Blog

CC stands for “carbon copy,” and in email it is the field you use to send a copy of a message to people who should stay informed but don’t need to act. Everyone on the email can see who was CC’d, which is what separates it from BCC (blind carbon copy). This guide covers what CC means, when to use it, when to leave people off, and the privacy mistakes that have cost organisations real fines.

What CC Stands For and Where “Carbon Copy” Came From

The term is older than email. Before photocopiers, a typist slipped a sheet of carbon paper between two sheets of paper. Pressing the keys printed the letter on the top sheet and a duplicate on the sheet underneath. That duplicate was the carbon copy.

Business letters carried a “cc:” line at the bottom listing everyone who received a duplicate. The main recipient could see exactly who else had a copy. That transparency is the whole point, and email kept it.

When internet email was standardised, the field names came along. The current specification, RFC 5322, defines three destination fields:

• To: the primary recipients
• Cc: additional recipients who receive a copy
• Bcc: recipients whose addresses are hidden from everyone else

So if you have been asking “what is a CC in email?” the plain answer is that it’s a second, visible tier of recipients. They receive exactly the same message as the people in the To field. The difference is social, not technical: CC signals “this is for your information” rather than “this is for you to handle.”

People also use it as a verb. “I’ll CC you” or “can you CC my manager?” both mean “add that person to the CC field.”

How CC Works Compared With To and BCC

All three fields deliver the same message to the inbox of every person listed. What changes is who can see whom, and what recipients assume about their role.

A message needs at least one recipient somewhere. Most clients expect something in To, but you can technically send with only CC or BCC filled in.

What Each Recipient Actually Sees

When someone opens your email, the header shows the To and Cc lines exactly as you filled them in. A CC’d person sees the main recipient and every other CC’d person. A To recipient sees the same.

BCC works differently at the server level. Your mail server delivers a copy to each BCC address but strips the Bcc line from the version everyone else receives. In Gmail, a BCC’d recipient who opens the details dropdown typically sees “bcc: me,” while nobody else sees any trace of them.

That has one practical consequence people forget. If a BCC’d person hits Reply All, their reply goes to everyone in To and CC, and now the whole group knows they were on the email. Your “quiet” copy just announced itself.

What CC Does Not Do

CC doesn’t change delivery speed, priority, or how spam filters treat the message. It doesn’t restrict forwarding either. Anyone who receives a copy, in any field, can forward it to anyone else. Treat CC as a label of intent, not a security setting.

When You Should CC Someone

The test is simple. Ask whether this person needs to know or needs to do. If they need to do something, they go in To. If they only need to know, CC works. If they shouldn’t be visible to the others, use BCC.

Good reasons to CC someone at work:

• Keeping a manager in the loop. You’re confirming a deadline with a client, and your manager should know the agreed date without being asked to reply.
• Introductions and handovers. You’re passing a customer to a colleague. You email the customer in To and CC the colleague so both have each other’s address and the history.
• Creating a visible record. You’re confirming a decision made on a call. CCing the people who were on the call means nobody can later claim they never saw it.
• Sharing with a stakeholder who might chip in. A project update goes to the team in To, with the department head on CC. The head can reply if something looks wrong but isn’t expected to.
• Looping in the other half of a shared task. You email a supplier about an invoice and CC your accounts team, who will need the paperwork later.

CC is also handy outside work. Booking a holiday rental and CCing your travel partner means both of you have the confirmation without one of you forwarding it.

When You Should Not CC

CC gets abused more than any other email feature. A few patterns create resentment, cluttered inboxes, or worse.

Don’t CC to apply pressure. Copying someone’s boss on a routine request (“just checking in, CCing Mark”) reads as a threat. If you genuinely need to escalate, tell the person first that you’re going to, or email the manager separately.

Don’t CC “just in case.” Every unnecessary CC is another notification and another thread someone has to decide whether to read. Knowledge workers already wade through a heavy daily volume. If you can’t name the reason someone needs the message, leave them off.

Don’t CC people who don’t know each other when addresses are private. Clients, customers, patients, volunteers, parents at a school: none of these groups agreed to share their email addresses with each other. Use BCC, or better, the right tool (covered below).

Don’t CC for sensitive content. Performance issues, salary, health, legal disputes. Every extra visible recipient is another person who can forward the message.

Don’t use CC to dodge responsibility. “I CC’d you, so you knew” doesn’t hold up if the email didn’t clearly ask for anything. If you need a decision, put the person in To and ask a direct question.

Examples of CC in Real Emails

Here’s how the To, CC and BCC fields look in situations you’ll actually meet.

Client handover

To: [email protected]
CC: [email protected]

Hi Dana, I’m moving to a new role at the end of the month, so I’ve CC’d Leo, who’ll be your account manager from 1 July. He’s read through our last three months of notes and will be in touch this week to set up a call.

Why it works: the client is the person being addressed, and Leo is copied so the introduction is visible and both sides have each other’s address.

Decision confirmation after a meeting

To: [email protected]
CC: [email protected]

Quick recap from today: we’re going with Option B for the checkout redesign, with a review on Thursday. Sam owns the prototype. Shout by end of day if I’ve missed anything.

Why it works: the team owns the work, so they’re in To. The product lead needs the record but has nothing to do.

Vendor request with finance looped in

To: [email protected]
CC: [email protected]

Please send the corrected invoice for PO 4471 with the updated VAT number below. Our accounts team is copied so they can match it on arrival.

Why it works: the supplier acts, accounts receives, and the sentence explains the CC.

Group email where addresses should stay private

To: [email protected]
BCC: 40 volunteer addresses

Hi everyone, the Saturday clean-up has moved to 10am. Reply to me directly if you can no longer make it.

Why it works: the sender’s own address sits in To, everyone else is in BCC, and nobody’s address leaks to 39 strangers. Asking people to reply directly also stops a pile of Reply All messages.

How to CC Someone in Gmail, Outlook, Apple Mail and on Your Phone

Every major client has CC and BCC built in. The fields are sometimes hidden until you ask for them.

The exact location varies by app:

In classic Outlook, once you switch on the Bcc field it usually stays visible for future messages. That’s worth doing once so you never have to hunt for it under pressure.

BCC: The Field That Hides Recipients

If CC is the copy everyone can see, BCC is the copy nobody else can see. Each BCC recipient gets the message, but their address never appears to the To, CC or other BCC recipients.

Legitimate uses for BCC:

• Small group messages to people who don’t know each other. Event reminders, a club update, a note to a handful of customers.
• Protecting privacy where the group itself is sensitive. A support group, patients of a clinic, people in a legal matter. Membership of the list is personal data.
• Moving people off a long thread. “Thanks for the intro, Sarah. Moving you to BCC to spare your inbox.” The introducer sees the reply landed, then drops out of the conversation.
• Copying your own CRM or archive address. Many CRMs give you a unique address to BCC so the email is logged against a contact.

Uses to avoid:

• Secretly copying a manager on a conversation with a colleague. If the colleague finds out (and Reply All mistakes make that likely), trust is gone.
• Mass mailings. BCC solves the privacy problem but creates deliverability and legal ones. More on that below.

The Real Cost of Using CC When You Meant BCC

This is the angle most “what is CC in email” explainers skip. The difference between CC and BCC is a single click, and regulators have fined organisations for getting it wrong.

The UK Information Commissioner’s Office (ICO) has issued several public penalties for exactly this mistake:

Notice the pattern. None of these was a hack. Each was an ordinary email, sent to a sensitive group, with the addresses in a visible field. In two of the three cases the list alone revealed health information, because being on that mailing list told everyone something private about the people on it.

You don’t need to work in healthcare for this to matter. A dentist emailing patients, a lawyer emailing clients in a class action, or a recruiter emailing every candidate for a confidential role can all cause harm through a CC field.

If you do send an email with addresses exposed, act quickly. Recalling messages rarely works outside a single organisation’s Microsoft 365 environment. Apologise to the recipients, ask them to delete the email and not reply all, record what happened, and check whether your local data protection law requires you to report it. The mindset is similar to recovering after a typo email: own it fast, fix what you can, and change the process so it can’t happen twice.

Why You Shouldn’t Use CC or BCC for Mass Emails

Once a list gets past a couple of dozen people, CC and BCC become the wrong tool entirely. There are three reasons.

Recipient Limits Cut You Off

Every provider caps how many recipients one message and one account can reach. Recipients in To, CC and BCC all count toward the same total.

Limits as published in Google and Microsoft help documentation in 2025. Providers adjust these without much notice, so check the current figures before a large send.

Hit a cap and your account can be temporarily blocked from sending, often for 24 hours. That’s a bad day if it’s also your work address.

Spam Filters Distrust It

A personal or work mailbox blasting a single message to hundreds of BCC recipients looks a lot like spam. There’s no unsubscribe link, no list management, and replies and complaints pile up. Recipients who mark it as junk drag down your sending reputation, and future one-to-one emails from the same address start landing in spam. If you want to understand why, our explainer on how e-mail spam filtering works covers the signals filters weigh.

The big mailbox providers have also tightened the rules for anyone sending at volume. Since February 2024, Google and Yahoo have required senders of 5,000 or more messages a day to their users to authenticate with SPF, DKIM and DMARC, offer one-click unsubscribe, and keep spam complaint rates below 0.3%. Microsoft began enforcing similar requirements for Outlook.com, Hotmail and Live addresses on 5 May 2025. A BCC blast from your inbox meets none of those standards.

The Law Expects an Unsubscribe

If the message is promotional, laws such as CAN-SPAM in the US and GDPR plus PECR in the UK and EU require things a BCC email can’t easily provide: a working opt-out, a valid physical address in the US case, and records of consent in the European one.

The fix is a proper sending platform. Tools built for email marketing handle unsubscribes, bounces, authentication and personalisation, and they send each person an individual copy so no addresses are ever exposed. Most have free tiers for small lists. Our roundup of small business email platforms compares the options if you’re making that switch.

Reply All, CC and Email Storms

Every CC’d person is a potential Reply All. On a small thread that’s useful. On a big one it’s a hazard.

A reply-all storm starts when a message goes to a huge distribution list. Someone replies to everyone asking to be removed. Others reply to everyone telling them to stop replying to everyone. Each reply goes to thousands of inboxes, and mail servers buckle. Microsoft’s own late-1990s “Bedlam DL3” incident is the textbook case, and the problem was common enough that Microsoft later added reply-all storm protection to Exchange Online. It detects bursts of reply-alls on threads with very large recipient counts and temporarily blocks further reply-alls.

You can head off most of this yourself:

• Use BCC for large announcements so nobody can reply to the whole group.
• Tell people how to respond. “Reply to me directly, not to all” is one sentence and saves a lot of noise.
• Before you Reply All, scan the CC line. Ask whether every name there needs your answer. Usually only the sender and one or two others do.
• Trim the CC list when you reply. You’re allowed to remove people who are no longer relevant. Say so if it’s not obvious (“dropping the wider team from this”).

CC Etiquette: Best Practices for Professional Email

These habits make CC useful rather than annoying.

1. Put action-owners in To, observers in CC. If you want something from someone, they should never be buried in CC.
2. Explain every CC. One clause in the opening line is enough.
3. Keep the list short. Three CC’d people is common. Ten is a meeting invite in disguise.
4. Ask before CCing someone’s manager. If you need to escalate, say “I’m going to loop in Jo on this” first, or escalate in a separate email.
5. Don’t add people mid-thread without context. If you CC someone into an existing conversation, summarise the background in two lines. Dumping a 30-message thread on them is rude.
6. Remove people when they’re done. Move introducers to BCC and drop people whose part is finished.
7. Respect a CC as FYI. If you’re CC’d, you generally don’t need to reply. If you do reply, it’s usually to the sender only.
8. Use BCC for groups of strangers, a mailing tool for anything bigger.
9. Re-check fields before sending anything sensitive. Autocomplete is the main culprit in misdirected email. A colleague called Alex and a client called Alex sit side by side in your address suggestions.
10. Mind your signature on CC-heavy threads. When five external people are reading, a clear, current signature saves them hunting for your title or number. Our email signature examples are a good starting point.

Common CC Mistakes to Avoid

Most CC trouble comes from a handful of recurring errors.

Using CC when you meant BCC. The most expensive mistake on this list, as the ICO cases show. If addresses are private, they go in BCC every time.

Burying the person who needs to act. Putting the decision-maker in CC and an assistant in To means the decision-maker assumes it’s FYI. Then nothing happens.

Passive-aggressive CCs. Copying a boss on a minor complaint, or CCing HR on a disagreement without warning, damages relationships faster than the original problem ever would.

Forgetting that CC’d people see the whole thread. When you reply on a thread that includes clients, every earlier message (including internal comments someone added lower down) goes with it. Read the full quoted text before you send.

Replying all to a BCC. If you were BCC’d, reply only to the sender. Otherwise you reveal that you were quietly copied.

CCing too many people on a thread that will grow. A message to 12 people becomes 12 copies of every reply. Over a week that’s a lot of clutter. If you’re on the receiving end of that kind of thread, filters, mute and labels help, and when the clutter has already piled up our guide to bulk delete Gmail emails will clear it out quickly.

Assuming CC means the person read it. Being copied isn’t the same as being informed. If something matters, ask for a confirmation or put the person in To with a direct question.

Key Takeaways

• CC stands for carbon copy, a term inherited from typed business letters.
• CC’d recipients get the full message and can see everyone else in To and CC.
• To is for people who must act, CC for people who should know, BCC for people whose addresses must stay private.
• Explain every CC in the body of the email, and keep the list short.
• Using CC or To for private contact lists can be a data breach. The largest UK fine for this kind of email mistake so far is £350,000, and UK GDPR allows far higher penalties.
• Past a small group, neither CC nor BCC is the right tool. Use a proper sending platform that handles unsubscribes and authentication.

FAQ

What does CC stand for in email?

CC stands for “carbon copy.” It comes from the carbon paper used to make duplicates of typed letters. In email, the CC field sends a copy of your message to extra recipients, and every recipient can see who was copied.

What is the difference between CC and BCC?

Both send the same message to extra people. CC recipients are visible to everyone on the email. BCC (blind carbon copy) recipients are hidden from all other recipients, and they don’t receive replies when someone clicks Reply All.

Do CC recipients need to reply?

Usually not. CC traditionally means “for your information.” If you need someone to respond or take action, put them in the To field and ask them directly in the email.

Can people in the To field see who was CC’d?

Yes. Everyone in To and CC can see every address in both fields. Only BCC addresses stay hidden.

Can a BCC recipient see who else was BCC’d?

No. Each BCC recipient sees the To and CC addresses, plus usually a note that they themselves were BCC’d. Other BCC recipients are invisible to them.

Is it rude to CC someone’s boss?

It depends on why. CCing a manager who genuinely needs the information is normal. CCing someone’s boss to pressure them, especially without warning, is widely seen as hostile. If you need to escalate, tell the person first or email the manager separately.

How many people can I CC on one email?

Providers cap total recipients per message across To, CC and BCC combined. Free Gmail accounts allow up to 500 per message, free Outlook.com accounts have lower limits (roughly 100 per message), and Microsoft 365 defaults to 500. Google Workspace allows up to 2,000 per message, of which a maximum of 500 can be outside your organisation. Long before you hit those limits, a mailing platform is the better choice.

What does “cc’d” mean?

“CC’d” is the past tense of CC used as a verb. “I’ve CC’d Maria” means Maria’s address was added to the CC field, so she received a copy of the email.

You just spotted a typo in an email that already went out, and your first instinct is to fire off a correction. Slow down for two minutes. Most typos don’t need a follow-up, some need one urgently, and the wrong kind of correction can do more damage than the original mistake.

What You Need Before You Act

Have these in front of you before you send anything else:

• The exact sent version. Open it from your Sent folder or your email platform’s campaign report. Don’t work from the draft or from memory.
• The recipient count. One client, a team of 12, or a list of 40,000 each call for a different response.
• Access to wherever links point. That might be your website, landing page builder or ecommerce admin. Many link mistakes can be fixed there without another email.
• Your campaign stats for a bulk send. You want delivered, opened and clicked counts.
• A second pair of eyes. A colleague who didn’t write the email will judge severity more calmly than you will right now.

Step 1: Check Whether You Can Still Pull It Back

If you sent from a personal inbox in the last few seconds, you may still be inside an undo window. Here is how long each major client gives you.

Undo Send doesn’t pull a message back from someone’s inbox. Your client simply holds the email for that many seconds before it actually goes out. Once the timer runs out, it’s gone.

Outlook’s Recall feature is different. It only works when you and the recipient are in the same Microsoft 365 or Exchange organization. It will never recall a message sent to a Gmail, Yahoo or other outside address. Recipients may also get a notice that you tried to recall something, which draws more attention to the email than the typo would have.

Marketing platforms work the same way once a campaign is delivered. Klaviyo, HubSpot and Mailchimp all let you cancel a scheduled campaign. None of them can edit or remove an email that has already landed in an inbox. Large sends go out in batches, so if a campaign is still sending, check your platform’s help docs right away to see whether you can cancel the remaining batches.

Step 2: Find Out What Actually Went Wrong

Before you write a single word of apology, pin down the error precisely. “There’s a typo” isn’t a diagnosis.

Open the sent email and check each part separately:

1. Subject line and preview text. These are seen by everyone, including people who never open.
2. Facts. Prices, discount codes, dates, times, time zones, addresses and deadlines.
3. Links and buttons. Click every one in the sent version. Don’t trust the editor preview.
4. Personalization. Look for “Hi {first_name}” left blank or showing raw merge tags.
5. Names. A misspelled client name is a bigger deal than a misspelled common word.
6. Plain spelling and grammar. These are usually the least important item on this list.

In a marketing platform, open the campaign report and look at link click data. A link with zero clicks while others are healthy often points to a broken URL. In Klaviyo, the campaign’s click map shows which links got activity. In HubSpot, the email’s performance page lists clicks per link.

Step 3: Decide Whether the Typo Needs a Correction

Not every mistake is a mistake your reader will notice or care about. Teams fixate on a missing comma while recipients skim past it. Use this triage table.

The test is simple. If the error will cause someone to take the wrong action, miss a deadline, lose money or feel personally slighted, correct it. If it’s only untidy, let it go.

Repeat offenders are another matter. One typo in one email gets forgiven. Typos in every email tell readers nobody is checking, so fix your process even when you skip the correction.

Step 4: Fix What You Can at the Destination

Here’s the angle most people miss: the email is frozen, but the things it points to are not.

If your link points to a mistyped path on your own site, add a 301 redirect from the wrong URL to the right one. Everyone who clicks lands in the right place, and nobody needs a second email.

On an Apache server, that’s one line in .htaccess:

Redirect 301 /spring-sael /spring-sale

On Nginx:

location = /spring-sael {
    return 301 /spring-sale;
}

Most ecommerce and landing page platforms, including Shopify and WordPress plugins, offer the same thing through a URL redirect setting with no code.

Discount codes work the same way. If you printed SPRNG20 instead of SPRING20, create SPRNG20 as a valid code. If you printed a deadline later than the real one, honor the later date. Fixing it at the source and saying nothing is the cleanest correction there is.

Step 5: Write the Correction for the Person Who Needs It

If you do need to correct, keep it short, factual and lighter than the original. Nobody wants three paragraphs of regret over a wrong time.

One-to-one emails

Reply in the same thread so the context is right there. Lead with the correct information, not the apology.

Quick correction: the call is at 2pm ET, not 3pm. Sorry for the typo.

For a misspelled name, a single line is enough:

Apologies for misspelling your name in my last email, Joan.

“Sorry for the typo” is fine for colleagues and most clients. In more formal settings, “Apologies for the error in my previous message” reads cleaner. Skip “sorry for any inconvenience” unless there was real inconvenience.

Don’t send a correction for a trivial typo to a client. Pointing out “recieve” makes them reread the email looking for it.

Marketing campaigns

A correction campaign should be shorter than the original and name the fix in the subject line:

• “Correction: your code is SPRING20”
• “Oops, here’s the working link”
• “Wrong date in our last email: the sale ends Thursday”

Put the corrected information in the first line of the body. Add one sentence of apology, repeat the main call to action and stop. A touch of humor works if it fits your brand voice. Groveling doesn’t.

Leave your normal footer and unsubscribe link in place. A correction is still a marketing email under CAN-SPAM and GDPR.

Step 6: Send the Correction to the Right People

Don’t resend to your whole list by reflex. Target the people the mistake affected.

Who to include:

• Clickers of a broken link, if the fix needs a new link.
• Openers, for a wrong fact in the body. Since Apple Mail Privacy Protection launched in 2021, open data is inflated by automatic opens, so treat it as a broad net.
• Everyone delivered, only for errors in the subject line or a deadline nobody can afford to miss.

In Klaviyo, build a segment using “What someone has done” with the Received Email, Opened Email or Clicked Email metric, filtered to the campaign name. In HubSpot, create an active list or segment filtered on the specific marketing email’s sent, opened or clicked activity. Mailchimp lets you segment by campaign activity in the same way.

A second send has real deliverability cost. Every extra email to people who didn’t need it raises your odds of unsubscribes and spam complaints, and mailbox providers watch those numbers closely. Understanding how e-mail spam filtering weighs complaints explains why a sloppy blast can hurt your next ten campaigns.

Google also recommends keeping spam rates below 0.1%. A correction that annoys 0.2% of recipients can tip a healthy sender toward that 0.3% ceiling.

If the Typo Was in an Email Address

Some typos aren’t in the message at all. They’re in the address.

You sent to the wrong person. If the email went to “jon@” instead of “joan@” and contained nothing sensitive, ask the wrong recipient to delete it and resend to the right person. If it contained personal data about someone else, treat it as a possible data breach. Under GDPR Article 33, organizations must report a breach that poses a risk to people’s rights to their supervisory authority within 72 hours of becoming aware of it. Tell your data protection lead immediately.

You mistyped your own address when signing up for something. You won’t get the verification email, and you usually can’t fix it yourself. Contact the company’s support team through their website or chat, prove who you are, and ask them to update the address.

Your subscribers mistype their addresses. Addresses like “[email protected]” bounce and drag down your sender reputation. Use double opt-in so mistyped addresses never get confirmed, and turn on any typo suggestion your sign-up form offers.

Common Mistakes That Make a Typo Worse

• Silently fixing a fact that mattered. If you quoted the wrong price and just update your website, anyone who acted on the email feels misled. Silent fixes only suit errors nobody could act on.
• Sending the correction before checking it. Corrections get rushed, and a typo in the correction is far more memorable than the first one.
• Over-apologizing. A long apology makes the error look bigger than it was.
• Resending the entire original email. People get a duplicate, can’t tell what changed and start unsubscribing.
• Correcting at 11pm. Unless a deadline forces it, send the correction at your normal send time.
• Blaming a person. “Our intern made a mistake” is never something readers need to hear.

Build a Preflight That Catches the Next One

Typos in emails come from rushing, not from bad spelling. A written checklist slows you down at exactly the right moment. Never rely on memory for this.

Reading out loud is the step teams skip, and it’s the one that catches the most. Your eyes fill in missing words. Your ears don’t.

In Klaviyo, use Preview and test to view the email as a specific profile and send test emails. In HubSpot, use the Preview option to check how it renders for different contacts, then send a test email before you hit Review and send. Both platforms render personalization differently from what you see in the editor, so the test send matters.

Check your signature once in a while too. A typo there repeats in every email you send. If you’re redoing it, a few good email signature examples will help you keep it short and easy to proofread.

What a Good Outcome Looks Like

After the dust settles, you should have:

• The right people holding the right information, and nobody else bothered.
• Broken links redirected and wrong codes made valid, so stragglers who open late still get a working email.
• Unsubscribe and complaint rates on any correction send roughly in line with your normal campaigns.
• One new line on your preflight checklist covering whatever slipped through this time.

That last point is the real fix. Every mistake shows you a gap in your process, so close it before your next send.

FAQ

Should I apologize for a typo in an email?

Only when the typo changes the meaning, affects an action or misspells someone’s name. For ordinary spelling slips, an apology draws attention to something most readers missed.

How do I say sorry for a typo professionally?

Lead with the correct information, then add one short line. “Correction: the meeting is Tuesday, not Thursday. Apologies for the error.” That’s all it takes.

Can I unsend an email in Gmail after 30 seconds?

No. Thirty seconds is Gmail’s maximum Undo Send window. After that, the message is delivered, and you’ll need to send a follow-up if a correction is warranted.

Do typos in emails hurt deliverability?

Occasional honest typos don’t trigger spam filters. Your sending reputation, authentication and complaint rate matter far more. Deliberate misspellings used to dodge filters, like swapping letters for numbers in spammy words, are a different story and do get flagged.

Should I resend the whole campaign with the typo fixed?

Rarely. Send a short correction to the affected segment instead. A full resend duplicates the email for everyone and increases unsubscribes and spam complaints.