Every time you sign up for a newsletter or an online service, privacy laws set rules for how your personal information is collected, stored and used. Over the past decade, data privacy has gone from a niche legal topic to a major one.
Governments have recognized that unchecked data collection leads to profiling and identity theft, and many have passed laws that give people rights over their data and put obligations on companies. Knowing the basics helps you use those rights.
The General Data Protection Regulation (GDPR)
The European Union's General Data Protection Regulation (GDPR), in force since May 2018, is the most influential privacy law so far. It defines personal data broadly: any information relating to an identified or identifiable person, not just things like ID numbers.
Under GDPR, personal data includes your name, home address, IP address, device fingerprints, cookie identifiers, and crucially, your primary email address. The law rests on seven principles:
- Lawfulness, fairness, and transparency: Organizations must have a legitimate legal basis to process data and clearly explain their practices.
- Purpose limitation: Data collected for one specific purpose (e.g., shipping an order) cannot be repurposed for another (e.g., targeted ad tracking) without explicit consent.
- Data minimization: Companies must only collect the minimum amount of data necessary to fulfill their stated purpose.
- Accuracy: Reasonable steps must be taken to keep personal data accurate and up to date.
- Storage limitation: Data must not be retained longer than necessary.
- Integrity and confidentiality: Appropriate technical and organizational security measures must be maintained.
- Accountability: Data controllers must demonstrate continuous compliance with all principles.
The GDPR also applies outside the EU. Any company that offers goods or services to people in the EU, or monitors their behavior online, has to comply, or face fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher.
CCPA and CPRA: California
The United States has no single federal privacy law, so individual states have passed their own. The most prominent is California’s Consumer Privacy Act (CCPA), enacted in 2018 and later expanded significantly by the California Privacy Rights Act (CPRA).
The CCPA/CPRA gives California residents more insight into and control over how businesses use their personal information. Key elements include:
- The Right to Opt-Out: Consumers can instruct businesses not to "sell" or "share" their personal data with third parties (the origin of ubiquitous "Do Not Sell or Share My Personal Info" footer links).
- Limiting Sensitive Personal Information: Consumers can restrict the processing of precise geolocation, racial or ethnic origin, contents of private communications, and biometric identifiers.
- Private Right of Action: In certain cases of data breaches involving unencrypted or unredacted personal information, consumers can sue companies directly for statutory damages.
Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah, Texas, Oregon and other states have since passed similar laws, so protections now vary from state to state.
Other Key Global Privacy Frameworks
Many other countries have laws based on or similar to the GDPR:
- Brazil’s LGPD (Lei Geral de Proteção de Dados): Closely modeled on the GDPR, Brazil's law sets out when data may be processed, requires data protection officers and allows significant fines.
- Canada’s PIPEDA and Digital Charter: The Personal Information Protection and Electronic Documents Act covers how private companies handle personal data; proposals to modernize it have been under discussion for years.
- United Kingdom’s UK GDPR & Data Protection Act: After Brexit, the UK kept the GDPR's rules in its own law.
- India's DPDP Act: The Digital Personal Data Protection Act sets obligations for organizations that process personal data in India.
Your Main Rights
The details vary by country, but most of these laws give you similar rights:
- Right of Access (Subject Access Requests): You can ask for a copy of the data a company holds about you and who they've shared it with.
- Right to Rectification: If a company's data about you is wrong or incomplete, you can ask them to correct it.
- Right to Erasure ("Right to Be Forgotten"): With some exceptions (such as records they must keep for tax or legal reasons), you can ask a company to delete your personal data.
- Right to Data Portability: You can ask for your data in a machine-readable format (such as JSON or CSV) so you can move it to another service.
- Right to Object and Restrict Processing: You can object to direct marketing and profiling, and withdraw consent you gave earlier.
Why Regulators Care About Email Addresses
An email address is rarely just a way to reach you. It works as an identifier that links your bank, social media, shopping and forum accounts.
When companies ingest your email address, they can cross-reference it against data broker databases and third-party advertising exchanges. To learn more about why companies value your inbox so much, read our detailed analysis on why every website wants your email address.
Because one address can unlock so much linked data, privacy laws require companies to have a legal basis for using it, explain what they do with it, and keep it secure.
The Practical Limitations of Privacy Regulations
Privacy laws help, but they can't protect you on their own:
- Enforcement Lag: Investigations often take years, and by then leaked or misused data has spread.
- Dark Patterns: Many websites design their consent screens to nudge you into accepting tracking.
- Breaches: a company can follow the law when it collects your email today and still be breached next year.
- Jurisdictional Blindspots: Some websites and data scrapers operate where regulators can't realistically reach them.
Share Less in the First Place
The best protection is data minimization on your side: data that was never collected can't be leaked, sold or misused.
Instead of giving your real address to every one-off service, free trial or forum and hoping they follow the law, use a disposable address from TempoEmails. Those sites then can't link what you do there to your real email.
For more, read our guide on protecting your identity online, or see the privacy policy for how TempoEmails handles your data.