Is Disposable Email Legal?
In short. No jurisdiction we are aware of prohibits using a temporary email address. What can be unlawful is what someone does while using one, and that would be equally unlawful from a permanent mailbox.
This page explains how the pieces fit together. It is not legal advice, and laws differ by country.
The direct answer
In the United States, the European Union and the United Kingdom there is no law against receiving mail at an address that expires. There is no registration requirement for email addresses, no obligation to use your legal name, and no statute that treats a short-lived mailbox as suspicious in itself.
The same is true of most other jurisdictions with a functioning internet. Where restrictions exist they attach to specific regulated activities rather than to the mailbox.
Three things people constantly confuse
Breaking a law. Conduct prohibited by statute, with consequences imposed by the state. Fraud, impersonation for gain, evading age restrictions on regulated goods.
Breaking a site's rules. Conduct prohibited by a contract you accepted. The consequence is that the company stops dealing with you. No court is involved and no offence has been committed.
Having an account closed. An operational decision, often automated, often without explanation. It does not establish that either of the above happened, and it happens to people who did nothing at all.
Most anxiety about disposable addresses is about the second and third while using the vocabulary of the first. Being banned from a service is not a criminal record, and it is worth keeping that straight before worrying.
What makes it unlawful is the act, not the address
A disposable address is a container. What matters legally is what you put in it.
Buying something with a stolen card is fraud, and the mailbox is irrelevant. Pretending to be a specific real person to obtain something is impersonation with or without a throwaway address. Circumventing age verification for regulated goods is an offence in many places, and the address is a detail.
Conversely, avoiding a newsletter, keeping a shopping habit out of a data broker's file, or refusing to give a permanent address to a site that had no business asking, are all entirely lawful, and constitute the overwhelming majority of use. So is handing a stranger a contact address for one private sale and letting it expire once the item has gone.
Where a real address is required by regulation
There are genuine exceptions, and they cluster where the law requires a durable means of contact.
Financial services, where identity verification rules require contactable customers of record. Government services, where the address is part of an official record. Healthcare, where communications are regulated and often protected. Sometimes employment, where the contract requires a means of formal notice, though in practice a job search breaks on a missed offer long before any legal question arises.
In these settings a disposable address does not just violate a policy, it fails the purpose: the address has to work when a formal notice is served, and one designed to expire cannot.
What a site's terms actually say
Look under acceptable use or account registration and you will typically find a sentence requiring a valid email address you control, and sometimes an explicit prohibition on temporary or disposable addresses.
The consequences named are contractual: suspension, termination, forfeiture of credits. On services where a second account is the real concern, closure of all linked accounts is standard, and that is where the actual cost lands.
Worth noting that many sites prohibit disposable addresses in their terms while accepting them in practice, because the terms were written by lawyers and the signup form was built by someone else.
Why senders care beyond marketing
There is a legitimate reason forms want confirmable addresses, and it is not only about selling to you.
Bulk email is regulated. Rules in most jurisdictions require consent, an identifiable sender and a working way to opt out, and mailbox providers enforce their own requirements on top. A sender whose list is full of expired addresses generates bounces and spam trap hits, which damages their ability to deliver mail to anyone.
So "please confirm your address" is partly compliance and partly self-preservation, not purely an attempt to keep you on a list.
The part that cuts the other way
There is an interesting inversion in data protection law. European rules give people a right to have personal data erased, and they oblige companies to keep personal data no longer than necessary. An email address is personal data.
An address that deletes itself reduces the size of that problem for both sides. The company holds a contact that stops being personal data the moment it stops identifying anyone reachable; the person does not have to file a request to achieve something the design already did.
This does not exempt anyone from anything, and it is not a defence to any obligation. But it is a reasonable answer to the assumption that throwaway addresses exist to frustrate the law: quite often they align with what the law was trying to encourage.
The honest caveat
This is a general explanation written by people who run a mail service, not by lawyers, and jurisdictions genuinely differ. If a specific legal question turns on whether an address was temporary, ask someone qualified in the relevant country rather than relying on a page like this one.
Read next
Reading Email Headers
The sender name is decoration. How to read the headers of a message, check SPF and DKIM, and tell a forgery from the real thing.
Your Own Catch-All Domain
A domain plus a catch-all mailbox gives you unlimited private addresses. What it costs, what it fixes, and who should not bother.
What a Breach Does With Your Address
Your address is the key that joins one leak to another. What actually happens after a breach, and what a throwaway address changes.