How to protect from spam when the legislation forces you to display the email address?

Question

Context

I want to protect a ecommerce website from email spam, whilst the legislation in my country makes mandatory to publish an email contact address on ecommerce sites.

As an additional constraint, GDPR rules also apply, and some captcha solutions are not compatible with them.

Being fully aware there won't be a perfect solution to this paradoxical situation, I am looking for a mix of possible techniques to reduce spam from robots, despite the risk of the email address being collected manually remains.

---

Project

Here's what I am currently considering:

1. Publish an email address that redirects to another one, so that I delete and replace the published address if it gets too much spam after some time.
2. Display the email address on a picture instead of clear text.
3. Load the picture only after some mouse interaction, like dragging some slider (either a simple one, or puzzle-style captcha one). Another idea could be splitting the picture into chunks that load progressively on different of mouse clicks asked to the visitor. Or combine different techniques.
4. For the picture showing the email address, use some font that is challenging for OCR. There is also a paradox here as it must still be easy to read by a visitor. Maybe would a dotted font suffice ?
5. Add some anti-badbots rules in the .htaccess file.

I am also open to other ideas, especially if they are efficient and easy to implement.

---

Criteria

For the components, my selection criteria will be:

• able to run on a PHP shared hosting, or pure Javascript
• open source
• no charge
• no registration required
• easy to install on the contact page.
• preferably compact
• easy to use for the visitor

---

I am looking for comments, ideas, suggested scripts and fonts. Thank you.

Answer 1

A little bit of obfuscation stymies all the bots. I've been using a combination of HTML entities, JavaScript, math, and plain text to display my email address in my page for years and still get no spam.

<script type="text/javascript">document.write("it&#"+(100+15)+";me"+5);</script><script type="text/javascript">document.write("&#"+(2*32)+";");</script>examp&#108;e.com

shows up in the page as [email protected].

If I ever did start to get spam, I'd start by changing the email address and throwing the old one away. There is a number in it for a reason.

I'd imagine that using an image like you suggest would also prevent spam, but it would also make the email address hard to access for real users.