A few months ago, my husband made a $10 donation to a nonprofit he believed in. Within weeks, he was on six other organizations' mailing lists. The letters started piling up in our mailbox. Then came the "gifts" from the organizations, and enough address labels to last us until 2075 at the rate we actually send mail. It quickly became clear that his information hadn’t stayed with just one organization – it had likely been shared, exchanged or purchased.
I shared this on my social media, half venting and half curious whether anyone else had noticed this happening. The post went viral. Hundreds of people liked the post, and dozens of professionals commented that they shared the same experience.
The response made one thing clear: I wasn't the only curious one. So, I decided to explore the broader topic of how nonprofits collect, share and sell donor information and what that means for the people who trust them with it.
Acquisition mailings exist because most nonprofits lack a built-in donor base the way universities or hospitals do. Smaller organizations rent or exchange lists instead, betting on finding people statistically likely to give.
Unlike most consumer data, donor lists have no single federal law specifically governing their sale in the United States. What exists instead is a patchwork: the FTC Act can penalize a nonprofit for violating its own stated privacy policy, and a growing number of states now have their own broader consumer privacy laws that may apply. List-sharing terms are usually set by contract between organizations rather than a dedicated donor-privacy statute, leaving opt-out protection inconsistent and largely dependent on each organization's own policies.
That left me with more questions than answers, so I brought in two people who could speak to this with real expertise. I reached out to Sarah Marcotte, a fundraising professional based in Canada, to understand how donor privacy is handled outside the United States. I also wanted a voice from the world of fundraising ethics, so I connected with Mary Doorley Simboski, ACFRE, who currently chairs the AFP Ethics Committee.
Q&A with Mary and Sarah
Mary, let’s start with some context. How do you distinguish between wealth information and donor information?
An important distinction in fundraising ethics is the difference between wealth information and donor information. Wealth information is typically derived from publicly available sources and may help organizations identify individuals who have the capacity to support charitable causes. Donor information, however, is entrusted to an organization through a relationship with a donor and carries a significantly higher obligation of confidentiality.
While it may be appropriate to analyze publicly available information to better understand philanthropic capacity or potential, organizations must exercise great care in how they collect, store and use information provided directly by donors. The ethical stewardship of donor information requires not only compliance with applicable laws and regulations, but also a commitment to protecting donor privacy, maintaining trust and honoring the expectations that accompany every charitable gift.
Sarah, how does Canada approach donor list regulation differently from the United States?
In Canada, donor list practices are governed by a layered web of legislation that makes compliance complex. At the federal level, the Personal Information Protection and Electronic Documents Act (PIPEDA) requires charities to obtain express opt-in consent from donors before sharing their information with other organizations and to be explicit about what is being shared, with whom and why.
That's already a high bar—and it's about to get higher. Bill C-36, introduced in June 2026, is expected to update PIPEDA to address AI-driven data processing and strengthen enforcement.
Additionally, each province and territory has its own privacy legislation, adding another layer of complexity. Canada's Anti-Spam Legislation (CASL) governs electronic communications separately, with only a narrow exemption for charities. The Canadian Marketing Association's Code of Ethics sets additional expectations for how marketing professionals handle rented lists.
The takeaway: organizations operating in Canada need to ask hard questions about whether any donor list they are renting was collected with proper consent, and whether the return on investment is worth the risk.
What is your overall position on organizations buying donor lists?
Mary: Organizations considering purchased lists should go in with realistic expectations, as response rates are typically low. There are often more effective ways to grow a donor base that build lasting relationships over time. Trust is the currency of philanthropy, and donor privacy must remain at the center of any decision involving donor information.
Sarah: In Canada, organizations can rent donor lists, but I would seriously question whether the return on investment justifies the legal and ethical risks. Between federal privacy law, provincial legislation and anti-spam regulations, the compliance landscape is complex and becoming more so every year. Show me an organization with consent documentation in genuinely good shape, and then we can have that conversation. Otherwise, the risks far outweigh the rewards.
Have your views on donor list acquisition changed over the course of your career?
Mary: My perspective on the effectiveness of donor acquisition through purchased or rented lists has remained largely unchanged. For most organizations, there are more productive and sustainable ways to build a donor base. What has evolved is my understanding of donor privacy. In an age when vast amounts of personal information are readily available, protecting donor privacy is more important than ever. Our responsibility extends beyond merely complying with regulations; we must actively safeguard donors’ information and respect their expectations of confidentiality.
Sarah: Contributing to this article was an interesting experience for me, as I haven’t had much up-close personal or professional experience with direct marketing. This was a great opportunity to brush up on my privacy legislation and compliance knowledge. I have also included a list of the sources I found most useful (see end of the article).
What risks should organizations consider?
Mary: Beyond the financial reality that donor acquisition is a long-term investment with uncertain returns, organizations need to weigh reputational risk. Donors may question how their information was obtained, and any perception that their privacy has been compromised can erode trust quickly.
Sarah: In Canada, the legal risk alone should give organizations pause. Quebec's Law 25, enacted in 2024, carries strict enforcement and steep fines for noncompliance. Other provinces are watching and following suit. The direction of travel is toward stricter consent requirements and greater transparency—not less. Organizations that aren't getting ahead of this now will be scrambling later.
Are there circumstances where purchasing a donor list could be ethically justified?
Mary: There may be limited situations, particularly when two organizations are closely aligned in mission and purpose. For example, two environmental organizations collaborating to preserve a local ecosystem might structure a careful, transparent data-sharing arrangement. Even then, organizations should limit what information is shared and be explicit with donors about how their data may be used.
Sarah: The key word in any of this is consent. In Canada, donors must actively opt in—not opt out—before their information can be shared with another charitable organization. The organization sharing the data must be specific about what information is being disclosed, to whom, and for what purpose. That’s a high bar—and rightly so.
What ethical principles should guide how organizations handle donor data?
Mary: Accuracy, transparency, accountability and respect for privacy. Organizations should have clear policies governing what information is collected, how it is stored, who has access to it and how it is used. The AFP Code of Ethical Standards is a useful framework for developing those policies. Nonprofits should collect only what they need to advance their mission and strengthen donor relationships. They must protect that information from misuse, keep it accurate and honor the trust donors placed in them when they gave. Stewardship of donor data is an extension of stewardship of the donor relationship itself.
Sarah: I keep coming back to a principle I’d borrow from journalist Michael Pollan: collect only what’s necessary and keep it safe. It sounds simple, but most organizations aren’t there yet.
What alternatives would you recommend to organizations trying to grow their donor base?
Mary: Start with your logical stakeholder groups—people who already have some connection to your mission: volunteers, board members, alumni, beneficiaries and community members. There is no shortcut to building a strong donor community. Donors are developed through consistent cultivation, meaningful engagement and authentic connection to the work.
Sarah: Segmentation analytics and look-alike modeling within your existing database can be powerful tools. Canada Post also offers mailing list services that can supplement outreach in a more compliant way. The point is that there are options that don’t require you to gamble with your organization’s reputation or your donors’ trust.
If you could establish one universal principle governing the use of donor data, what would it be?
Mary: Honor donor privacy and donor intent. Every decision regarding donor information should reinforce the trust donors place in organizations.
Sarah: Collect only what’s necessary. Keep it safe.
A final thought
Talking with Mary and Sarah made one thing clear: nobody disputes that donor privacy matters. The real question is how much friction organizations accept to protect it. Canada’s opt-in standard may show where the United States practice eventually heads. The most useful guidance was Sarah’s borrowed principle: collect only what’s necessary and keep it safe.
If you’d rather not end up on multiple lists: write directly to an organization and ask to be removed from any list it rents or shares (BBB standards require this opt-out be offered yearly), register with the DMA’s Mail Preference Service at dmachoice.org, or switch to a recurring bank-draft gift, which tends to reduce mailings.
Helpful Sources
Stephanie Willis
Consultant, Creative Fundraising Advisors
Stephanie Willis is a consultant at Creative Fundraising Advisors and author of the 2026 book "The Art and Science Approach to Fundraising Data and Research". She is currently serving on the Apra International Board and is the President of the Apra Foundation. Mary Doorley Simboski, ACFRE is the Secretary for Stewardship at the Archdiocese of Washington and is the Chair of the AFP Ethic Committee. Sarah Marcotte is the Senior Specialist, Data Steward at SickKids Foundation and the co-author of the 2026 book "From the Ground Up: Prospect Research for Nonprofits.”