CC and BCC Meaning in Email: When to Use Each

BCC (blind carbon copy) sends someone a copy of your email without showing their address to anyone else on it. CC (carbon copy) sends a copy too, but everyone on the email can see who received it. Put people who need to act in To, people who should know in CC, and private addresses in BCC.

One warning: in the UK, a group email that shows customers' addresses to each other can be a personal data breach.

CC and BCC meaning, and where the names come from

CC stands for carbon copy. Before photocopiers, a typist put a sheet of carbon paper between two pages, and the second page became a copy of the letter. The letter ended with a "cc:" line naming everyone who received one.

BCC stands for blind carbon copy: a copy sent without that note on the original, so the main reader never knew about it. Email kept both names and both rules.

Both words also work as verbs. "I'll cc you" means adding someone to the CC field, and "she was bcc'd" means she got a hidden copy. Some people read CC as "courtesy copy", which fits how it is used today.

To, CC and BCC: who sees what

Every address in the three fields receives the same message at the same moment. What changes is who can see the address, who gets later replies and what the sender expects from each person.

Mail servers deliver To and CC in the same way.

The BCC list stays in the sender's own copy. In classic Outlook, for example, you can see it by opening the message in Sent Items (Microsoft Support).

Can people see who was BCC'd?

No. People in To and CC, the visible recipients, cannot see who was added in BCC, and BCC recipients cannot see each other (Gmail Help).

A BCC recipient does see the To and CC addresses. Gmail also tells them they were added with Bcc, while people on other mail services may see no such note.

If you put everyone in BCC and leave To empty, the email still arrives. Apple's guide to Mail says recipients then see "Undisclosed-recipients" in the To field. You can also put your own address in To, which hides the list just as well.

BCC stays blind as long as the software handles it correctly. The internet email standard leaves the method to each mail program and warns that mishandling the Bcc line can reveal addresses. In the UK cases described below, the software worked; a person put the addresses in a visible field.

What happens when someone clicks Reply all

When a visible recipient replies to all, BCC recipients do not get that reply, according to Google's Gmail help. Their part of the conversation ends with the first message.

The danger runs the other way. If a BCC recipient replies to all, their answer reaches every visible recipient, and they all learn that this person had a hidden copy. When you want a colleague to see an email, forward them your sent copy afterwards, or ask them to answer only you.

BCC can also curb a Reply all storm on a large thread. Microsoft suggests one reply with the distribution list moved to Bcc and a line explaining why, so further answers come only to you.

When to use CC and when to use BCC

Use CC when everyone on the email should know who else is reading:

• Keeping your manager informed about a deadline you agreed with a client.
• Handing a customer over to a colleague, so both sides see the introduction.
• Recording a decision with everyone it affects.

Use BCC for a one-off, non-sensitive note to a few people who do not know each other.

Leave both fields empty when a copy would only add noise, or when copying someone's manager would read as pressure. Using BCC is not unprofessional in itself. A secret copy in a dispute or a performance conversation is different, because it damages trust once a stray reply reveals it.

How to add CC and BCC in Gmail, Outlook and Apple Mail

Most mail apps hide the Bcc line until you switch it on.

Gmail on a computer

Click Compose, then click Cc or Bcc next to the To field. Keyboard shortcuts also work: Ctrl + Shift + C adds Cc, and Ctrl + Shift + B adds Bcc. On a Mac, use ⌘ instead of Ctrl.

Gmail app on Android, iPhone and iPad

Tap Compose, then add people in the To, Cc or Bcc fields.

New Outlook for Windows

Open a new message or a reply, go to Options > Show fields and select Show Bcc.

Classic Outlook for Windows

If the message opens in its own window, select Options > Bcc. If it opens in the Reading Pane, select Bcc on the ribbon. The field then appears on every new message until you select the same button again.

Apple Mail on a Mac

If the message window has no Bcc field, click the Header Fields button in its toolbar and choose Bcc Address Field.

Mail on iPhone

In a new message, tap the Cc/Bcc field, then tap Bcc and enter the addresses (iPhone User Guide).

These steps match the Google, Microsoft and Apple help pages as of 25 October 2026.

Why BCC is the wrong tool for a customer list

BCC protects addresses only if every address lands in the right field, every time. The Information Commission's Office (ICO), the UK data protection regulator, says BCC "is not enough on its own" to protect people's information. For sensitive emails, it expects alternatives such as bulk email services or mail merge (ICO, Email and security, published 30 August 2023 and under review after the Data (Use and Access) Act).

An email address is personal information when it identifies someone, as most firstname.surname addresses do. Even when the email says nothing private, the recipient list can. A list of people who use a clinic, a debt advice service or a support group reveals something about each of them.

The mistake is common. The ICO says misused BCC is consistently among the top 10 non-cyber breaches reported to it. It had received nearly a thousand such reports since 2019 (ICO news, 2023).

ICO fines for BCC mistakes

The ICO has fined a government department £350,000 and two charities up to £10,000 for addresses left in To or CC.

The Ministry of Defence case

On 20 September 2021, the Ministry of Defence (MoD) team handling relocation applications from Afghanistan emailed 245 people. Their addresses sat in To instead of BCC. Two earlier emails that month made the same mistake, and 265 unique addresses were exposed in total.

Two recipients then replied to the whole list, and one of them gave their location. The MoD's own breach report said the shared information "could result in threat to life".

The ICO judged £1,000,000 the appropriate penalty and cut it to £700,000 for the pressure of the evacuation and the MoD's response. It then halved that under its approach to public bodies, leaving a £350,000 fine in a notice dated 7 December 2023 (ICO penalty notice).

Fines and reprimands over HIV service emails

In these three cases, the recipient list alone linked people to HIV.

Organisation	What happened	ICO action
HIV Scotland, a charity	In February 2020, an event agenda went to 105 members of an HIV advisory board with every address in CC; 65 addresses identified people	£10,000 fine, October 2021
NHS Highland, a health board	An email to 37 people likely to be using HIV services used CC instead of BCC	Reprimand, March 2023
Central YMCA, London	Emails for an HIV support programme went to 264 addresses in CC; 166 people could be identified	£7,500 fine and a reprimand, 2024 (the ICO first recommended £300,000)

Sources: the ICO's email and security guidance, its civil monetary penalties list, the NHS Highland reprimand and its statement of 30 April 2024.

HIV Scotland's case holds the clearest lesson for a small organisation. The ICO's email guidance describes it without naming the charity: an email automation platform had already been bought, but the move to it was unfinished. So a staff member typed the addresses into CC by hand.

How many people can you BCC?

A personal Gmail account stops you at 500 recipients in one email or 500 emails a day (Gmail Help). Google Workspace allows 2,000 recipients per message across all three fields, with no more than 500 outside your organisation (Google Workspace Admin Help). Both limits were checked on 25 October 2026.

No provider publishes a number at which a BCC send lands in spam. Microsoft warns that spammers favour Bcc, so many junk filters flag messages that use it. The other signals filters read are covered in why emails go to spam.

Sending to a list: use an email platform, not BCC

An email platform sends each person a separate copy addressed only to them, so there is no shared field to get wrong. British marketers often call this kind of send an eshot.

For a service notice rather than a newsletter, compare ways to email recipients individually before deciding whether you need a platform.

Marketing email also needs an opt-out: under the Privacy and Electronic Communications Regulations (PECR), every message must give people a simple way to opt out (ICO). A blind-copied send from Outlook has no unsubscribe link, so every "please remove me" reply becomes a job by hand.

Who you may email at all is a separate question. The rules are in UK GDPR and PECR for email marketing and in opt-in, double opt-in and soft opt-in.

In MailGraf, a campaign to 400 contacts leaves as 400 separate emails, each with one address in To. Every email must carry an unsubscribe link: in the editor it sits in a locked footer with your company address. Each copy also carries the one-click unsubscribe header that Google and Yahoo require from bulk senders.

These are the address and unsubscribe headers on one contact's copy, as MailGraf's sending code builds them (October 2026; addresses are examples and the links are shortened):

From: "Harry Walsh Joinery" <[email protected]>
To: [email protected]
Subject: Workshop open day moved to Saturday
List-Unsubscribe: <https://…>, <mailto:…>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

Contacts who unsubscribe, hard bounce or mark your email as spam are left out of later campaigns automatically (MailGraf Help). Once your list has outgrown BCC, find its monthly volume on the pricing page; contacts are unlimited at every volume.