1. An unexpected newsletter
In 2026, I began receiving newsletters from a well-known international news organization at my personal email address.
The newsletters stated that I was receiving them because I had signed up for updates.
I did not recall making such a subscription.
Rather than simply unsubscribing, I wanted to understand how my email address had entered the organization’s systems and whether a subscription or user account had been created using it.
2. My GDPR request
On 20 August 2026, I contacted the organization’s privacy team and submitted a request under Articles 14 and 15 GDPR.
I explained that I had not personally signed up for the newsletters and asked, among other things:
- when my email address had first entered the newsletter or subscription system;
- the specific source from which it had been obtained;
- whether it had been submitted through a signup form and, if so, which one;
- which newsletters or communication preferences had been selected;
- whether an email-confirmation or verification procedure had occurred;
- what personal data and associated subscription records were held;
- the purposes and legal basis for the processing; and
- whether the email address had been obtained directly through the organization’s systems or from another source.
I expressly asked that the relevant creation and provenance records be preserved and made clear that I was not requesting deletion at that stage.
3. An unexpected discovery
The initial response produced information that I had not previously known.
According to Customer Support, my email address had been registered on the organization’s website on 2 September 2024, and two newsletters had been selected.
This was particularly interesting because I did not recall performing this registration.
I therefore asked the organization to clarify whether the date referred to an actual user-account registration or merely a newsletter subscription, how the registration had occurred, whether email verification had taken place, and why I could identify newsletter delivery in my own mailbox only much later.
4. A user account had been created
On 3 September 2026, Customer Support provided further information.
According to the organization’s records:
- a user account associated with my email address was created on 2 September 2024;
- the account was created using a “Continue with Google” authentication method available on an article page;
- the registration did not require email verification;
- two newsletters were associated with the account; and
- newsletter messages were recorded as having been sent on several days each month from 3 September 2024 until 7 November 2025, and subsequently again from 4 June 2026 until 21 August 2026.
This created a new factual question.
I do not recall creating the account through “Continue with Google,” and I do not presently know what underlying authentication, registration or technical records remain available that could establish how the account was created.
The fact that the organization’s records identify a particular authentication mechanism does not, by itself, allow me to determine who performed the registration or what technical event occurred.
5. The unusual newsletter timeline
The delivery history was also interesting.
According to Customer Support, newsletters were sent periodically from September 2024 until November 2025. There was then an apparent interruption, followed by newsletter delivery again beginning in June 2026.
I had specifically asked whether the organization could identify any event that caused newsletter delivery to begin or resume in 2026.
The response provided the delivery periods, but did not explain what caused the interruption or subsequent resumption.
I therefore consider the subscription and delivery history relevant to understanding the complete lifecycle of the account.
6. Email verification
Another significant detail was the organization’s statement that:
the registration did not require email verification.
This matters because an email address becoming associated with an online account is not necessarily the same thing as the owner of that email address having verified or authorized the account.
At present, I am not drawing conclusions about how this particular account was created. I am documenting the distinction because the provenance of the registration is precisely what I am attempting to establish.
7. My formal data-access request
Customer Support subsequently directed me to the organization’s Data Subject Request system and instructed me to select “Access and Port it” in order to obtain my personal data.
I followed that instruction on 4 September 2026 and completed the required verification process.
My purpose remains to obtain the underlying personal data and available registration information associated with the account, particularly any records capable of clarifying its creation and provenance.
This may include, insofar as such information exists and constitutes personal data, registration timestamps, account identifiers, authentication records, subscription preferences, consent or preference records, and available information concerning the source of the data.
The full access response remains pending at the time of writing.
8. Why the distinction between Article 14 and Article 15 matters
There are two related but distinct questions in this case.
The first concerns provenance and transparency: how did my personal data enter the organization’s systems, and what information was provided concerning that processing?
The second concerns my right of access: what personal data and associated information does the organization actually process concerning the account and its creation?
Customer Support has already provided useful factual information voluntarily, including the recorded account-creation date, authentication method and newsletter-delivery periods.
However, those explanations are not necessarily equivalent to receiving the complete personal data and information covered by an Article 15 access request.
9. What remains unresolved
At the time of writing, I still do not know:
- who or what initiated the account registration on 2 September 2024;
- what underlying event caused the organization to record the account as having been created through “Continue with Google”;
- what registration or authentication records associated with that event still exist;
- whether technical information capable of identifying the originating session was recorded or retained;
- why newsletter delivery appears to have stopped in November 2025 and resumed in June 2026;
- whether any event or account change triggered that resumption;
- what complete personal data are currently associated with the account; and
- what available information exists concerning the provenance of the registration.
10. Next steps
I am preserving the correspondence and awaiting completion of the GDPR access process.
If the access request is not completed within the applicable GDPR timeframe, or if the eventual response does not address the personal data and information covered by my request, I intend to consider submitting the matter to the Austrian Data Protection Authority.
At this stage, however, I am documenting the case rather than drawing a conclusion that the organization has violated the GDPR.
11. Why I am documenting this case
I am deliberately not identifying the news organization in this public account.
The purpose of this case study is not to accuse the organization of creating the account or of knowingly processing an unauthorized registration.
Indeed, its Customer Support team responded to several of my questions and provided information that helped clarify important parts of the chronology.
The unresolved issue is narrower: an account associated with my personal email address was recorded as having been created through a specific authentication mechanism that I do not recall using, and I am seeking the underlying data necessary to understand what occurred.
The case illustrates why provenance information, authentication records, email verification and meaningful GDPR access rights can matter even in something as apparently ordinary as a newsletter subscription.
My objective is to document the available evidence, preserve the chronology, obtain the personal data associated with the account and allow the underlying records — rather than assumptions — to establish what actually happened.