Do websites that tell email already in use violate privacy?

Question

If there is a website that during sign up tells if some email is already in use when using that email, do they violate privacy? They're disclosing that someone is using that service if we know their email, while this is unavoidable, is there anything that could possibly be used against it?

Answer 1

If there is a website that during sign up tells if some email is already in use when using that email, do they violate privacy?

No.

The website isn't providing personally identifying information about a person. It is merely providing information about everyone, collectively, who isn't you. Someone out there must have that email, but it doesn't tell you who.

The website itself isn't sharing enough information, by itself, to learn something about the actual person. You also need a "private key" so to speak, that the website does not provide (in this situation, knowledge of who the email address belongs to).

There are lots of circumstances when information that doesn't violate privacy by itself can reveal information about someone if you have other private information that is not revealed to you from the same source.

For example, if you know how everyone else in a precinct voted, you can determine the way that the last person voted from the vote totals for that precinct.

If you want to know if your spouse has an account at a dating site, and your spouse doesn't want you to know that, your spouse should use an email account that you don't know about from a place or in a mode that prevents you from accessing your spouse's browsing history.

People routinely voluntarily share information that they could keep private because it is a route of least resistance to do so when the information shared isn't important. I don't have an ultra-secret complicated password for my Netflix account, and I'd be thrilled if someone hacked my utility bill account and paid my bill for me, so I don't keep my password for that very secure either. On the other hand, I have highly secure access to my bank accounts and use an email not traceable to me if I'm doing something I want to keep secret (as lawyers sometimes must).

Learning these lessons is part of modern life in the age of the Internet. But the fact that users share private information doesn't make it the website's fault that the private information shared makes it possible to learn thing that the website doesn't reveal is traced to you.

In the same vein, many people have a password that appears prominently on a sticky note on your computer screen. The site whose password is on the sticky note isn't responsible for breaches of your privacy that arise from someone in your office reading the sticky note, even if it is still wrong for the person who accesses your account with that password to do so without your permission.

Answer 2

Yes

Now, that may or may not be illegal because privacy laws differ widely around the world. However, looking at the “gold standard”, the EU’s GDPR, this is probably a violation.

In general, an email address and the fact that it’s owner is or is not a member of the site is Personal Data because it is “information relating to an identified or identifiable natural person (‘data subject’)”. A generic corporate email address might not be personal data if the people who have access to it is sufficiently large that they cannot be individually identified, but most web sites don’t or can’t make the distinction so they should treat all email addresses as personal data.

Disclosure of this information to a third-party (which is what the person typing an arbitrary email address in is), is a data breach.