7.2 Email privacy

Email is an old technology that still carries much of the world's paperwork. It was designed for openness and reliability, not secrecy.

That history shows in how messages move across networks, how they are stored and how accounts are managed, all shaped by decisions made decades ago. Modern threats exploit those decisions, while modern users expect privacy by default. Bridging the gap takes realistic choices, not perfection.

Legacy systems, modern threats

Email is more like a postcard than a sealed letter. The message content can be protected with end-to-end encryption, but the surrounding details are normally visible to every server that handles it:

• sender and recipient addresses;
• timestamps;
• sometimes routing headers that show where the message travelled.

Most email now travels between servers with encryption "in transit" (usually TLS), which stops casual eavesdropping on the network. It does not stop the providers themselves seeing the content, and it does not remove the metadata that routes the message.

The threats have shifted too. For many people, the biggest risks are account compromise, phishing and years of archived messages, not sophisticated interception on backbone networks. Email sits at the centre of password resets, account recovery and billing. A compromised inbox becomes a pivot into many other services, and old messages can be used to answer security questions or impersonate you convincingly.

Myth: "encrypted email" means the same privacy as a secure messaging app. Reality: even with the body encrypted end-to-end, the subject line is usually visible, as are the addresses. That is not one provider's flaw; it is baked into how the system works.

Provider trust

Every email provider can technically access messages stored on its servers, unless you use end-to-end encryption and keep the keys yourself. This is not just about good or bad intent. Providers need access for:

• spam filtering;
• search;
• backup;
• legal compliance;
• abuse handling.

Many also monetise data in aggregate, and some rely on advertising profiles tied to account activity. Even providers with strong privacy promises have to operate within the laws of their jurisdictions.

In the UK, providers can be required to retain or disclose information under various powers. That does not mean everyone is monitored, but your provider's location and corporate structure can affect your exposure. Keep your threat model realistic:

• routine messages about appointments or shopping: a mainstream provider might be fine;
• working with sensitive sources: you will need stricter controls.

You do not have to go all-or-nothing. Practical steps:

• separate everyday correspondence from sensitive conversations;
• use a provider with a stronger privacy posture for the sensitive ones;
• keep account recovery options minimal;
• prefer a provider that supports hardware security keys and app-specific passwords; it is generally easier to lock down than one relying on SMS codes.

None of this removes the provider from the picture, but it cuts the chance of account takeover and limits the damage if it happens.

Metadata permanence

Email generates metadata automatically: who wrote to whom, when, from which device or IP address, and how the message moved through the network. This metadata is often as revealing as the message itself. One thread can expose patterns of work, travel, relationships or organisational structure.

Because metadata is useful for debugging, abuse prevention and compliance, it tends to be kept for a long time and copied across logs. Delete a message and copies may still exist in backups, on recipients' servers or in audit logs. Not sinister, just how large systems stay reliable. But it means "delete" often means "gone from your inbox", not "expunged everywhere".

So for everyday use:

• assume metadata has a long shelf life;
• keep sensitive details out of subject lines and headers;
• use separate accounts for different roles, so no single place holds a complete map of your life.

Myth: a different device or a VPN hides email metadata. Reality: it can hide your IP address from the provider or recipient, but not the sender, recipient or time. And it does not stop the provider seeing the content unless you add end-to-end encryption on top.

Aliases and compartmentalisation

Aliases are extra addresses that deliver to your main inbox. They are handy for:

• cutting spam;
• spotting where your address leaked;
• separating online roles.

Some providers let you create them on the fly; others offer a fixed set. They are simple compartmentalisation: if a shop's copy of your address is breached, you disable that alias and keep your personal inbox.

Know the limits. If every alias ends up in the same inbox, they are still linked behind the scenes. Your provider, or anyone who gets into your account, can see the connections between roles.

Need stronger separation? Use distinct accounts with separate recovery methods and, ideally, separate devices or browser profiles. For example:

• a journalist keeps a public address on a mainstream provider for press releases, and a more hardened account for talking to sources;
• a freelancer keeps clients in one account and personal mail in another, so an accidental forwarding rule cannot expose private messages.

Aliases also shape recovery. If they all map to one account and it is compromised, the attacker inherits every alias. Separate accounts mean more complexity in exchange for a smaller blast radius. The right choice depends on how much inconvenience you can tolerate and what you are protecting.

Attachments and tracking

Attachments feel like "just files", but email adds extra risks.

• Opening in webmail: the file may be scanned or converted, and a copy stored temporarily on the provider's systems. Usually good for security, but the provider can access the file.
• Downloading and opening locally: safer in some ways, but risky if the file contains malware or hidden scripts.

Tracking is the quiet part of email. Many messages embed invisible images or unique links so the sender can see when, where and on what device you read them. Not just marketing: newsletters, event invitations, even individual messages from someone whose tool adds tracking automatically.

The fix: disable remote images, or set your mail client to ask before loading them. That stops most tracking pixels firing. Some clients also strip tracking parameters from links, which cuts follow-on tracking when you click.

The trade-off:

• blocking images can make legitimate emails harder to read;
• it does not stop all tracking: a sender can still tell you got the message if you reply, click a link or download an attachment.

For sensitive conversations, exchange files through a secure file-sharing method rather than attachments, and treat links with caution even when they seem to come from someone you know.

Practical choices for everyday email

Email privacy is less about one perfect tool and more about boundaries that fit your daily reality. For most people, the effective steps are simple:

• use a reputable provider;
• turn on strong two-factor authentication, with a security key if possible;
• keep personal and work accounts cleanly separate;
• be careful what goes in subject lines.

When you genuinely need stronger privacy, add end-to-end encryption with tools that manage keys on your own devices, and accept that email becomes less convenient and less compatible with people not using the same approach.

The system's constraints are not going away, and most risks cannot be eliminated. But you can make it work for you by knowing where the privacy boundaries really are and choosing friction where it matters most.