“If you have received this email in error, you must let us know: NoReply@DontBotherUs.com”
By: Adam Chapman
Tags: Usability, Privacy, Ux Strategy, UX, Content Strategy

In addition to all of the quantum leaps Gmail brought to email (1GB inboxes, labels, conversation views, etc.), Gmail was especially praised for also basically killing spam, or at least banishing it to a folder you forget ever existed until you’re looking for an invoice from a semi-legitimate plumber they swore they sent. Basically, Gmail promised you would only get emails in your inbox from people and services that intentionally entered your address in the to box.

Unfortunately, Gmail couldn’t prevent people from entering the wrong email in the to box, let alone imagining that people wouldn’t know their own email addresses when signing up for services. In fairness, I couldn’t either until I started to experience it firsthand.

In the nearly 17 years I’ve had my email address, I’ve received thousands of emails intentionally sent to achapman@gmail that weren’t intended for me. I’ve categorized them into three different flavors: Personal (annoying, but hard to solve with design), Commercial (also annoying, but more solvable), and Problems (emails that legally I shouldn’t be getting but still do).

Personal

The variation here represents the entirety of the human experience: I get church bulletins, after school soccer practice schedules, baby shower invitations, backyard renovation photos, town council meeting notes, etc., all of which I reply with a simple “Wrong email address, please don’t reply” (which all too often still elicits a “Sorry”). There isn’t much if anything that can be done about this, so it’s just a small annoyance. But it only gets worse from here.

Commercial

I also get signed up for countless newsletters, promotions, loyalty programs, and more, all of which the companies that run them get my email from other achapmans out in the world who wrongly give the companies my address. In an ideal world, this would happen once per company as they would request active affirmation in their first email to me that I intended to sign up for whatever they want to send me, and if I don’t reply then I’ll be left alone. Of course, this almost never happens because it’s not really in any company’s best interest, but it sure would be nice.

Problems

Here’s where it gets to be a real issue, and for others way more than just me. Over the years, I’ve been mistakenly sent medical records, employer verifications, vaccine appointments, hotel reservations, home repair invoices, tax returns, school registration details, travel plans, lab test results, mortgage agreements, and all other kinds of things you really should want to make sure goes to the right person. Not to mention the amount of times I’ve had password resets and account lockouts from achapmans entering in my email address in services that I signed up for with “our” email address.

Naturally, most of the emails that come with the very sensitive information also come with two delightfully contradictory messages:

A disclaimer at the bottom that says “If you were not the intended recipient, you must delete this email and notify the sender”; They come from an email address that starts with some variation of “DoNotReply”.

Sometimes there’s other contact information within the email; usually there isn’t. I’ve tried in the past to inform someone, anyone, connected to the sender that I was not the intended recipient, which is usually met with… nothing. Eventually, I stopped trying, and probably (hopefully) the people who were supposed to receive those emails complained, and it was eventually discovered why.

I can’t imagine how many GDPR, CCPA, HIPAA, and other laws have been inadvertently broken with these emails, but what makes it especially frustrating as a UXer is that the process simply wasn’t sufficiently thought through. I’ve personally experienced hundreds of instances where there was nothing more than a perfunctory boilerplate effort made to ensure accurate delivery, and clearly there were no meaningful consequences to protect user privacy (and, admittedly, my inbox). But I’m just one generic address: imagine how many cmartinezes or jsmiths or dchans or any other number of permutations there are of first initial, semi-generic last name. This is an issue that likely affects hundreds of thousands of people daily, and, admittedly, until I wrote this article I didn’t realize how many people it likely impacts.

The proximate moral here is if you’re planning to send sensitive material, first confirm it’s going to the right place. But the ultimate moral is to remember that we will never be able to plan for every contingency we make about user behavior, so we should make it easy for users to remind of us of all the things we didn’t think of. Making it simple for users to let us know about what we’re doing wrong is rarely a bad move. Most design flaws come from making assumptions like “no one would ever enter in the wrong email address”. Since we can’t predict how users will find those flaws (and they are our flaws, not theirs), planning for graceful failures strengthens our empathy muscles and ultimately allows us to design everything better.

Do you have an example of truly unexpected user behavior that broke your design and how you solved for it? Leave a comment and let’s learn from each other.

A friend of mine was once at a wedding and texted me during it to say she’d met another achapman there. I told her to tell him that I held achapman@gmail to see his response. She did, and told me he was surprisingly (to her, not me) impressed.