Businesses aren’t legally allowed to sell your email after you unsubscribe from their mailing list

Billions of emails are sent and received by people all over the world every day. Many of these emails are marketing promotions sent from a variety of companies.

VERIFY viewer Lynda says she gets a lot of these promotional emails. She asked our team in a text message if a business can sell a person’s email address after they unsubscribe from its mailing list. 

THE QUESTION

Are businesses allowed to sell your email address after you unsubscribe from their mailing list?

THE SOURCES

• CAN-SPAM Act
• Federal Trade Commission (FTC)
• Andrew Sternke, J.D., chief executive officer and private investigator at Juris Disputes & Investigations   

THE ANSWER

No, businesses are not legally allowed to sell your email address after you unsubscribe from their mailing list.

WHAT WE FOUND

The Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 — widely known as the CAN-SPAM Act — is a federal law that sets the rules for businesses that send commercial marketing emails. It requires that these emails be identified as advertising and provide recipients with a method for opting out of receiving any of these emails in the future. It also spells out tough penalties for violations, according to the Federal Trade Commission (FTC).

Under the CAN-SPAM Act, businesses are required to tell recipients how to opt out of receiving future emails from them. They’re also prohibited from selling or transferring a person’s email address after they request to unsubscribe from receiving additional emails. The FTC says the only exception to this rule is that a business may transfer the email addresses on its mailing list to a company it has hired to help it comply with the CAN-SPAM Act.

“Once you put in your personal email [to opt out], then that business has 10 business days from the time you enter it to delete your email from their system. They cannot resell that specific email address to anyone else,” said Andrew Sternke, chief executive officer and private investigator at Juris Disputes & Investigations, a Texas-based cybersecurity firm.

More from VERIFY: Yes, the Facebook Protect security email is real

But Sternke warns that businesses could have already sold a person’s email address before they submitted an opt-out request.

“This is basically self-regulated. There's nothing saying that they didn't already sell your email prior to you opting-out — they just can't do it once you opt out,” Sternke told VERIFY.

The FTC says any commercial email sent from a business after a person has requested to unsubscribe from its mailing list is in direct violation of the CAN-SPAM Act and is subject to penalties of up to $46,517 per infraction.

“If a consumer provides their email address (or any other personal information) to a business and that business shares that information after promising that it would not share it or uses that information differently from its stated purpose, the company could face a potential enforcement action from the FTC,” an FTC spokesperson told VERIFY.

More from VERIFY: VERIFY Fact Sheet: 5 tips to spot email scams