Is AOL Mail safe in 2026? The new owner, privacy, security

AOL Mail is one of the oldest free inboxes still running, and in 2026 it quietly changed hands. If you or someone you help still uses an @aol.com address, "is it safe" now covers three questions: can strangers get in, what does the company do with your mail, and will the account still be there.

Is AOL Mail safe to use?

AOL Mail is reasonably safe from hackers if you turn on 2-step verification or a passkey and remove old security questions. It is not private: AOL's policy lets it process the content of your emails for features and use commercial emails for ads, and AOL holds the keys. Since 2026 it has belonged to Bending Spoons.

Here is the evidence for each part, and what to change.

Who owns AOL Mail now?

Not Yahoo anymore. AOL's own FAQ about the sale says "Yahoo has agreed to sell the AOL business to Bending Spoons," an Italian software company, with closing "expected to be completed on or after January 2, 2026." TechCrunch reported in July 2026 that the AOL acquisition was completed this year.

What changed for users:

• A new company is responsible for your data. The current privacy policy, last updated September 11, 2026, names AOL Media LLC in New York as the data controller.
• Your address and login did not change. The FAQ says your email address, password and login details stay the same.
• Yahoo can still receive data. The policy says: "We may transfer your data to Yahoo Inc. as an independent data controller," adding that this "does not affect EEA users."
• Mail still flows through Yahoo-named servers. On October 22, 2026, the MX record for aol.com, which tells other servers where to deliver AOL mail, pointed to mx-aol.mail.gm0.yahoodns.net. Anyone can check it with a DNS lookup.

Bending Spoons has made deep staff cuts at companies it buys. The company has said it added about 1,830 people through the AOL, Eventbrite and Vimeo deals and expects "only a few hundred to remain" once the changes are done later in 2026, according to TechCrunch. That is not a security problem in itself, but it is worth knowing if you depend on AOL support.

Does AOL read your emails?

AOL's software does, for specific purposes the policy lists. The privacy policy names "the content of incoming and outgoing emails and attachments, and metadata about your emails" as data processed for "Smart Features," such as automatically identifying flight and hotel bookings and one-tap unsubscribe. Depending on where you live, that rests on your consent or on AOL's "legitimate interest."

For advertising, the policy lists "information that we may collect from the emails you receive from retailers or other organizations" (it calls this "Commercial Emails") among the data used for both tailored content and targeted ads. If you refuse consent where consent is required, "we will still show you ads, which will not be tailored on these categories of information."

Under the policy, AOL may also share personal data with advertising networks as independent controllers, with "public, judicial and/or police authorities, within the limits established by applicable laws," and with its corporate affiliates.

None of this is unusual for a free, ad-funded inbox. It does mean your mail sits on AOL's servers in a form AOL's systems can read.

Is AOL Mail secure from hackers?

The tools are better than AOL's old reputation suggests, and they have improved this year.

• Passkeys. AOL's passkey page, updated October 5, 2026, lets you sign in with your face, fingerprint or device PIN. You create the passkey on a phone first, then use it to sign in on a computer by scanning a QR code.
• 2-step verification by text, call or an authenticator app. AOL's 2-step page notes the authenticator option may not be available on every account yet, and you need at least two recovery methods to see it.
• Security alerts. Since a May 2026 update, AOL emails your primary and backup addresses when your password, recovery details, 2-step settings or passkeys change, when an app password is used, and when it sees an unrecognized sign-in.
• App passwords let older mail programs connect without your main password.

The best-known incident on AOL's own record came in April 2014, when the company confirmed that attackers had taken email addresses, postal addresses, address books, encrypted passwords and encrypted security answers from "a significant number of user accounts," and spammers then sent spoofed mail from addresses mimicking 2% of AOL accounts, the Los Angeles Times reported.

The biggest risk is not a hacker

For AOL users the more common danger is a scam that impersonates AOL support. AOL does sell phone help: its help pages say to "call paid premium support at 1-800-358-4860." Scammers copy that model with fake numbers in search ads and pop-ups, then ask for remote access to your computer or a payment.

Two rules cover it. Use only the phone number printed on help.aol.com itself, never one from an ad, an email or a pop-up. And never let a caller install remote-access software or read you a code sent to your phone. Our guide on spotting a phishing email shows the signs that give fake AOL messages away.

Check AOL's mail security yourself

Two public DNS records show how aol.com handles spoofing and encrypted delivery. On October 22, 2026:

Without MTA-STS, a sending server that cannot set up an encrypted connection is free to deliver in plain text, and an attacker in the network path can force that downgrade. RFC 8461 is the standard that lets a domain forbid it. Yahoo.com publishes an MTA-STS policy in testing mode; aol.com publishes none.

Will AOL delete my account?

It can, if you stop using it. The privacy policy says account data is kept "for no more than three (3) years from your last interaction with our Services," after which "your account is deleted, and your data is either deleted or anonymized." AOL's help page on deleted accounts adds that if this happens, "your old username may not be available."

If you keep an AOL address as a backup for banks or other accounts, sign in at least once a year. Better still, move those accounts to an address you use every day, since whoever controls a recovery email can reset passwords.

Is AOL Mail safer than Gmail?

Not on the points you can check. Gmail's domain enforces MTA-STS, and Google says it does not process email content to serve ads, as we cover in our post on whether Gmail is private. AOL publishes no MTA-STS policy and uses commercial emails for ad targeting. Both offer passkeys and 2-step verification, both hold the keys to your stored mail, and neither encrypts it end to end. Our look at whether Yahoo Mail is safe covers the closest relative.

How to make AOL Mail safer

1. Add a passkey from a phone browser, then use it on your computer.
2. Turn on 2-step verification on the Account Security page, using an authenticator app if your account offers it.
3. Disable security questions. AOL says an email address or phone number is more secure and lets you switch them off.
4. Update recovery details so the security alerts reach an inbox you read.
5. Delete app passwords you do not use, and do it again after any password change.
6. Check mail settings for tampering. AOL's hacked account guide lists filters, display name, signature, blocked addresses and away messages.
7. Review ad and privacy choices in AOL's privacy controls and cookie settings.
8. Sign in at least once a year so the three-year inactivity clock does not run out.

If you are ready to retire the AOL address

Moving is easier than most AOL users expect, and keeping the old account open while you switch costs nothing. Secria Mail gives you a free mailbox with no phone number or card needed, imports your old mail, and keeps every message in your mailbox under zero-access encryption. In Secria, tracking pixels are removed automatically and senders never see your IP address.

Frequently asked questions

Is AOL Mail still free?

Yes. AOL's FAQ on the sale says there were no extra charges to keep using AOL services through the change of owner. AOL also sells optional paid plans and paid phone support.

Is AOL Mail being discontinued?

There is no announcement that AOL Mail is closing. AOL discontinued its dial-up internet service on September 30, 2025, which some people confused with the mail service. Inactive accounts can be deleted after three years under the current privacy policy.

Is AOL still owned by Yahoo?

No. Yahoo sold AOL to Bending Spoons, and since 2026 AOL Media LLC is responsible for your data. The privacy policy still allows some data to be transferred to Yahoo Inc. as a separate controller.

Is it safe to open AOL emails?

Opening a message is generally safe. The risk is in links, attachments and requests for codes or payment. AOL says never to interact with spam, including its unsubscribe link.

Can someone hack my AOL account?

Yes, if they get your password and you have no second step. A passkey or 2-step verification blocks most account takeovers, and AOL can email you when it sees a sign-in from a new device, browser or location.

An AOL account can be locked down in ten minutes. Whether you want your mail with an ad-funded company that changed hands this year is the real decision.