Skip to main content
SpringerLink
Log in

Purchase Details Leaked to PayPal

  • Conference paper
  • First Online:
Book cover Financial Cryptography and Data Security (FC 2015)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 8975))

Included in the following conference series:

Abstract

We describe a new form of online tracking: explicit, yet unnecessary leakage of personal information and detailed shopping habits from online merchants to payment providers. In contrast to Web tracking, online shops make it impossible for their customers to avoid this proliferation of their data. We record and analyse leakage patterns for N = 881 US Web shops sampled from Web users’ actual online purchase sessions. More than half of the sites shared product names and details with PayPal, allowing the payment provider to build up comprehensive consumption profiles across the sites consumers buy from, subscribe to, or donate to. In addition, PayPal forwards customers’ shopping details to Omniture, a third-party data aggregator with an even larger tracking reach. Leakage to PayPal is commonplace across product categories and includes details of medication or sex toys. We provide recommendations for merchants.

Online companion at: http://preibusch.de/publ/paypal_privacy

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Valentino-DeVries, J., Singer-Vine, J.: They Know What You’re Shopping For, 7 Dec 2012. http://on.wsj.com/TQ8Dbi

  2. Duhigg, C.: How Companies Learn Your Secrets 16 Feb 2012. http://nyti.ms/QbbTyS

  3. OECD: The OECD Privacy Framework (2013)

    Google Scholar 

  4. European Commission: Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (2012)

    Google Scholar 

  5. PayPal, About PayPal (2014). www.paypal-media.com/about

  6. Bonneau, J., Preibusch, S.: The privacy jungle: on the market for data protection in social networks. In: Eighth Workshop on the Economics of Information Security (WEIS) (2009)

    Google Scholar 

  7. Bonneau, J., Preibusch, S.: The password thicket: technical and market failures in human authentication on the web. In: Ninth Workshop on the Economics of Information Security (WEIS) (2010)

    Google Scholar 

  8. Preibusch, S., Bonneau, J.: The privacy landscape: product differentiation on data collection. In: Schneier, B. (ed.) Economics of Information Security and Privacy III, pp. 263–283. Springer, New York (2013)

    Chapter  Google Scholar 

  9. Krishnamurthy, B., Wills, C. E.: On the leakage of personally identifiable information via online social networks. In: Proceedings of the 2nd ACM Workshop on Online Social Networks (WOSN) (2009)

    Google Scholar 

  10. Soltani, A., Canty, S., Mayo, Q., Thomas, L., Hoofnagle, C.J.: Flash Cookies and Privacy. In: Intelligent Information Privacy Management, Papers from the 2010 AAAI Spring Symposium, Technical report SS-10–05 (2010)

    Google Scholar 

  11. Ayenson, M., Wambach, D.J., Soltani, A., Good, N., Hoofnagle, C.J.: Flash cookies and privacy II: now with HTML5 and ETag respawning, SSRN (2011)

    Google Scholar 

  12. Acar, G., Eubank, C., Englehardt, S., Juarez, M., Narayanan, A., Diaz, C.: The web never forgets: persistent tracking mechanisms in the wild. In: Proceedings of CCS 2014 (2014)

    Google Scholar 

  13. Eckersley, P.: How unique is your web browser? In: Atallah, M.J., Hopper, N.J. (eds.) PETS 2010. LNCS, vol. 6205, pp. 1–18. Springer, Heidelberg (2010)

    Chapter  Google Scholar 

  14. Acar, G., Juarez, M., Nikiforakis, N., Diaz, C., Gürses, S., Piessens, F., P, B.: FPDetective: Dusting the web for fingerprinters. In: Proceedings of the 2013 ACM SIGSAC Conference on Computer and Communications Security (2013)

    Google Scholar 

  15. Tsai, J.Y., Egelman, S., Cranor, L., Acquisti, A.: The effect of online privacy information on purchasing behavior: an experimental study. Inf. Syst. Res. 22(2), 254–268 (2011)

    Article  Google Scholar 

  16. Jentzsch, N., Preibusch S., Harasser, A.: Study on monetising privacy. An economic model for pricing personal information European Network and information Security Agency (ENISA) (2012)

    Google Scholar 

  17. Preibusch, S., Kübler, D., Beresford, A.R.: Price versus privacy: an experiment into the competitive advantage of collecting less personal information. Electron. Commer. Res. 13(4), 423–455 (2013)

    Article  Google Scholar 

  18. PayPal, How would you like to integrate with PayPal? (2013). www.developer.paypal.com/webapps/developer/docs/

  19. PayPal, Getting Started With Express Checkout (2013). www.developer.paypal.com/webapps/developer/docs/classic/express-checkout/integration-guide/ECGettingStarted/

  20. PayPal, “Legal Agreements for PayPal Services,” 2014. [Online]. Available: www.paypal.com/us/webapps/mpp/ua/legalhub-full

  21. PayPal, PayPal Developer Agreement (2013). www.paypal.com/us/webapps/mpp/ua/xdeveloper-full

  22. PayPal, SetExpress Checkout API Operation (NVP) (2014). www.developer.paypal.com/docs/classic/api/merchant/SetExpressCheckout_API_Operation_NVP

  23. Mitmproxy project, mitmproxy 0.9 Introduction (2013). http://mitmproxy.org/doc/index.html

  24. Dempster, A.P., Laird, N.M., Rubin, D.B.: Maximum likelihood from incomplete data via the EM algorithm. J. Roy. Stat. Soc.: Ser. B (Methodol.) 39(1), 1–38 (1977)

    MathSciNet  MATH  Google Scholar 

  25. Adobe Systems Incorporated, Digital marketing Adobe Marketing Cloud (2014). http://www.adobe.com/solutions/digital-marketing.html

  26. Adobe Systems Incorporated, SiteCatalyst variables and query string parameters (2014). http://helpx.adobe.com/analytics/using/digitalpulse-debugger.html#id_1298

  27. BuiltWith Pty Ltd. Websites using Omniture SiteCatalyst (2014). http://trends.builtwith.com/websitelist/Omniture-SiteCatalyst

  28. Krishnamurthy, B., Wills, C.: Privacy diffusion on the web: a longitudinal perspective. In: Proceedings of the 18th International Conference on World Wide Web (WWW) (2009)

    Google Scholar 

  29. PayPal, Privacy Policy: 20 Feb 2013. www.paypal.com/webapps/mpp/ua/privacy-full

  30. Singel, R.: Online Tracking Firm Settles Suit Over Undeletable Cookies, 12 May 2010. http://www.wired.com/2010/12/zombie-cookie-settlement/

Download references

Acknowledgements

We thank the Fonds Wetenschappelijk Onderzoek–Vlaanderen (FWO) for support through the project Data Mining for Privacy in Social Networks (grant number G068611N).

Author information

Authors and Affiliations

  1. Formerly Microsoft Research, Cambridge, UK

    Sören Preibusch

  2. KU Leuven, Leuven, Belgium

    Thomas Peetz, Gunes Acar & Bettina Berendt

Authors
  1. Sören Preibusch
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Thomas Peetz
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Gunes Acar
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Bettina Berendt
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Sören Preibusch .

Editor information

Editors and Affiliations

  1. University of Innsbruck, Innsbruck, Austria

    Rainer Böhme

  2. NTT Laboratories, Tokyo, Japan

    Tatsuaki Okamoto

Rights and permissions

Reprints and permissions

Copyright information

© 2015 Springer-Verlag Berlin Heidelberg

About this paper

Cite this paper

Preibusch, S., Peetz, T., Acar, G., Berendt, B. (2015). Purchase Details Leaked to PayPal. In: Böhme, R., Okamoto, T. (eds) Financial Cryptography and Data Security. FC 2015. Lecture Notes in Computer Science(), vol 8975. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-662-47854-7_13

Download citation

  • DOI: https://doi.org/10.1007/978-3-662-47854-7_13

  • Published:

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-662-47853-0

  • Online ISBN: 978-3-662-47854-7

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation