A professional association directory lists members by real name, designation and employer, and some directories publish a contact email address. Using one dedicated alias as that published address keeps the member reachable while the primary inbox address stays out of it.
Member directories
Associations publish directories as a networking tool, and the amount of contact detail shown depends on the association and on the software it uses. The Casualty Actuarial Society relaunched its public directory in April 2025 with four member settings: Full Profile Display, Limited Profile Display, Limited Profile + Email, and Do Not Display My Profile. Full Profile Display includes the member's primary email address. Limited Profile Display leaves out contact details and location. Limited Profile + Email adds the email address back to the limited display. Do Not Display My Profile removes the record from the public directory altogether.
Other associations leave the choice to administrators rather than to individual members. Documentation from the Junior League states that administrators control which personal information fields are visible, that members can hide specific fields including an email address where the administrators have enabled that option, and that members should be told when a previously hidden field, such as an email address, is switched on. A Novi AMS cheat sheet lists three visibility levels: listings open to the public, listings visible to the public with contact information restricted to logged-in members, and listings restricted to certain member types, with separate settings for hiding a record, hiding contact information, and hiding an address. A directory listing and a published email address are therefore two separate settings, and neither should be assumed private without checking the member's own profile.
Harvesting of published addresses
An email address on a public web page can be collected by automated software. MembershipWorks states that spammers look for addresses to add to spam lists and that an address shown in a members directory can be harvested with ease, and its default is not to display email addresses in a directory. The same reasoning sits behind contact form features on membership platforms, covered in a later section.
A harvested address tends to stay in circulation after collection. Copies can be resold and reused by senders the member has never dealt with, so unsubscribing from one sender does nothing about the other copies already held elsewhere. Suped, a deliverability vendor, notes that a scraped list gives no guarantee that an address still belongs to the person or company expected, and that a public email address alone does not establish permission to send marketing. No published count exists of how many association directories expose email addresses, and no source measures spam volume caused specifically by directory harvesting, so this article states the mechanism and gives documented examples rather than a prevalence figure.
United States law
The CAN-SPAM Act, the United States federal law on commercial email, sets rules for senders rather than a barrier against collection. Commercial messages must carry accurate sender information, a valid physical postal address, and an opt-out mechanism that stays working for at least 30 days after sending, with opt-out requests honoured within 10 business days. The address harvesting provision, section 7704(b)(1) of the statute, treats sending to addresses obtained by automated means from a website or online service that stated it would not transfer addresses for email marketing purposes as an aggravated violation where the sender knows, or has knowledge fairly implied by objective circumstances, that the addresses came through that harvesting method. The statute text sets out that provision together with the opt-out and postal address requirements.
Penalties under the Act fall on the sender after a violation. MAJ Leads, which states it checked the Federal Trade Commission compliance guide on 3 November 2026, and Suped, updated 25 October 2026, both report that each separate email in violation is subject to penalties of up to $53,088. The figure is adjusted for inflation over time, so it should be confirmed against the guide before reliance. A penalty of that kind does not delete a published address from circulation, and it does not stop a scraper from collecting the address in the first place. Association rules on member data govern the association itself, not third parties. Guidance from the American Psychological Association to its division leaders, updated in May 2024, states that member email addresses may be used only for division-related business, for one-time use, and may not be given or resold to another user without permission from the chief executive or a designee. Those rules restrict how the association handles the data. They do not restrict what a third party does with a public page.
Directory privacy settings
The directory setting itself is the strongest control available to a member, and it should be checked at joining, before the first directory refresh publishes the listing. The Casualty Actuarial Society example shows the range a member may find: full display, limited display, limited display plus email, or no display. A member who wants the networking benefit of the listing without publishing a contact address can select the limited display option, which keeps name, designation and employer visible while leaving out contact details. A member who wants to be contactable through the directory can select the option that adds the email address back, or use a contact form where one exists.
Where no per-member setting exists, the choice narrows to asking the association to hide the listing or accepting publication. WildApricot documentation notes that members can hide a public profile altogether by unchecking the option to show the profile, which removes the listing as well as the contact details. A hide option cannot be assumed to exist. It has to be checked in the member's own profile.
Contact forms
A contact form lets a visitor send a message without seeing the member's email address. Novi AMS states that its contact form option removes all email addresses from the member directory and replaces them with a link to a form, with the stated purpose of preventing web scrapers from harvesting members' email addresses. Novi's documentation also notes that messages sent through the form are delivered to the member's primary email, and that a member who replies reveals the reply address to the sender. MembershipWorks applies a similar design, with sender verification and a spam check before delivery, plus a report spam link in delivered messages.
A contact form reduces exposure to automated harvesting, but it does not remove exposure to senders who are people. Novi's documentation states the limit directly: the form curtails bots and web scrapers, while human beings still have access to use it.
One alias per association
A dedicated alias per association sits between the directory controls and the primary inbox. The member gives the association one alias address, uses it as the directory contact address where the directory shows one, and keeps the primary inbox address out of the association's published materials. Mail sent to the alias forwards to the primary inbox, so the member stays reachable through the listing. If the alias starts receiving spam, the member pauses or deletes that alias and the spam stops, while the membership, the real-name listing, and the primary address are unchanged.
The alias is the published contact address, not a different identity. The listing still carries the real name, designation and employer, and the membership itself is held under the real identity.
Separation also identifies the source of unwanted mail. Mail arriving on the association alias came through the association's directory, events, or mailing lists, because no other service was given that address. A directory breach or a scraped listing then affects one alias, not the primary address used for banking, work, and personal correspondence.
| Directory option | What visitors see | What happens when spam arrives |
|---|---|---|
| Primary address published | The primary inbox address | Spam reaches the primary inbox directly, and the address cannot be changed without changing the inbox |
| Dedicated alias published | An alias that forwards to the primary inbox | The alias is paused or deleted, and the primary address is unchanged |
| Contact form only | No address, only a message form | Automated harvesting is reduced, but human senders can still use the form |
| No public listing | No record in the public directory | No directory exposure, and no networking benefit from the listing |
An alias has limits, stated here as properties of the method. An alias does not stop a human sender from using a directory contact form, and it does not hide a name, employer, or designation from a public listing. It does not protect an address the member gives the association for billing, voting, or internal administration, since those addresses are usually held privately by the association rather than published. It does not repair a primary address that is already published in a directory. For an existing listing, the member needs to change the published address to the alias and, where the association offers it, update the directory privacy setting at the same time.
AliasFleet managed aliases
AliasFleet provides email aliases that forward to a verified destination inbox. A member creates one alias for an association, for example on a personal subdomain, and gives that alias to the association as the contact address. Mail sent to the alias arrives in the primary inbox, and replies can be sent from the alias so the primary address is not revealed in correspondence. When an alias starts receiving spam, the member disables it in one click, and mail to that alias stops. The free plan includes 10 active aliases, which covers one alias per association for most members, and the pricing page sets out the free plan limits and the paid tiers. The documentation covers alias creation and management. AliasFleet does not hide a member's name from a directory listing, does not change an association's directory settings, and does not remove an address that is already published. Those remain the member's and the association's decisions.
Listings published before the change
A member who has already received spam on a primary address through a directory should first check whether that address appears in breach data, before deciding whether the exposure is limited to directory harvesting or part of a wider breach. Have I Been Pwned provides a search of addresses against breach data, and its frequently asked questions explain what a result means and what it does not prove. If the address appears in no breach data, the likely route is directory exposure, and changing the published address to an alias closes that route. If the address appears in breach data, the member faces a wider exposure than one directory listing, and the alias change still applies, alongside the measures that follow from the breach itself.
At joining, the sequence is short. The member checks the association's directory privacy settings and selects the display option that matches the visibility wanted, then gives the association a dedicated alias as the contact address rather than the primary inbox address. If the alias attracts spam, the member disables it and, where the association allows it, replaces the published address with a fresh alias. A scraped copy of the listing then contains an address the member can delete rather than an address the member cannot change.
Top comments (0)