How to find out who sold your email address
You usually can't. Spam doesn't say where your address came from, and whoever sent it bought the list from somebody else. Knowing means having given each company its own address before you signed up.
Why the message itself tells you nothing
The name on a spam message is whoever bought the list. That’s almost never the company that sold it, and the sender often doesn’t know who did. Headers can be forged, and honest ones only record the last hop.
An address that leaks in January can be resold four times before the first junk mail arrives in May. By then there is no thread back to the company you gave it to.
Plus addressing gets you halfway
Gmail and several other providers let you put anything after a plus sign and still receive the mail. Sign up as you+shoes@gmail.com and any spam addressed to that exact string points at the shoe shop.
Plenty of signup forms reject the plus sign, so you can’t use it where you most want to. And stripping everything between the plus and the at sign is one line of code that list cleaners run routinely. It works until somebody bothers.
Breach databases answer a different question
Have I Been Pwned tells you which known breaches include your address. A breach is a company losing your data. Selling it is a decision, usually made with permission buried in terms you accepted, and it shows up in no breach list anywhere.
It also reports after the fact, so you can change the password without ever finding out who to blame.
The one method that names the source
Give every company an address only it has. When mail turns up at that address from somebody else, the address is the evidence. The shoe shop got shoes@your-domain and nobody else did, so the shoe shop passed it on.
This only works if you do it before you sign up. You can’t apply it backwards, which is why most people asking never find out.
What to do about the address you already have
Unsubscribing usually works. What it can’t do is take the address back: it stops one sender, and the address stays on every list that bought it. Filtering hides the mail. The address is still out there.
Leave your existing address where it is and stop adding to the pile. Every new signup from today can have its own address, and in a year everything you joined since is traceable.
Where Rovatrove fits
Rovatrove issues a working address for each service you sign up to. It’s a real address on a real domain, so confirmation links and verification codes arrive normally and forms accept it.
No two services share an address, so mail arriving at one identifies the service that let it out. When you’re done with that service the address is retired: mail sent to it afterwards is dropped, and it’s never reissued to anyone else.
Questions people ask
Can you tell who sold your email address from the spam itself?
You usually can't. Spam doesn't say where your address came from, and whoever sent it bought the list from somebody else. Knowing means having given each company its own address before you signed up.
Does plus addressing show who leaked your address?
Sometimes. Mail addressed to you+shop@gmail.com does identify the shop, but many signup forms reject the plus sign, and removing everything between the plus and the at sign is trivial and routine for list cleaners. It works until someone bothers to strip the plus.
Will Have I Been Pwned tell me who sold my address?
No, it answers a different question. It lists known breaches containing your address. Selling your details is usually legal and deliberate, leaves no breach record, and so never appears there.
Is it legal for a company to sell your email address?
In many places, yes, if the signup terms you accepted allowed sharing with partners. That is why the trail goes cold: nothing was broken, so nothing was reported.
Can I find out retroactively for accounts I already have?
Not reliably. Identifying the source depends on each company having been given a different address at signup, which cannot be applied after the fact. What you can do is change the address a service holds going forward.
Does unsubscribing remove my address from the lists that bought it?
No. Unsubscribing stops one sender. The address stays on whatever lists it was sold to, which is why unsubscribing feels ineffective even when it worked exactly as intended.