people the right to know the source of their data [1], and when you write to someone whose address you did not get from them, you should say where it came from at the latest in your first email [2]. If they object, stop for good [3].
General information, not legal advice, as of the date above. Where a regulator says its guidance is under review, we say so. If your situation is unusual, ask a lawyer who practises in that country.
What the rules say
When you collect someone's address from somewhere other than them, GDPR Article 14 says they should be told "from which source the personal data originate, and if applicable, whether it came from publicly accessible sources" [4]. If you use the data to write to them, that should happen "at the latest at the time of the first communication" [2]. If they ask later, Article 15 gives them a right to "any available information as to their source" [1]. And when someone objects to direct marketing, "the personal data shall no longer be processed for such purposes" [3].
Three replies you can send
If you found the address on their website
Hi Maria,
Fair question. I found maria@harbourlane.example on the team page of your practice website, harbourlane.example/team, on 28 September. I wrote because it is the address listed for practice enquiries.
I have your name, that address and the name of the practice, nothing else. If you would rather not hear from me, say so and I will delete it and not write again.
Sam
If a colleague passed it on
Hi Maria,
Your colleague Tom Byrne gave me your address when he replied to my email on 27 September and suggested you were the right person.
I have your name and that address, nothing else. If you would rather not hear from me, say so and I will delete it.
Sam
If they also ask you to delete it
Hi Maria,
Done: I have deleted your address and added it to my do-not-contact list so you will not hear from me again. I found it on your practice website's team page.
Sorry for the interruption.
Sam
What not to do
- Do not be vague ("from a database"). Name the page or the person.
- Do not argue that the address was public. Being public is a reason you could find it, not a reason to keep writing.
- Do not send the rest of your sequence. Stop the follow-ups the moment this question arrives, and answer it first.
- Do not keep the address after they ask you to delete it, except on a do-not-contact list so you never write again.
Better: answer it before they ask
Because the source should be given at the latest in the first email, the simplest habit is one short line at the end of every first email: where you found the address. It also makes the email more honest, which tends to help replies. In the UK you must also not hide who you are and must give a way to opt out [5].
Questions
Do I have to tell someone where I got their email address?
In the EU and the UK, yes. GDPR says people should be told the source of their personal data, at the latest when you first write to them, and they can ask for it at any time.
What if they ask me to delete their email address?
Delete it, stop all follow-ups, and keep the address only on a do-not-contact list so you never write again. Confirm in one short reply.
Is a public email address free to use for cold email?
Being public explains how you found it. The rules on direct marketing and on telling people the source still apply.
See what it would write for you
Type your website. Honest Intros reads it and shows the kind of first email it writes, quoting your own pages.
Free to start. Nothing is sent until you approve it.