Your Online Shopping Cart Is Spying on You (And Selling the Evidence)

Every retailer, selling everything from antique medical supplies to Amish-style clothing , needs an online presence. Shopping online is so convenient that you may never need to leave the house. You do pay for this convenience by losing all chance at anonymity, though. In a brick-and-mortar shop, you can plunk down your cash, take your goods, and walk away without even giving your name. In an online purchase, you share a wealth of personal information.

This article was made possible in part by Incogni. It was written and edited independently without partner oversight.

What happens to that data when your online shopping is done? It depends on the merchant, but follow-on activities can range from targeted advertising to accidental exposure of your data to outright sale of your details for cold hard cash. Let's explore the different levels of privacy exposure that can come from online shopping, and how you can minimize any problems.

Why Online Checkout Demands Your Data

At the online store, you can't avoid giving your credit card details for payment. You also have to provide your physical address, so the merchant knows where to send your order. You almost always need to give your email as well, which allows the retailer to send a receipt and keep you informed of any issues.

Once the transaction is complete and the product delivered, the store could just delete your data. But there are plenty of reasons that they don't.

How Retailers Turn Your History Into Market Research

One valid reason for a merchant to retain your purchase information is that it might be needed if there's an issue after the sale. Perhaps the item was defective, or the customer wants to take advantage of a money-back guarantee.

There's also a lot more the retailer can do by remembering your data. They can email you about sales and promotions and greet you by name when you next visit the site, for example. Want to make another purchase? You may find that the site automatically populates the shipping address fields and even your credit card data.

But it doesn't stop there. Information about your purchases becomes fodder for market analysis. The online merchant can calculate what "people like you" buy and use that information strategically. Analysis may, for example, affect plans for how much stock to keep on hand or allow the merchant to experiment with different pricing models. Analyzing aggregate data on what customers are buying now can help predict future trends. And all of this benefits the merchant, not you.

What Your Browsing Behavior Really Reveals

As it turns out, purchase details are only the beginning of what an online retailer knows about you. Everything you've done on the sales website becomes fodder for analysis. What items did you examine before making your choice? How long did you peruse the information about each item? What links did you click within the site?

In a brick-and-mortar shop, you can plunk down your cash, take your goods, and walk away without even giving your name.

Before you even think about checking out, the merchant site knows what you've put into your cart, and whether you left anything in it without completing a sale. The site might even send an email asking if perhaps you forgot that lone item in your abandoned cart.

With this wealth of information about your on-site activity, the retailer can generate a truly useful customer profile. Useful, that is, for advertising and targeted merchandising. If you came to the site by clicking a link in an advertising email, you're likely to get more such ads. Buy a gas grill, and before you know it, you'll see ads for oven mitts and grilling tongs.

Behind the Scenes: How Shops Share Your Info Anonymously

As we've seen, there are a ton of ways a retail site can use your personal information to create an ongoing connection, bringing you back to shop again and again. The possibilities become even wider when merchants share customer data.

A retailer with a conscience may feel that simply swapping full customer profiles, as if they were baseball cards, goes too far. In fact, most of them don't do that. Rather, they take your data and hash it. No, really! It's a computer science term. Hashing is like encryption, but one-directional. Feed the same data into a hash function , and it always returns the same result, but there's no way to go from the result back to the input. If two hashes are the same, then their two originals are the same.

There are plenty of online markets that blatantly sell your data. You may even have signed off on an agreement that allows them to do so. Did you read the fine print?

To start exchanging customer data with a major advertiser or other data collector, the merchant shares only the hash. The receiving entity looks up the hash and either matches it with an existing hashed record or reports that it doesn't know that customer. When there's a match, the merchant and ad agency can share data about you, doing things like enabling personalized advertisements across different platforms.

When you buy a product on one site and get ads for related products on dozens of other sites, you may get an oppressive feeling that your privacy has been compromised. It has, in a way, but the merchant never directly shared your details.

The Data Brokers and Scammers Buying Your Profile

I've mentioned that online merchants can work with advertisers without revealing full details of your personally identifiable information. They can , but not all of them do. There are plenty of online markets that blatantly sell your data. You may even have signed off on an agreement that allows them to do so. Did you read the fine print?

Who buys this information? Data brokers form one big group of consumers. In addition to data they may purchase from websites, brokers pull in publicly available data of all types. Analyzing tons of input, they pull together matching parts into personal profiles. Then they sell the resulting profiles to advertisers, people-search websites, and perhaps even identity thieves .

Spammers and scammers are also big consumers of personal data profiles. They might simply scrape all the emails and blast a spam message. But there's also the possibility they'll pour the full profile into an AI and have it generate a totally convincing spear phishing message.

Why Old Accounts Are a Ticking Privacy Time Bomb

The internet is forever. Sure, you can delete a problem post, but there's no telling who copied, scraped, screenshotted, or archived it while it was visible. By the same token, once a retail site has your personal information, it can retain that data indefinitely. Well, unless enjoined from doing so by legislation such as GDPR and CCPA . You may not have bought anything from Uncle Ed's Ukulele Atelier in 20 years, but a data breach at that site could still expose your data.

Legitimate merchants will show you the data they hold about you and delete it on demand. But how do you know who's holding that data in the first place? Some personal data removal services, as well as other security services, will help with these requests, providing links to opt out or templates for an email request. A few even go hunting for your accounts. You give them access to your email history, and they identify websites where you may have an account.

If you don't take proactive measures, if you just let your antique accounts fester away in the darkness, your inattention could come back to bite you. All it takes is a data breach at one of those sites to totally blow away your privacy.

5 Smart Steps to Reclaim Your Privacy While Shopping

Just because shopping online enables some threats to your privacy doesn't mean you have to give it up. There are quite a few things you can do to make the process safer.

1. Omit optional info and lie about the rest:Yes, the retailer needs your email address, but giving out your phone number is probably optional. If a site starts asking things like your date of birth or other extraneous data, consider finding another merchant. If you do proceed, omit anything that's optional and lie about the rest. Sure, my mother's maiden name is Eleanor Roosevelt!

2. Check out as a guest:Many shopping sites let you save your personal and financial details for convenience. Always turn down this offer and check out as a guest instead. The site still has your information passing through, but at least you haven't given them permission to keep it. Even without a saved shopping account, you still don't have to type in all your details every time.

3. Autofill details with a password manager:Avoid saving accounts with retailers. Use a password manager to autofill your address and credit card details so you don't have to type them manually every time.

4. Use masking and temporary email services:With a temporary email service , you can shop online without sharing your actual email address with the merchant. The best services extend this protection to mask your credit card number and even your telephone number.

5. Engage a personal data removal service:To significantly reduce your digital privacy exposure, use a personal data removal service . This type of service searches data brokers and similar sites for your profile and automatically submits a request to remove your data. Some also help you request the removal of your data from ordinary online merchants.

Shopping online will never be as anonymous as exchanging cash for goods in person. However, with a little care, you can maximize your privacy while still enjoying the convenience of shopping in your PJs.

PCMag and Yahoo may earn commission from links in this article.