We've always had a very strict permission policy at Campaign Monitor with clear-cut rules about what does and doesn't constitute permission. There was however one piece of functionality which perhaps relaxed our high standards a little - forward to a friend reporting.
To date, we not only store which of your subscribers forward your email to a friend or colleague, we also told you exactly who they forwarded it to. We certainly didn't add these friends to a list or anything nasty like that, but we did expose their details nonetheless. To compound the problem, it wasn't crystal clear on the Forward to a Friend page that your friend's details were even being captured. Another slap on our wrists.
While we never had any negative incidents or complaints around this issue, it's clearly not best practice and we've gone ahead and stopped capturing exactly who forwards to who. Instead, you'll now see which subscribers forwarded your email and how many people they forwarded it to. This change has also been applied to any previous campaigns you've sent.
From personal experience, I know how interesting this data was, but individual's details were being exposed to the campaign sender without their permission. We need to put the privacy of these people first. If you're hoping to capture new subscribers via the Forward to a Friend feature, we recommend adding a prominent link in each email encouraging new subscribers to sign up, then link right to the subscribe form on your site.