Email Privacy: How to Protect Your Address and Your Accounts

Protecting your email privacy comes down to four habits: only give out your address where it's needed, check whether it has already shown up in a data breach, stop emails from tracking you when you open them, and lock down access with unique passwords and two-step verification. None of them require technical know-how, and most take a single setup. Below you'll find each step explained, with the actual settings in Gmail, Outlook, and Apple Mail.

Why does your email address reveal so much about you?

Your email address works as a unique identifier that repeats across almost every service you use. It's your username for stores, social media, banks, and apps, and it's where password reset links are sent. Anyone who knows it can cross-reference different databases and figure out which sites you have accounts on, what you buy, or which lists you've subscribed to.

On top of that, whoever controls your inbox controls your accounts: with access to your email, an attacker can request a password change for any linked service. That's why it pays to treat your main address with the same care as an ID number, not as something you hand over on any form.

How do I know if my email was in a data breach?

The easiest way is to search for it on Have I Been Pwned, a free service created by security researcher Troy Hunt that collects data from public breaches. According to its own website (2026), the database covers more than 1,000 breached sites and more than 17 billion exposed accounts.

1. Go to haveibeenpwned.com and enter your email address.
2. Review the list of breaches it appears in and what data was exposed in each one (passwords, phone numbers, addresses, etc.).
3. Change the password for every affected service, and for any other service where you used that same password.
4. Turn on two-step verification for those accounts.
5. If you want to hear about future breaches, use the site's notification option (Notify me).

Showing up in a breach doesn't mean someone has gotten into your account, but it does mean your address is circulating on lists used by spammers and scammers. Expect more phishing attempts from that point on.

What are tracking pixels and how do I block them?

A tracking pixel is a tiny, often invisible image that's downloaded from the sender's server when you open an email. When it loads, it tells the sender that you opened the message, when you did, and, depending on your email client, your IP address. Microsoft calls them web beacons and explains that they're used to find out whether you read an email. The fix is to stop external images from loading automatically.

Gmail

On the web, open Settings (the gear icon), choose See all settings, scroll down to the Images section, and select Ask before displaying external images. Click Save Changes. According to Gmail Help, images are shown automatically by default, although Google scans them first and prevents the sender from getting information about your device or location. With the "ask" option, no remote image loads until you decide.

Outlook

In classic Outlook for Windows, automatic picture downloads are blocked by default. If someone turned them on, block them again under File > Options > Trust Center > Trust Center Settings and check the option to not download pictures automatically in HTML email messages. In Outlook.com, external images are loaded through Outlook's own service, which acts as a proxy; the setting is under Settings > General > Privacy and data. The Outlook apps for iOS and Android have a setting to block external images.

Apple Mail

On a Mac, go to Mail > Settings > Privacy and turn on Protect Mail Activity. According to Apple, this hides your IP address and downloads remote content in the background, so the sender can't tell when or how many times you open a message. If you'd rather not use it, turn on Block All Remote Content and Hide IP Address. On iPhone, the setting is under Settings > Apps > Mail > Privacy Protection.

Should you use a different address for different things?

Yes: separating addresses by use limits the damage from a data breach and keeps your main inbox clean. If a store you bought from once sells or loses its database, the spam goes to a secondary address and not the one you use with your bank or at work. It also lets you see which service shared your address when unwanted marketing starts showing up.

When does a temporary email make sense, and when doesn't it?

A temporary email works for one-off sign-ups where you only need to receive a code or a confirmation link and don't plan to come back. You can read more in our guide on what a temporary email is and when to use one and in how to receive verification codes without giving out your personal email.

On Mawlio, each address lasts 1 hour by default, and you can extend it with credits if you need it longer. Your inbox only shows emails that arrive after you get the address, and verification codes are highlighted so you can copy them with one tap.

There's an important limitation you should be clear on: when a temporary address expires, it can later be assigned to someone else. The new owner starts with an empty inbox and can't see your previous messages, but a future password reset email would go to that person. So never use a temporary email for accounts you'll need to recover: banking, work, government services, purchases with a warranty, or any service that stores your data. And don't use it to get around a service's rules, like creating multiple accounts to repeat a free trial.

How do I secure access to my email account?

The most effective step is combining a unique password with two-step verification. A unique password means you don't use it anywhere else: if a store's password database leaks, it can't be used to get into your email. A password manager helps you generate and remember a different one for every service.

Two-step verification adds a second factor, such as an authenticator app, a security key, or a passkey, on top of your password. Gmail, Outlook, and Apple all offer this in your account's security settings. While you're there, also review your active sessions, connected devices, and recovery email and phone number, and remove any you no longer recognize.

Frequently asked questions

Is it safe to enter my email on Have I Been Pwned?

It's a free, well-known service, and the search only asks for your address, never your email password. Make sure you type the domain correctly (haveibeenpwned.com). If a site asks for your password to check for breaches, be suspicious.

Does blocking images stop all tracking?

It blocks the most common method, the tracking pixel. Links in an email can still include parameters that identify who clicked, so don't open links from senders you don't know.

Do I need to change my address if it showed up in a breach?

Usually not. It's enough to change the affected passwords, turn on two-step verification, and stay more alert to phishing. Changing your address is only worth it if the spam has become unmanageable.

Can I reply to emails from a temporary address?

On Mawlio, yes, with a free account: you can reply, forward, or write new emails from the temporary address without revealing your personal email. If you also want to cut down on what's already reaching your inbox, see how to stop spam.

If you want a disposable email address on hand for your one-time sign-ups, you can get a free address on Mawlio, no sign-up required.

Sources

• Have I Been Pwned, home page (2026)
• Have I Been Pwned, About (2026)
• Google, Gmail Help: Choose whether to show images
• Microsoft, Block or unblock automatic picture downloads in email messages (in Spanish)
• Microsoft, External image protection in Outlook.com
• Microsoft, What is Block External Images in my settings?
• Apple, Change Privacy settings in Mail on Mac
• Apple, Mail Privacy Protection & Privacy (in Spanish)