I just started generating random addresses and putting them in password manager. The actionable bit is permanently black-holing all incoming mail to that address if/when I no longer need the service, or the "spam" rate gets too high.

I use gmail, so I just use the "Report as spam" option. I'm assuming Google uses that information in some way when calculating spam scores. So if enough people do the same, those emails will just start getting sent to spam automatically for huge amounts of people, and therefore punishing those folks for doing it in the first place. That seems more effective to me.

And I just never really had that big of an issue with spam where I needed to black-hole a specific email address. So for me it just wasn't worth the effort.

Yesterday I used the report as spam feature on an email from Microsoft.

The footer had no unsubscribe option and the "manage communication preferences" requires a login/password combo that I couldn't be bothered to reset for my new geolocation.

I doubt this'll make a dent in Microsoft.com's spam score.

People using "report as spam" is what made gmail such a great spam filter. Is also the reason google has such high market share of public email addresses. It's also why people running their own mail servers are afraid of being blacklisted by google.

More than 3 years ago I moved from a single gmail address that had a ton of spam, to a Fastmail wildcard domain with a rule for each individual/company that emails me. I use a randomly generated, 7-character username created from a-z and 0-9 for each address, stored in my password manager. eg. The email address for my Reddit account might be [email protected].

While I think this scheme is perfection in terms of privacy and security in knowing which company sells or breaches my email address... the fact is I haven't gotten a single unsolicited email in the entire 3+ years. Not a single message that hit a spam/junk filter, and not one email that wasn't expected based on whitelisted rules. The closest exception is Amazon who shares your email address with their shippers for delivery notifications; while I do receive 3rd party mail regarding legitimate Amazon deliveries, I've never received any spam to that Amazon address.

I have come to a conclusion as to why I have never received a single spam email since switching to this scheme. When I transitioned my GitHub account away from the old gmail address, I used the privacy option to not publish my REAL email address in Git logs pushed to GitHub. I deleted my old repos, and re-imported using the GitHub-wrapped email address. Thus I surmise that for those of us who are developers pushing code to public Git repositories, the vast majority of the spam you receive is because your email address can be very easily scraped from those Git logs.

I expect to migrate back to a single email address in the future, for a singular reason: as I get older I cannot imagine managing these email filters and password manager entries. Eventually I will need to simplify things.

I just search my email for the company name or the address I used.

The action one can take is that if the address is distributed and you start receiving unwanted mail, you can filter out messages to that address.

> Sure, I can send them a nasty email, but it'll just get ignored or whatever.

If you're in the EU, then send it to their DPO instead, and CC the national data protection authorities.

I don't think it's quite that simple. Ignoring the fact that I'm not in the EU, the company would also have to have some sort of presence in the EU for that to have any effect. And then which company do I send it to? The original one? Or the one they shared my address with and is now spamming me? Presumably the latter, since they are the one sending the spam. But if the initial company shared my email address with that company, they probably shared it with a lot of others, too. And what are the chances someone who has resorted to these sorts of tactics is going to care anyway?

> he company would also have to have some sort of presence in the EU

If you were in the EU, they wouldn't have to have presence in the EU to fall under GDPR.

> And then which company do I send it to?

Both! One shared your data with a third party without your explicit consent, for non-essential reasons, the other one is processing it without your explicit consent.

> And what are the chances someone who has resorted to these sorts of tactics is going to care anyway?

Depends. A lot of business do awful stuff for as long as nobody cares enough to start raising fuss about it.

Speaking of that, for extra effect, complain about it on Twitter and Facebook, linking relevant companies' public profiles/pages. In general, it seems a lot of companies (particularly non-tech ones) are extremely sensitive about social media posts.

> And what are the chances someone who has resorted to these sorts of tactics is going to care anyway?

https://www.enforcementtracker.com/

(And the rules here: https://gdpr.eu/fines/)

> There's just nothing actionable to do with this information.

Of course there is. When it happens I add an entry to my procmailrc that routes those emails directly to my spam folder, and I never see them again. And I never do business with that company again.

Maybe there is a way to publicly shame them, even if only a low fraction of users forwards bad actors to a collaborative list