How to respond to "how did you get my email?"
Name the real source, say why you wrote, offer to delete. Reply templates, the GDPR and CAN-SPAM basics, and what to do next.
Tell them the truth in the first line: the exact source, in plain words. "I found you on your company's team page" or "Your email came from Apollo, a B2B contact database" works. "Through my research" does not. Then offer to delete their details, and stop selling in that message. That's the whole answer. The rest of this piece is the wording, the legal part you can't skip if they're in the EU, and what to do when the honest answer is embarrassing.
Why people ask it
"How did you get my email?" is rarely curiosity. Usually it's one of three things:
- Mild annoyance. They get forty cold emails a week and want to know which list they're on.
- A test. They're half interested, but want to see whether there's a person behind the message or a sequence.
- A formal request. In the EU and the UK, this can be the opening of a data access request, and the reply you send is part of the record.
You can't always tell which one you're looking at, so write the reply that works for all three. It's short, specific and calm, and it gives them control.
What a good reply contains
Answering "how did you get my email?"
- Name the real sourceThe tool, the page or the person. One sentence.
- Say why you picked themThe one fact that made you write: their role, a post, a hire, a product launch.
- Offer deletionRemove them from the list, and delete the record if they ask.
- Stop the pitchNo meeting link, no case study in this message.
- Do what you promisedRemove them the same day and stop every sequence they're in, in every channel.
The second step is the one most people skip, and it matters most. Someone who asks where you got their address is also asking "why me?". If you can't answer that in one sentence, the problem isn't your reply. It's your list.
Replies you can copy
When the source is a data provider:
Fair question. Your work email came from Apollo, a B2B contact database. I picked you because you run sales ops at a 40-person agency, and that's who we work with. If you'd rather not hear from me, say so and I'll delete your details today.
When the source is public:
I found it on the team page of your website, under the partnerships section. I wrote because you're listed as the person for new integrations. Happy to remove you if this isn't your area, or point me to the right person.
When someone referred you:
Anna, who worked with you on the logistics project last year, said you'd been looking at this. If she got that wrong, no problem, I won't follow up.
When they're clearly annoyed:
Sorry for the unwanted email. Your address came from a contact database (Apollo). I've removed you from our list and won't write again. If you'd like your record deleted from our systems too, reply "delete" and I'll confirm when it's done.
Notice what none of these do. They don't argue that cold email is legal. They don't call the prospect "a perfect fit". They don't add "but while I have you…". The moment you pitch in this reply, you've answered a different question than the one they asked.
Do
- Name the tool or page by name
- Give the one reason you picked them
- Offer removal before they demand it
- Remove them the same day
Don't
- Say "through my research"
- Quote the law at them
- Ask for a call in the same message
- Keep the next sequence step scheduled
The legal part, briefly
This isn't legal advice, but the basic rules are short and you should know them before you send cold email to anyone.
EU and UK (GDPR). If you got someone's data from anywhere other than them, Article 14 says you must tell them where it came from, including whether it came from a public source. If you use the data to contact them, that notice is due at the latest at the first message, not a month later. Many teams handle this with a line in the footer of the first email. If the person asks directly, Article 15 gives them a right to any available information about the source, and Article 12 gives you one month to respond.
Objections to direct marketing are absolute. Under Article 21, once someone objects, their data can no longer be processed for that purpose. You don't get to weigh it against your interests.
US (CAN-SPAM). The FTC's compliance guide requires a working way to opt out and says you must honor it within 10 business days. Asking where you got their email isn't an opt-out by itself, but the angry version of the question usually is. Treat it as one.
In practice that means: know your source for every contact before you send, write it down in the CRM, and make "remove me" work across every tool you use. If your contacts were imported from three spreadsheets two years ago and nobody knows from where, fix that before your next campaign, not after the first complaint.
When the honest answer is awkward
Sometimes the true answer is "I bought a list" or "a scraper guessed your address from your name and domain". You still say it.
Your address wasn't published anywhere. Our tool guessed it from your name and company domain and then checked that it accepts mail. I know that's not great. I've removed you and won't write again.
That reply costs you a prospect who was already lost. A vague one costs you more: a screenshot in a LinkedIn post about shady sales tactics, or a complaint to a data protection authority. People forgive a guessed email address. They don't forgive being told "we have our ways".
If you find yourself dreading this question, it's a signal to change where your contacts come from. A list where every person has a reason you can say out loud ("you posted about this last week", "you just hired two SDRs") gets fewer of these questions, and the ones it gets are easy to answer.
After you reply
Three things, the same day:
- Stop everything. Pause their email sequence, cancel the pending LinkedIn request, remove them from any WhatsApp or Telegram follow-up. A "removed you" reply followed by a scheduled step-three email two days later is the worst outcome here.
- Record the source and the request. Note in the CRM what they asked, what you answered and when you removed them. If it turns into a formal request, this is your proof.
- Check the segment. If one person asked, look at the others who came from the same source. One question can be a quirk. Three from the same list means the list is bad.
Some people will write back "thanks for being straight" and ask what you actually do. That happens more often than you'd expect, and it's a real conversation from that point on. Treat it like any other reply. Our piece on how to respond to "not interested" covers how to read that second message.
Where an AI agent fits
The reply itself takes one minute. The hard part is the rest: answering the same day, stopping the sequence in every channel at once, and keeping a record of where each contact came from. That's where a tool helps. Nitrino answers replies in the account owner's voice, recognizes when a reply means "don't write to me", marks that person as opted out and stops writing to them. Anything that needs a decision, such as a formal request to delete data, still goes to a person, and it should.
Tool or no tool, the rule is the same. If you can't say where you got someone's email and why you wrote to them, don't send the email.
