Should You Put Your Email Address in Your Social Bio?

A social media bio email address is a public contact address displayed in a profile biography so that strangers can reach the account holder without a direct message. The address sits on a page that any visitor, search engine, or crawler can read. The mechanism that turns that visibility into risk is harvesting: automated programs walk public pages, match the shape of an email address with a regular expression, and store every match in a list.

Harvesting mechanisms

An email harvester is a crawler built for one pattern. It requests public pages in the same way a search engine does, then keeps only the strings that match the shape of an email address, and it moves on to the next page. The technique predates social platforms and targeted mailto links, staff directories, forum posts, and mailing list archives. Social profiles are a denser source because a profile page combines the address with a name, a photograph, a location, and a list of interests in one record.

A second mechanism works through application programming interfaces rather than web pages. A service that exposes profile data through an API endpoint accepts repeated queries, and each response returns the same fields a visitor sees on the page, including the contact address. The 2021 LinkedIn scraping incident followed this pattern: the records were gathered through legitimate API access rather than through a breach of LinkedIn systems, according to an analysis by Cloudskope, which attributed the collection to an absence of effective rate limiting and bulk extraction detection on the API.

Scraped profile datasets

In April 2021, data for 500 million LinkedIn users was offered for sale on a hacking forum, with a sample of two million records provided to buyers. LinkedIn stated that the dataset was an aggregation of data from a number of websites and companies, including publicly viewable member profile data scraped from LinkedIn, and that it was not a LinkedIn data breach. In June 2021, a further 700 million LinkedIn records were offered for sale by the same seller, with a sample of one million records. The records in both cases included full names, email addresses, phone numbers, and links to other social media profiles, and no passwords or payment data were in the samples researchers examined.

The pattern is not limited to professional networks. In 2020, the data broker Social Data exposed nearly 235 million profiles scraped from Instagram, TikTok, and YouTube, in violation of the platforms terms of service, and the records were sold rather than merely collected. The scale of these incidents establishes that a public bio address is collected at industrial volume rather than by individual spammers copying addresses by hand.

The address as a join key

An email address has a property that a name or a photograph does not have: it is stable across services, so it functions as a key that joins records from separate datasets. A broker or a buyer who holds a scraped bio address can match it against a breach dump, a marketing list, and a second scraped dataset, and each match adds fields to the same profile. The Federal Trade Commission study of nine data brokers in 2014 found brokers selling audience segments built on sensitive inferences, including pregnancy, diabetes, and high cholesterol. The bio address is the field that links the public profile to the rest of the record, and the link persists after the address leaves the bio.

The same join mechanism feeds account takeover attempts. A scraped address that also appears in a breach dump can be tested against login pages with passwords from that dump, a technique known as credential stuffing. The bio address also supports impersonation, because a sender who writes from an address that resembles the public one can borrow the credibility of the profile. The United States CAN-SPAM Act of 2003 prohibits sending commercial mail to addresses obtained by automated harvesting from a site that posts a notice against the transfer of addresses, but the prohibition governs the sender after collection, and it does not remove the address from lists that already hold it.

Alias separation

A public alias separates the contact address in the bio from the address that unlocks the account holder accounts. The alias is a forwarding address that receives mail at the bio and passes it to a destination inbox, and the destination address never appears on the public page. When the alias starts receiving mail from a sender the holder does not recognise, the alias names the bio as the source, because no other service holds that address. AliasFleet provides managed aliases of this kind: one alias per public surface, with pause and deactivation controls.

The separation has a stated limit. An alias does not prevent the bio address from being scraped, and it does not remove the address from datasets that already contain it. The protection is containment: the scraped address connects to one public surface and one forwarding rule, rather than to the inbox that receives password resets and account notices. The recovery address for an account is never the bio alias, and the canonical position for financial accounts is a permanent real dedicated address used only for those accounts, never an alias. The bio alias is a contact channel that can be replaced.