<story><title>Ghostery exposed everyone&apos;s email address in its GDPR email by not using BCC</title><url>https://www.reddit.com/r/technology/comments/8m45k6/ghostery_have_exposed_everyones_email_address_in/</url></story><parent_chain></parent_chain><comment><author>weinzierl</author><text>Ghostery is owned by Cliqz and Cliqz GmbH (which is majority-owned by Hubert Burda Media) is based in Germany.&lt;p&gt;CC instead of BCC has been a regulatory offence with fines up to 300000 EUR before GDPR. This is not a theoretical risk, companies have been fined for that in Germany.</text></comment>
<story><title>Ghostery exposed everyone&apos;s email address in its GDPR email by not using BCC</title><url>https://www.reddit.com/r/technology/comments/8m45k6/ghostery_have_exposed_everyones_email_address_in/</url></story><parent_chain></parent_chain><comment><author>labster</author><text>I can&amp;#x27;t say I&amp;#x27;m surprised that someone would do this. I had just written a breach policy that included &amp;quot;Use the Bcc field to send notification, don&amp;#x27;t make it worse than it already is.&amp;quot;&lt;p&gt;Pedantry: title should use &amp;quot;its&amp;quot;, not &amp;quot;it&amp;#x27;s&amp;quot;.</text></comment>