> What action do you take when someone accidentally CCs another party when they should’ve BCC’ed, and your address is leaked?

I realize that it was a user error, am a bit miffed about it for two minutes, maybe mail them that they should be more careful with mail addresses.

If, OTOH, it's a business misusing my mail address intentionally and for monetary profit, I hope that regulators stomp on them.

Retaining email addresses doesn’t necessarily suggest deliberate misuse (or even accidental misuse), however. Unless you’re of the opinion that retaining it after, say, account closure/deactivation, is itself misuse.

I’d take a big issue to an organization storing a social security number or something of that nature, because its leak would represent a significant risk, but email addresses are fairly disposable items that we only voluntarily attach to ourselves to.

Disclosing mail addresses to all other users is misuse, albeit usually accidental misuse.