Short answer: a web unsubscribe link doesn't carry your new address. Two other routes can leak it, though. 1. The link itself. Forwarding passes the message body along unchanged, so the link is the one the sender made for your OLD address, usually as a token in the URL. The headers your provider adds while forwarding (Received, Delivered-To and so on) stay in your copy; clicking a link doesn't send them anywhere. The RFC for one-click unsubscribe even says the recipient info has to be encoded in the URL and the request must not carry cookies or other context: 2. What a click does reveal: it's a normal page visit, so they see your IP and browser, and that the old address is still read. If the page asks you to "confirm your email", typing the new one is the leak. 3. Unsubscribe by email (the mailto: option in the List-Unsubscribe header, RFC 2369). Thunderbird or an add-on writes that message from whatever identity is selected, which is probably your new address. Check the From line, or skip that option. Also, Thunderbird doesn't do one-click (RFC 8058) unsubscribe natively yet; the request is still open: Add-ons like List Unsubscribe do it, and that add-on reads your account identities to choose the sender for mailto unsubscribes: https://addons.thunderbird.net/en-US/thunderbird/addon/list-unsubscribe/ If you want zero signal, mark it as spam or filter it instead of clicking.

Replies (1)

↑