An email address contains no home address, but a home address can still be traced from one through records that join the address to a name and the name to a home address. The address acts as a stable identifier across signups, breach files, public profiles and broker records, and people-search reports built from those records can list current and previous addresses. Some breach files already contain a home address alongside the email address, so no second step is needed in those cases. No source read for this article gives a measured probability that one email address leads to a correct current home address, so no such figure appears here.
Email addresses as identifiers
Stability and reuse give the address its power as an identifier. One address typically stays in use for years, across jobs and services, and each registration made with it adds another thread that can be traced. An analysis of what an email address reveals calls the address stable and connective, tied to almost everything the owner has signed up for, and notes that breach membership alone tells a researcher which service held an account at the time of a breach. The local part often repeats a username used elsewhere, so the address can also give away a handle, and that handle leads onward to forum posts, reviews and old social accounts.
A further link comes from account existence checks. An email investigation guide describes tools that test whether an address holds an account on more than a hundred websites without alerting the owner, and notes that the list of services tied to an address opens the next pivot. The guide gives the limit in plain terms: email investigation usually turns up linked accounts, identity and activity, not an exact home address directly. The address leads to a name, and the name leads to the address.
Breach records
Breach files form the most common first link, because breach search tools index by email address. Have I Been Pwned is a free breach search service created by security researcher Troy Hunt, and at the time of writing its homepage lists 1,048 pwned websites and 17,846,896,404 pwned addresses. A breach result does not hand a stranger the leaked data; it shows which breaches included the address and which types of data each breach exposed. A guide to checking breach exposure states the same limit: a clean result means the breaches loaded into the service do not contain the address, not that the address never leaked.
Where a breach file already pairs a home address with the email address, no second step is required. A count of the public breach list on 10 October 2026 found 108 breaches added between 1 January and 10 October 2026, covering about 539.8 million accounts; 62 of the 108 included home addresses, 84 included names and 68 included phone numbers. A breach guide covering the same service describes the scale in similar terms, with more than 17.8 billion breached accounts from over 1,000 websites as of September 2026. Leaked data also keeps its value after passwords change. Kaspersky notes that breached data can stay useful for a long time, because an email address, a phone number, a home address or a date of birth can be combined with newer information from another source for some forms of identity fraud. A breach check therefore answers two distinct questions: whether known breaches contain the address, and what each breach exposed.
People-search reports
A people-search report is the step that converts a name into a home address. The US Federal Trade Commission describes people-search sites as a type of data broker, and states that such sites may buy information from other data brokers, gather information from public social media profiles, and compile federal, state and local government public records. A report bought from one item of information, such as a name or phone number, can contain current and previous addresses, other names used, properties bought or sold, and the name and address of family members, according to the FTC. The report exists because public records and broker feeds already contain the address; the email address only supplies the route to the name.
The FTC also sets out the limits of that mechanism. Opting out stops a site from selling the information it holds, but the information stays in public records, so the same facts remain available on a government website. Information can return if public records change, and a person's details can still surface in the reports of relatives, neighbours or associates. A people-search match therefore links a name with an address; it does not prove the record is current, or that it describes the right person where several people share a name. Accuracy differs from site to site and record to record, and a listing can be wrong, stale or about another person.
Public records
Much of the address material in a people-search report comes from public records, and that supply has nothing to do with email. The FTC names property records, driving records, voter registration information, criminal and civil records, and birth, marriage, divorce and death records among the public record sources that people-search sites compile. A home purchase, a voter registration or a court record can therefore put an address into a broker file with no email address involved at all.
Advice from 2007 still holds at the level of the mail system. An answer from Ask Leo states that a free mail provider never held a home address alongside the address in the first place, and that an internet provider holding a billing address does not disclose it to a stranger, releasing such information only in response to legal action or a court order. The same answer places the risk on what the owner shares, and on merchants that collect an email address, a physical address and a phone number together and then fail to protect the combined record.
Data broker trade
The trade behind people-search reports was described by the FTC in a 2014 report titled "Data Brokers: A Call for Transparency and Accountability", based on a study of nine data brokers. A summary of that report records the FTC definition of data brokers as companies that collect personal information and resell or share it with others, and the finding that consumers had little access to or control over information once brokers obtained it, because the data was gathered, analysed and passed between many sources. The FTC recommended that Congress give consumers an easy way to identify which brokers held their information and to control it, require brokers to disclose the types of information they acquire and sell, and require disclosure of the original sources of the data. The trade runs on records the consumer never gave the broker directly.
Removal and opt-out
Removal works in parts, and the same sources that describe the trade state its limits. The FTC describes two routes for people-search opt-out: working through sites one by one for free, or paying a service to do it. California has moved beyond the site-by-site model. The California Privacy Protection Agency operates the Delete Request and Opt-out Platform, known as DROP, which lets California residents send a single deletion request to all active data brokers. Brokers must check DROP and act on deletion requests at least once every 45 days from 1 August 2026, and face fines of $200 per day for each request left unprocessed.
Senate Bill 362, the California Delete Act behind DROP, was signed in October 2023, and the consumer platform launched on 1 January 2026, with more than 500 data brokers registered at that point according to a summary of the law. A separate analysis of the Delete Act regulations confirms the same dates and the same penalty, and adds that non-California residents cannot use DROP, because consumers must have their California residency verified. Residents of California have a single-request system, and residents elsewhere still face the site-by-site route. Deletion also carries exemptions, including information a broker holds in a first-party capacity. No system covering all jurisdictions was identified in the sources read.
Email aliases and the join key
AliasFleet provides email aliases that forward mail to a verified destination inbox, and the product touches this subject at one point in the chain: the signup step. With a different alias at each site, a breach at one site leaks only that site's alias, not the address used everywhere else. A broker file built from that site's records then contains the alias, not the main address, unless the owner links the alias to a real identity elsewhere, for example by posting the alias alongside a real name in a public profile. Pausing or deleting an alias stops new mail from that site reaching the inbox, but it does not remove records brokers already hold, and it does not take a home address out of public records. An alias therefore cuts the link for future records; it cannot remove a link already formed.
That limit keeps the alias claim narrow. An alias used at one site and nowhere else gives a broker file built from that site nothing to join to a real identity, while an alias reused across many sites, or paired with a real name in public, gives the same file the same join the main address would have given.
Exposure checks
A breach record is the starting point for checking exposure, because that record states what was exposed. A guide to checking a compromised address recommends opening each listed breach, reading the affected service, the breach date and the exposed data types, and repeating the search for every address in use, including old addresses still linked to bank, shopping or social accounts. A government breach guide recommends monitoring bank statements, insurance records and credit reports for unusual activity after a breach.
The check carries a limit that the breach services state themselves. A clean result means the breaches loaded into that service do not contain the address, and some sensitive results appear only to the verified owner of the address. A result listing a breach does not prove anyone used the leaked data, or that the account is still open.
Top comments (0)