What should you reply to "how did you get my email?"
Answer the question you were asked, in the first line, with the real source. Then give the reason you picked them and an easy way out. Three sentences is enough:
- The source, named. "Apollo", "your team page", "the attendee list from [event]". Not "online research".
- The reason, specific to them. The post, job ad or company change that made you write.
- The way out. An offer to remove them, and a promise that you will.
Leave the pitch out of this reply unless they ask a second question. The person is checking whether you are a real sender or a spammer, and a sales paragraph answers that the wrong way.
It is a standard objection on cold calls. Gong Labs' analysis of more than 300 million cold calls (published July 2024, updated May 2026) puts where'd you get my number in the same group as send me some information and not interested: dismissive objections, which it says make up 49.5% of all objections. Gong measured phone calls, not email, and gives no figure for this objection on its own, so read it as a sign the question is a known pattern, not as a measure of how often it arrives by email.
Do you have to tell them where you got their email?
In the UK and EU, usually yes. In the US, the main email law doesn't ask for it. This is a summary of what the regulators publish, not legal advice.
| Where the person is | What the rules say about the source |
|---|---|
| UK | UK GDPR Article 14 requires you to tell people where you obtained their data within a month of getting it, or when you first contact them if that is sooner |
| EU | GDPR Article 14 has the same rule: the source, and whether it was publicly accessible |
| US | CAN-SPAM covers honest headers and opt-outs; the FTC's guide sets no duty to name your source |
The ICO's guidance on what privacy information to provide is direct about the source: be as specific as possible and name the individual source the data came from. If it came from a publicly accessible source, you must say so. Its page on when to provide it adds that if you use the data to communicate with someone, the latest point is that first communication, and the one-month limit still applies. The EU text of Article 14 says the same. The ICO notes that this guidance is under review after the Data (Use and Access) Act.
The source is one item on a longer list that includes who you are, why you hold the data and the person's rights. The ICO says a privacy notice on your website can cover this, but only if you actively point people to it. A link in your email signature is one way to do that. UK rules on emailing companies (PECR) are a separate question, and our comparison of GDPR, UK PECR and CAN-SPAM covers them.
Five replies you can copy
We wrote these for this guide; there are no measured reply rates behind them. Pick the one that matches where the address really came from, and fill in the brackets.
1. From a contact database. "Fair question. Your work email came from Apollo, a B2B contact database. I wrote because [Company] posted three [role] jobs this month, which usually means [work] is piling up. If that isn't on your plate, say so and I won't email again. Apollo also has its own opt-out form if you'd like your details removed there."
2. From their website or a public post. "It's listed on your team page at [URL]. I wrote because your post on [date] about [problem] described exactly what we work on. If this isn't relevant, reply 'remove' and I'll take you off my list."
3. Guessed and verified. "I worked it out. Addresses at [Company] follow the first.last@ pattern, and I checked yours with an email verifier before sending. I reached out because [reason]. If you'd rather not hear from me, tell me and I'll delete it."
4. From an event or a person. "[Name] suggested I contact you after we spoke on [date] about [topic]." Or: "Your name was on the [event] attendee list the organisers shared. I wrote because [reason]." Add the same removal line.
5. When they are angry. "Done: I've removed you and won't email again. To answer your question, the address came from [source], and I contacted you because [reason]." Put the removal first, as LeadHaste's reply prompt also advises for an angry reply.
If the source was a database, you can point people to its removal page. Apollo's opt-out form says it will remove the person's profile from its services. Hunter's claim page says it deletes all data linked to an address once it is claimed, including its original source.
What should you never say?
Never invent a source, and never argue about whether you were allowed to email. Both turn a question into a complaint.
| Avoid | Why | Say instead |
|---|---|---|
| "I found it online" | Sounds like you're hiding something | Name the tool or page |
| "You signed up for our list" (when they didn't) | It's false, and they know it | The real source |
| "It's public, so it's legal" | Starts an argument you don't need | The source and the opt-out |
| "You seemed like a good fit" | Tells them nothing about why | The post, job ad or change you saw |
| An apology followed by the pitch again | Ignores what they asked | Answer first; pitch only if they ask |
If you can't say why you picked this person, the problem is the list, not the reply. LeadHaste's prompt makes the same point: a vague fit reason means your list criteria need work. Our guide to buying signals for small teams lists reasons you can name in one line.
What do salespeople report when they answer honestly?
In one October 2024 r/sales thread (about 100 comments when checked on 24 October 2026), a rep asked whether anyone had ever sold to someone who asked "How did you get my number?". The thread is about phone calls, but the advice carries over.
- Name the provider. The second most upvoted reply was a script that names the data provider, offers to stop calling that line and then asks to explain the call, opening with: "We have this widely used data provider called zoominfo. I'm not sure how they got your number".
- It can still turn into a deal. The most upvoted comment said a call that began this way turned into a six-figure deal. That is one person's story.
- Honesty was the common thread. Several commenters said they simply tell people the number was in their CRM or came from a data tool, and offer to remove it.
Many replies in the thread were jokes, and no one gave measured numbers. Read it as a pattern in what working reps choose to do, not as proof that honesty converts.
How do you make the question easy before it's asked?
Record where every address came from before you send, and put the reason in your first line. Then the answer is a copy and paste.
| Field to log per lead | Example |
|---|---|
| Email source | Apollo; company team page; guessed and verified |
| Date found | 21 Oct 2026 |
| Reason for contact | Posted about manual reporting on 19 Oct |
| Status | Sent; replied; removed |
Some tools make the source column easy. Hunter's data page says contacts in its Domain Search come with where and when it found them, and its Email Finder shows whether a result is a guess or has public sources. If you guess addresses from a company's pattern, our guide to guessing and verifying a decision maker's email shows the steps, and the source line in your log becomes "guessed and verified".
You can also answer the question in advance. A March 2020 Indie Hackers growth tip credits LeadGenius with a 26% reply rate for the subject line "I found you through [insert relevant name]", against four other subject lines. The post gives no sample size or test date, so treat it as a lead to test, not a benchmark.
What if they ask you to remove them?
Remove them from every sequence the same day, add them to a do-not-email list, and confirm in one line. Don't send anything else.
- US. The FTC's CAN-SPAM compliance guide says you must honour an opt-out within 10 business days, and you can't sell or transfer the address afterwards. It makes no exception for business-to-business email.
- UK. The ICO's right to object guidance says people have an absolute right to stop their data being used for direct marketing. Its email marketing guidance calls it good practice to keep a do-not-email list of businesses that object and screen new lists against it.
- EU. GDPR Article 21 says that once someone objects to direct marketing, their data shall no longer be processed for that purpose.
Our guide to replying when a prospect says not interested has one-line confirmations for this. If you use Siela's AI SDR, each lead is saved to its built-in CRM with the reason it was picked, so the "why you" half of your answer is already written down. Its follow-ups stop when someone asks to stop.
Frequently asked questions
Does naming the source in my reply cover GDPR on its own?
Probably not, and this is not legal advice. The ICO's list of privacy information for data obtained from another source includes who you are, why you hold the data, the person's rights and the source. The ICO says a privacy notice on your website can cover this if you actively point people to it; a link in every email is one way to do that.
Do I have to reveal which tool I used to find someone's email?
In the UK, the ICO's guidance says to be as specific as possible and name the individual source the data came from, or give more general information if you don't know the specific source. In the EU, GDPR Article 14 also requires the source. In the US, the FTC's CAN-SPAM guide sets no duty to name it, but naming it is still the most credible reply.
What if I don't remember where I got their email?
Say so plainly, give the reason you contacted them, and offer to remove them. The ICO says that if you don't know the specific source, you should provide more general information, such as 'a B2B contact database'. Then fix the gap: add a source column to your lead list so every future answer is exact.
Should I send my pitch again after explaining how I got their email?
No. Answer the question, give the reason in one sentence and offer removal. If they reply with a question or show interest, then explain what you do. Repeating the pitch in the same reply makes the explanation look like a pretext and makes a spam report more likely than a conversation.
Can a person remove their email from Apollo or Hunter?
Yes. Apollo has an opt-out form, presented for California, EEA, UK and Swiss residents, that it says removes the person's profile from its services, keeping the email only to respect the opt-out. Hunter has a claim page; it says that once an address is claimed, it deletes all data associated with it, including its original source. Both pages were checked on 24 October 2026.
Sources
- Gong Labs: We found the top objections across 300M cold calls (31 Jul 2024, updated 27 May 2026)
- ICO: What privacy information should we provide? (checked 24 Oct 2026)
- ICO: When should we provide privacy information? (checked 24 Oct 2026)
- ICO: Electronic mail marketing (Guide to PECR) (checked 24 Oct 2026)
- ICO: Right to object (checked 24 Oct 2026)
- FTC: CAN-SPAM Act compliance guide for business (checked 24 Oct 2026)
- Apollo: Remove your information (checked 24 Oct 2026)
- Hunter: Our data (checked 24 Oct 2026)
- Hunter: Claim your email address (checked 24 Oct 2026)
- LeadHaste: How did you get my email reply prompt (checked 24 Oct 2026)
- Indie Hackers (Growth Bites): Telling the lead how you found them in the subject line (2 Mar 2020)
- r/sales: How did you get my number? (18 Oct 2024)
- EUR-Lex: Regulation (EU) 2016/679 (GDPR), official text (checked 24 Oct 2026)