Nowadays there are a lot of systems that send us automated emails that contain potentially sensitive data. For instance, if I buy something online, I will probably get an email receipt that may contain the price I paid, my home address, and the item I bought. Or I could get a utility bill emailed to me that says how much electricity I used in the last month. Or yet again, I may do a password reset somewhere and get a link emailed to me to set a new one.

In all of these cases, I cannot ask the sender to use PGP or similar end-to-end encryption. I also can't ask the sender to suppress sending the message in the first place - for instance, PayPal does not allow you to disable purchase notifications.

I am concerned about my this data being read by third parties, either in transit (not everyone uses SMTP TLS, unfortunately) or at rest on the email server (there are encrypted email providers, but I have no reason to think they will not submit to government snooping demands - even ProtonMail).

What recourse do I have to suppress this form of privacy risk? (Am I just stuck with it?)


2 Answers 2


Your question appears to be "I don't like elements of the service a provider is offering".

If the service does not provide the level of privacy mandated by law in your jurisdiction, then report the matter to the relevant authority.

If you've asked the provider to improve their service and it still does not meet your expectations, then stop using it.


Since you mentioned SMTP TLS, I see one possible option: run your own mail server and accept incoming mail only over a secure channel. By doing this you may experience problems with some mail servers that are not up to date or properly configured to handle TLS.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .