Most people who care about email privacy end up thinking about how to hide themselves. There are plenty of ways to do it with Gmail, but none are actually as safe as you think. Gmail doesn’t give you a good way to keep your identity private, even if you try using multiple emails. The best way is just to move on and use the services built for privacy and aliases.
Gmail tricks don’t actually hide who you are
Google profits by keeping your real email visible
Google’s email service has two well-known tricks that let you tweak your address without breaking delivery. You have the dot trick, where you can add periods anywhere in your username, and addressing, where you tack a plus sign and some extra text onto the end. Google ignores both when routing your mail, so everything lands in your inbox.
People use these to sort their email or figure out which companies are selling their data or training AI. The problem is that neither trick actually hides who you are. There’s no encryption or anything special going on. The real address underneath is still plainly visible, and any automated system can figure it out in seconds.
The advertising industry is pretty good at fixing this. When you hand your email to a website, these systems quietly clean it up by stripping dots, chopping off the plus sign and everything after it, and lowercasing everything, before turning it into a tracking identifier. So whether you sign up somewhere as u.s.e.r.name+newsletter@gmail.com or username+shopping@gmail.com, the system processes both as plain “username@gmail.com” and generates the same tracking token either way. Your identity never actually changes.
On top of that, if a site using one of your plus addresses gets breached, the leaked data gets picked up by data brokers who strip it back to your real address and attach it to whatever they already have on you.
This is how most people make aliases on Gmail, but it’s no secret that Google makes a lot of its money from advertising. It would be hard to sell to advertisers if the company can’t consistently identify users across websites and devices and build profiles around them.
So if you’re trying to be safe and private, making another Google address isn’t the answer. You need something truly different.
Email aliases keep your real inbox out of sight
Temporary addresses disappear before anyone can track you
Many people turn to temporary email alias services to avoid tracking and profiling. These services work by generating random, disposable email addresses that act as a middleman between the outside world and your real inbox. Instead of handing out your actual email address when signing up for something online, you give out one of these stand-ins, and any mail sent to it gets forwarded straight to you.
These aliases work well because they’re built to disappear. You can set them to expire after a certain date, after they’ve received a certain number of messages, or once they’ve sat unused for a while. When an alias dies, the connection is gone for good. Anything sent to that address after the fact just bounces back to the sender, and your real inbox never sees it.
The way these services handle your data under the hood depends on what kind of alias you’re using. For truly temporary, short-lived addresses, everything is designed to leave no trace. Incoming messages pass through the system and sit briefly in memory rather than ever being written to a hard drive, then get wiped automatically.
There’s nothing left to find if someone were to compromise the server. For more permanent alias services that you keep and reuse over time, the method is different. In that case, your alias and where it points do need to be stored somewhere. To protect that information, modern services encrypt it and make sure the decryption keys stay tied to your login session rather than sitting on the provider’s servers in a readable form.
Aliases aren’t perfect but they are still worth using
You can just manage your inbox the old-fashioned way with spam filters, blocking senders, plus-addressing, and inbox rules that dump junk straight into the trash. For keeping your inbox clean, that’s not so bad. The problem is that none of that actually stops anything from happening on the backend. It just hides the mess from you.
Your real email address is still out there, still tied to your identity, and that link never gets broken. When a website gets breached, which happens constantly, data brokers, bad actors, and anyone else who wants your information go and scrape those leaked databases. They’re not fooled by plus-addressing tricks or dot variations.
From there, they check it against everything else they have, like purchase history, physical addresses, phone numbers, and IP logs. It all gets stitched back together into a profile with your name on it. Your spam filter can’t save you from that.
The problem is that the privacy route comes with its own issues. The most annoying one you’ll run into pretty quickly is that a lot of websites just reject these kinds of emails outright. Many sites run checks specifically designed to catch disposable or proxy addresses and throw an error before you can even create an account.
So you end up in this constant rotation, trying different alias domains, sometimes buying a custom domain just to fly under the radar, and occasionally giving up on a service entirely because it won’t let you in.
I’ve had issues with 2FA codes failing, even though the website let me sign up with the email. So this can be a limited option.
This is a good solution, even if it’s not perfect
Alias services aren’t a perfect answer, but they work well in many cases. A surprising number of websites are already looking for disposable addresses, and I’ve personally run into cases where there were issues. Even still, if your goal is to break the link between your real identity and the sites you hand your email to, this is one of the few approaches that actually does it. You could always try Proton if you’re looking for a more secure way to check your mail daily, since it is built with privacy in mind.
