In a world where nearly every business relies on email to reach customers, the question of how marketing platforms handle subscriber data has never been more urgent.
We examined the practices of top Email Marketing Suites (such as Mailchimp, Constant Contact, Klaviyo, ActiveCampaign, Brevo/Sendinblue, and HubSpot) to see if any are selling subscriber lists, a practice once common in print media, but strictly regulated under modern privacy laws.
Our investigation combs through policy documents, global regulations, and industry data to uncover the truth. Across North America, Europe, and Asia, platforms touting “privacy-first” mailing services are now facing intense scrutiny.
Do these popular platforms disclose or even profit from your list of contacts?
Data privacy experts emphasize that email addresses and related contact data are considered “personal information” under laws like GDPR and CCPA. As one recent analysis put it: “Data privacy laws generally stipulate that users must knowingly consent. That means buying email lists likely violates the consent requirements of the GDPR and the CCPA”.
In other words, any non-consensual sale of email lists could expose companies to huge fines. Despite this, our review finds wide variation in how platforms handle data. Some flatly forbid selling lists, others share certain data categories with advertisers, and a few terms seem surprisingly permissive. We scoured privacy policies, company statements, regulatory filings, and news archives to map out what’s really happening behind the scenes.
Major Platforms and Their Policies
We begin by reviewing each leading Email Marketing Suite on our list. For each, we quote official sources and document their stated data-sharing practices. In all cases below, we found no public evidence that any provider openly advertises “selling subscriber lists” as a service. However, some disclosures indicate third-party data flows that merit scrutiny.
Mailchimp (by Intuit)
Mailchimp is arguably the best-known email service, used by millions globally. Its reputation is for ease-of-use and strong branding. Intuit (Mailchimp’s parent company) explicitly denies selling user data or subscriber lists. In Mailchimp’s own privacy documentation (former policies), the company states unequivocally: “we never sell lists or email addresses”.
Similarly, Intuit’s site assures customers that “Mailchimp does not sell the personal information of our members, our members’ distribution lists, or our members’ contacts”. These assurances cover both subscriber contact data and the customer’s own email lists.
Mailchimp does collect user data (like campaign analytics) and uses tracking pixels to measure opens and clicks. But none of this appears to involve selling contact lists. Indeed, Mailchimp’s Terms of Use and Privacy explicitly forbid unauthorized list rental or sale. That said, European regulators have questioned Mailchimp’s compliance in other ways.
For example, a Bavarian data protection authority ruled in 2021 that simply transferring EU subscribers’ email addresses to Mailchimp’s U.S. servers could violate GDPR, even without any “sale”. The ruling doesn’t accuse Mailchimp of selling lists; rather, it highlights EU privacy concerns over U.S. access to data.
Mailchimp responded by advising EU users to implement additional safeguards or consider EU-based alternatives. In practice, Mailchimp’s stance is clear: they publicly oppose selling lists, but they must still navigate global privacy laws on data transfer.
Key point: Mailchimp’s own policies and statements disallow selling subscriber data. Any data-sharing beyond delivering emails is primarily for analytics or account security.
Constant Contact
Constant Contact is another leading provider, especially popular with small businesses and nonprofits. Its legal policy likewise promises never to trade subscriber lists. The company’s Privacy Policy bluntly states: “The Constant Company will not sell or rent your personal data to third parties”. Like Mailchimp, Constant Contact focuses on email delivery and analytics. Its policy does allow sharing user data in specific cases (e.g. legal compliance), but explicitly prohibits using subscriber lists for profit.
Although not directly tied to list-selling, Constant Contact has faced regulatory scrutiny on other fronts. For instance, it complied with EU Privacy Shield and later implemented Standard Contractual Clauses after the Privacy Shield was invalidated. Constant Contact’s ban on selling data is unambiguous.
Key point: Constant Contact flatly prohibits selling or renting subscriber data. Its business model relies on providing email tools, not data brokerage.
Klaviyo
Klaviyo has surged in popularity for e-commerce marketing, particularly for online retailers. Unlike Mailchimp and Constant Contact, Klaviyo’s legal disclosures contain surprising language about “selling” personal information.
Klaviyo’s Privacy Notice (in its California disclosure) explicitly warns: “Unless you have exercised your right to opt-out, we may disclose or ‘sell’ your personal information to third parties for monetary or other valuable consideration”. In plain English, Klaviyo admits it may share or sell identifiable data unless the user opts out. It lists categories of third-party recipients: business partners, online ad networks, analytics providers, and social networks.
To be clear: the policy is not specific about selling email lists per se. It covers “personal information” broadly, which could include analytics data, user behavior, or possibly subscriber emails. However, it is unusual for a marketing platform to mention “selling” at all. This wording likely relates to Klaviyo’s obligations under the California Consumer Privacy Act (CCPA), which requires companies to disclose any potential data sales. In effect, Klaviyo treats data-sharing for targeted advertising as a “sale” under the law, offering an opt-out mechanism.
Nevertheless, the language suggests Klaviyo may monetize some data flows. For example, by syncing customer lists with Facebook or using ad-retargeting services, Klaviyo could pass user emails (or hashed identifiers) to advertising platforms. Klaviyo’s own integration guides confirm users can export segments to Meta Ads (Facebook) for custom audiences. Thus, although Klaviyo isn’t “selling lists” in a marketplace, its policy indicates that subscribers’ personal data could end up with ad partners unless customers opt out. We see no evidence of outright list brokering, but Klaviyo’s broad privacy language means user data powers ad targeting.
Key point: Klaviyo’s policy explicitly allows selling or sharing personal data with advertisers unless opted-out. Users should be vigilant about Klaviyo’s ad integrations, though no explicit “list sale” marketplace is evident.
ActiveCampaign
ActiveCampaign is a popular CRM and email automation tool aimed at small-to-medium businesses. Its privacy disclosures are nuanced. ActiveCampaign clarifies that it does not sell personal information “in exchange for money”.
However, its CCPA notice reveals that in the past year it has exchanged customer identifiers and usage data with “data enrichment providers” and shared with advertising and social networks. Crucially, ActiveCampaign emphasizes these “sales” and “sharing” explicitly exclude Contact Data (i.e. subscriber email addresses).
In plain terms, ActiveCampaign distinguishes between “contact data” (the email addresses on your list) and other tracking data (IP addresses, device info, browsing activity). According to their policy, contact emails themselves are not being sold. The data that was “sold” were things like customer identifiers and email open/click activity, provided to data companies to improve services. Similarly, “shared” data (non-email) went to ad networks and social media for audience targeting. So ActiveCampaign is allowing ad targeting on users, but not trading the actual subscriber lists.
From a user perspective, ActiveCampaign customers should understand that while the platform safeguards subscriber lists, their broader campaign metrics might feed ad networks. An opt-out link is provided for users concerned under CCPA.
Key point: ActiveCampaign’s policy shows it has not sold subscriber email lists, but it does “sell”/share non-contact identifiers and behavioral data to enrichment and ad services. Its stance is that subscriber lists themselves remain private.
Brevo (formerly Sendinblue)
Brevo, formerly known as Sendinblue, is a France-based email and SMS marketing platform. Its public documentation also denies any sale of personal data. Brevo’s privacy statement declares, “Brevo does not sell Personal Data.”. Like others, Brevo allows sharing certain data with affiliates (e.g. within its Intuit family) or with service providers for hosting, analytics, and legal compliance. But it does not monetize subscriber data directly. European users note that Brevo/Sendo (being EU-based) emphasizes GDPR compliance, even advertising that it has data servers in Europe to avoid U.S. transfer issues.
We found no evidence or allegations that Brevo sells subscriber lists or personal data. Its business model is centered on transaction fees for sending emails/SMS and providing marketing tools. Brevo also integrates with platforms like Google Ads or CRMs, which could indirectly use a list (if the customer opts in). But again, that is an opt-in integration, not Brevo independently selling contacts.
Key point: Brevo’s policy flatly states it “does not sell Personal Data”, and we found no contrary evidence. It focuses on platform services and compliance.
HubSpot
HubSpot offers a broad marketing and CRM suite, which includes email tools. We found no indication that HubSpot sells or rents email lists either. In fact, its documentation emphasizes user control. In HubSpot’s FAQs, the company clarifies that email content and contacts in your CRM are not used or sold by HubSpot. One support article explicitly states HubSpot “doesn’t share that information… sell it, or engage in any sort of anonymized collection of email bodies”.
HubSpot differentiates between what a customer does and what HubSpot itself does. Customers can use HubSpot to sync their lists or send data to social platforms (HubSpot even has a Data Sync feature with Facebook Custom Audiences). But HubSpot itself takes pains to reassure that it doesn’t autonomously trade in user data. The company’s privacy policy (not cited here) aligns with industry norms: no selling of customer data.
Key point: HubSpot states it does not sell or share customers’ email data outside the customer’s account. The data remains under the control of the customer’s HubSpot account owner.
What About Third-Party Tracking and Integrations?
Even when platforms don’t directly sell subscriber lists, they often allow integrations that could share data in other ways. Many email tools include tracking pixels in campaigns (which is how open/click data is collected). Those pixels are usually served by the email platform itself or its partners. Less obvious is sharing with advertising networks: for example, ActiveCampaign’s privacy notice shows it will link identifiers to ad networks for targeting, and Klaviyo encourages syncing email segments to Facebook audiences. These features can blur the line between “selling” and “sharing” data.
From the user’s standpoint, the key is control and consent. Under GDPR/CCPA, subscribers must consent to tracking and have an opt-out option. Mailchimp, Constant Contact, and Brevo provide unsubscribe links in every email and respect unsubscribe lists. Klaviyo and ActiveCampaign also offer opt-out mechanisms (CCPA “Do Not Sell” links, etc.). As one data privacy guide notes: “Don’t share or sell user data. Sharing user data with another company without explicit consent… is likely to constitute a data privacy violation”.
Thus, while none of the major platforms openly peddle subscriber lists for cash, the lines can get murky with “data-sharing” features. For example, if a newsletter signup is also added to a Facebook custom audience via an integration, those subscriber details (hashed email or identifiers) reach Facebook. Is that a “sale”? It depends on consent. Most platforms require the user (the business) to enable these features, meaning the business—and its subscribers—have some say. But unwary users might miss that step and inadvertently expose emails to ad networks.
We must also note the historical context. In traditional media, selling mailing lists was routine. A Publishers’ resource bluntly states: “Magazines often compile and sell subscriber lists to businesses looking to target a specific niche audience”. Another consumer bulletin put it bluntly: “It is common practice for magazines to buy and sell subscriber lists”. (These facts underscore why regulators harshly restrict similar practice for digital data.) Email marketing vendors, wary of legal risk and reputational harm, have steered away from that model. Instead, they emphasize opt-in list building.
Global Regulatory Insights
Our investigation shows that laws around the world strongly discourage selling personal email lists. Key points from different regions:
- European Union: Under GDPR, email addresses are personal data. Exporting or sharing EU-based lists without consent is high-risk. The Bavarian DPA’s March 2021 decision noted that even simply transferring EU emails to a US server (as Mailchimp often does) was illegal absent extra safeguards. That decision targets data transfer, not sale, but it exemplifies EU caution. Most EU-focused email providers (like Brevo or local cloud services) keep data in-region. EU law would generally forbid any sale of subscriber lists without explicit consent.
- United States: Laws like California’s CCPA require companies to disclose if they “sell” data. Klaviyo’s policy reflects this: it lists categories of info that could be “sold” (as defined by law) and provides an opt-out. Notably, CCPA’s broad definition of “sell” can include data-sharing for ads, which Klaviyo triggers. Other companies (Mailchimp, ActiveCampaign) list “Do Not Sell” pages to comply, but they maintain lists aren’t sold. Federal U.S. law (no national privacy law yet) is still catch-as-catch-can, but email marketers must heed CAN-SPAM (requiring consent for marketing emails) and state privacy laws like CCPA/CPRA.
- India: India’s new Digital Personal Data Protection Act (2023) mandates consent and restricts use of personal data for marketing without permission. Though the Act isn’t fully in force yet, it prohibits unauthorized sale of personal data for profit. Indian businesses can face heavy penalties if found trading personal data without consent. Major email providers in India (or those serving Indian clients) should soon need to ensure compliance: effectively, subscriber data must not be sold or used beyond what was agreed.
- Other Countries: Canada’s Anti-Spam Law (CASL) is very strict on unsolicited emails and data handling; selling lists of Canadian emails would likely violate CASL’s consent rules. Brazil’s LGPD (like GDPR) forbids unauthorized data sharing. Across the globe, privacy frameworks are trending toward “personal data is just that — personal.”
Comparative note: Interestingly, while email list “selling” is rare in digital marketing, other industries have faced analogous issues. Telecom companies that sell call metadata, or social networks that package user info, have drawn scrutiny and regulation. In many cases, regulators or courts step in only after complaints, e.g. from consumers or advocacy groups. In the absence of public scandals, much of our analysis relies on examining policies and customer protections.
Expert and User Perspectives
To gauge real-world impact, we looked for testimonies from users and experts. We found industry commentators noting the risks of any list buying or selling. For example, marketing consultants caution that “buying email lists… is a risky move that’s likely to land your business in hot water,” both legally and for campaign performance. Privacy professionals emphasize that handing off subscriber data without clear consent violates user trust and law.
Legal experts note that email marketing platforms are legally “data processors” acting on behalf of businesses, which are data controllers. This means the platform itself typically doesn’t own the data, making outright sales even more fraught. California plaintiffs and privacy advocates have pushed companies like Klaviyo to be transparent, which Klaviyo has done by disclosing possible data “sales.” One commentator on Klaviyo’s policy said it’s “highly suggestive that the business has either sold or shared their personal data for targeted advertising in contravention of the law”, a reflection of regulator language.
On the user side, we didn’t find any whistleblowers claiming, “My marketing vendor sold my mailing list!” In online forums and review sites, complaints about email providers usually focus on unwanted spam or account hacking, not on data resale. One privacy researcher remarked that while mailing lists can be valuable, the technical and legal barriers to selling them intact are high: “Companies may trade on anonymized aggregates, but direct sale of email lists would be a PR and legal nightmare.”
Nonetheless, some smaller newsletter publishers have expressed concern. We encountered a few non-profit organization pages stating on their own sites: “We do not trade or sell subscriber lists” (when describing their use of Mailchimp). This suggests awareness that subscribers assume privacy when signing up.
We also surveyed consumer protection guides. One FTC publication from 2005 (predating GDPR) plainly said: “It is common practice for magazines to buy and sell subscriber lists. There are no laws prohibiting this.”. This old stance on print media is now outdated for email: cross-border data rules and anti-spam laws effectively prohibit sharing email data without consent in many jurisdictions.
Technical Pathways and Risks
From a technical perspective, how could an email platform end up “selling” a list? Possible mechanisms include:
- API or Integration Flows: Many platforms offer APIs or integrations (e.g. connecting to Facebook or Google Ads). If a marketing manager syncs a list to Facebook Custom Audiences, the email hashes go to Facebook for ad targeting. That is technically a data export, but it’s usually initiated by the user, not the platform. Still, if done broadly, it could resemble selling access to a list. Platform policies treat this as something the account owner does with their own data.
- Data Enrichment: ActiveCampaign’s mention of “data enrichment providers” implies it sends contact behaviors to firms that analyze or append data. This could indirectly broaden a dataset, but again, not the same as handing over the raw subscriber list.
- Affiliate and Partner Networks: Some platforms affiliate with partners (e.g. co-marketing networks). If not carefully managed, partners might get access to subscriber info. Reputable providers maintain contract limits to prevent unauthorized resale.
- Security Breaches: A hacker could steal a subscriber list from a platform account. Several companies (including Mailchimp) have had breaches that compromised lists, but those are criminal leaks, not deliberate sales. Still, they represent a real risk to subscribers. All platforms emphasize security measures to prevent leaks.
Given these scenarios, the consensus is that any “sale” would likely be covert and illegal. That’s why public policies all deny it. Instead, what we see are data flows intended for advertising or analytics, which companies label carefully (with legal semantics like “share” vs “sell”).
Bulleted Summary of Findings
- Mailchimp (Intuit): No sale of subscriber lists. Privacy policy says “we never sell lists or email addresses”. Subject to EU/US data transfer scrutiny but not implicated in list sales.
- Constant Contact: No sale of personal data. Policy declares “will not sell or rent your personal data”. Emphasizes opt-in compliance.
- Klaviyo: May share/sell personal data for ads. Policy reveals potential sale of user information to third parties for value, unless opted-out. Users should opt-out if concerned; no concrete example of list transaction found.
- ActiveCampaign: No sale of contact lists, but shares other data. States “does not sell your personal information in exchange for money”, yet discloses sharing “identifiers” with ad networks. Contact email lists are kept private.
- Brevo (Sendinblue): No sale of personal data. Privacy notice explicitly: “Brevo does not sell Personal Data”. No known controversy on data selling.
- HubSpot: No sale of emails. Documentation assures no sharing or selling of connected inbox data. Users control list data within CRM.
- Laws and Penalties: GDPR (EU), CCPA (California), CASL (Canada), and India’s DPDP all regulate personal data strongly. Buying or selling subscriber emails without consent is likely illegal in these jurisdictions. Firms in violation risk fines (up to €20M or 4% revenue under GDPR).
- Best Practices: Experts advise never buying or selling email lists and always obtain explicit opt-in consent. Email platforms facilitate this with unsubscribe tools and privacy settings.
- User Impact: Subscribers generally expect privacy. A leaked or sold list can lead to spam, fraud, and loss of trust. Reputable email suites promote compliance and reputation over short-term profit from data.
Conclusion
Our deep investigation finds no evidence that leading email marketing platforms openly sell subscriber lists. Major providers uniformly include clauses forbidding data sales. However, the devil is in the details: some services do share anonymized or hashed data for advertising unless users opt out (notably Klaviyo and ActiveCampaign). These practices fall in a gray area that privacy laws interpret as “sale” under certain definitions.
Globally, regulators make it clear that selling personal contact data is either illegal or heavily restricted. In Europe, data export rules have even compelled companies to reconsider basic email list usage (the Bavarian cases). In the U.S., laws like CCPA force transparency on any data-sharing. India’s new privacy law is poised to enforce similar restrictions. In short, the legal climate is hostile to any surprise list-sharing.
For businesses using these Email Marketing Suites, the takeaway is: stick to the rules and use built-in tools, rather than risk non-compliance. Always gather subscriber consent, honor opt-outs, and understand third-party integrations. If your platform offers direct “export to ad network” features, use them carefully and disclose to subscribers.
As one expert summarized, “You can run a compliant email campaign… as long as you fundamentally don’t aggressively target individuals who have not expressed direct interest.”. Our review shows that these top-rated platforms generally play by that rule. They gain customers by being trusted custodians of subscriber data, not by selling it.
Bottom line: None of the major email marketing services openly peddle subscriber lists. Instead, they emphasize privacy and opt-in marketing. Any data sharing that does occur is either legally framed as necessary for service functionality or falls under complex regulatory definitions of “sale.” Savvy marketers and subscribers alike should remain vigilant: read the privacy fine print and be aware of your rights, but rest assured that outright “list selling” is not the advertised model of these companies.
Citations And References
All citations in this investigation correspond to verified sources gathered during extensive research across multiple continents and databases. Full documentation available upon email to support the accuracy and verifiability of all claims made.
- Mailchimp Privacy FAQ and Policy
- Constant Contact Privacy Policy
- Klaviyo Privacy Notice (California disclosure)
- ActiveCampaign Privacy Policy (CCPA disclosure)
- Brevo (Sendinblue) Privacy Policy
- HubSpot CRM Email FAQ
- Business.com: Email marketing and data privacy guide
- Schonherr News: “Mailchimp banned in the EU – or is it?” (BayLDA ruling)
- Publishers’ reference and consumer guide on magazine list selling
- Industry analyst commentary on email marketing privacy
About Our Investigative Services
Seeking to expose corruption, track illicit financial flows, or investigate complex criminal networks? Our specialized investigative journalism agency has proven expertise in following money trails, documenting human rights violations, and revealing the connections between organized crime and corporate malfeasance across the world and beyond.
Partner With Us for Impactful Change
Our investigative expertise and deep industry networks have exposed billion-dollar corruption schemes and influenced policy reform across Americas and beyond.
Whether you’re a government agency seeking independent analysis, a corporation requiring risk assessment and due diligence, or a development organization needing evidence-based research, our team delivers results that matter.
Join our exclusive network of premium subscribers for early access to groundbreaking investigations, or contribute your expertise through our paid contributor program that reaches decision-makers across the continent.
For organizations committed to transparency and reform, we also offer strategic partnership opportunities and targeted advertising placements that align with our mission.
Uncover unparalleled strategic insights by joining our paid contributor program, subscribing to one of our premium plans, advertising with us, or reaching out to discuss how our media relations and agency services can elevate your brand’s presence and impact in the marketplace.
Contact us today to explore how our investigative intelligence can advance your objectives and create lasting impact.
Read all investigative Reviews.
* For full transparency, a list of all our sister news brands can be found here.
