Strategic misdirection: Attempts to protect privacy with made-up email addresses

People are often asked to provide their email addresses for identification, authentication, or communication purposes. In many such circumstances, people provide made-up email addresses instead of their own. To understand why people provide made-up email addresses, we interviewed 20 people who reported doing so. We found that the participants provided made-up email addresses to avoid information overload and protect privacy. The participants chose to provide made-up email addresses based on several factors, such as the context, personal benefits and risks, past experiences, and verification requirements. When composing made-up email addresses, the participants employed several common patterns based on their mental models of email address formats and threat models for undesirable uses of their email addresses. The participants reported using these patterns strategically to navigate the social expectations to comply with such requests and to avoid embarrassment from being perceived as deceptive. We connect our findings to email privacy more broadly through the theoretical perspectives of boundary regulation, communication privacy management, contextual integrity, social desirability, and interdependent privacy. Our insight points to design and regulatory suggestions to address the interdependent privacy issues resulting from made-up email addresses and to help users deal more effectively with email overload and email marketing. • Explores how people use made-up email addresses for privacy and information overload. • Describes interdependent privacy issues in using made-up email addresses. • Connects email privacy practices to key privacy-related theories. • Proposes unified client-side management for misdirected and unwanted email messages. • Advocates input validation and double opt-in for email address collection.