PayPal's New Data Sharing Policy Raises Privacy Concerns

Paypal Opted You Into Sharing Data Without Your Knowledge

Here's how to opt out of sharing data for "Personalized shopping." PayPal quietly opted users into sharing data with third parties for "personalized shopping experiences," according to multiple complaints on social media and 404 Media's own tests. "Starting early summer 2025, we'll be building more personal experiences for you," PayPal says on its "Personalized shopping" settings page. "You can opt in and out of sharing at any time by adjusting this setting." On Monday, before I contacted PayPal for comment, the page also included a line that said "We'll use info collected about you after November 27, 2024 to personalize your shopping." As of Tuesday, that line is no longer on the page. As noted by Twitter user Ellen Datlow, you can find that setting and change it by logging into your PayPal account and going to Settings > Data & Privacy > Manage shared info > Personalized shopping. Or, click here while logged in. A link on that page, "how personalized shopping works," opens a popup with a very short description: "We'll share recommendations with participating stores based on your shopping history and preferences. Your info helps participating stores show you products [sic] offers and rewards you might like." As of writing, PayPal opts users into sharing their data by default, without their knowledge -- unless they navigate to the personalized shopping settings on their own. On that page, a toggle is set to "sharing on," agreeing to the statement "Let us share products, offers, and rewards you might like with participating stores." 404 Media tested the process with two PayPal accounts, including a historical one and one created over the last few days. In both cases, the accounts were opted in by default. There's also a link to a new version of PayPal's privacy statement, which differs from -- and has a different URL than -- the privacy statement you would navigate to from anywhere else on the site. The new statement's URL ends with "preview-privacy-full-effective-november272024." The new statement adds several sections relevant to the personalized shopping feature, including: Personal Information we disclose includes, for example, products, sizes, preferences, and styles we think you'll like. Unless we are required by law to obtain your consent, we disclose Personal Information collected after November 27, 2024 (or from earlier if you consent) for personalized shopping experiences. To opt-out of disclosures or Personal Information to Partners and Merchants for personalized shopping experiences, log into your PayPal account and edit your preferences in the Data and Privacy setting. If you opt-out, we will continue to disclose your Personal Information as necessary to complete transactions you initiate, but will not disclose Personal Information to Partners and Merchant for personalized shopping experiences. The new privacy statement also says personal information sent to partners and merchants or their service providers are "subject to the Partners' and Merchants' own privacy policies and procedures," and that PayPal is "not responsible for the privacy or security practices of Partners and Merchants." The new statement also says that if you opt out of this data sharing, PayPal will continue disclosing personal information "as necessary to complete transactions you initiate" but won't send personal information to partners and merchants "for personalized shopping experiences." I asked PayPal whether customers will be directly notified before November 27 that the company plans to share their data with third party partners and merchants, and what happens to users' data if they opt out after that date. Paypal did not respond. Several platforms have been caught changing their terms of service without explicitly notifying customers recently, including education platform Udemy, which announced that it would train generative AI on teachers' classes and automatically opted them in to that data sharing, and LinkedIn also started training AI on user data before updating its terms of service. Optery, a data deletion service that updated its terms of service to say the company may transfer user data to OpenAI and turned on the data transfer for users by default -- and then walked back those terms after public backlash.

Don't let PayPal share your personal data!

In a growing trend of online services quietly altering their data collection practices, PayPal is the latest to join the fray. According to PayPal's policy updates page, issued on September 23 for U.S. users, the service is set to begin sharing your data with third-party merchants "to help improve your shopping experience and make it more personalized for you." Starting in early summer 2025, this new policy will allow PayPal to collect and share user data. However, data collection will begin as early as November 27, 2024. Unfortunately, users are opted into this data-sharing by default, raising privacy concerns, especially for those under regulations like GDPR. Some U.S.-based users on Twitter have flagged the default opt-in as potentially problematic. One user, based in the UK, found that the same policy had been silently activated for them as well. New policy on how data is shared to users will however differ depending on the location of the user. In the UK, the policy will be implemented starting from October 10, 2024. PayPal's July 8 update clarifies that in the UK, "merchants are permitted to share customer personal information provided to them by PayPal with their service providers." The issue with PayPal's latest move lies not only in the fact that users are automatically opted in but also in how such practices are becoming normalized. PayPal is not the first company to quietly change its data policies without upfront user consent. As recently, LinkedIn activated AI training on user data by default, and before that, Facebook, Instagram, and X (formerly known as Twitter) did the same with AI tools using public information. PayPal's justification for the data-sharing is tied to enhancing the user experience through personalization. While personalization is often positioned as a benefit, it doesn't necessarily justify the broad sharing of user data. Users should have a say in how much of their data is used to "improve" their shopping experience. By defaulting users into data sharing, PayPal effectively places the burden on individuals to find and disable these settings -- a task many may overlook or be unaware of. The impact of this new policy isn't universally consistent across all regions, adding to the confusion. While users in the U.S. and UK are immediately affected, other jurisdictions like the EU may have different rules depending on their regulations. Such variability in data practices makes it difficult for global users to understand exactly what's happening to their information. The growing problem of data opt-outs PayPal's decision to opt users into data sharing without upfront consent is part of a larger trend in which companies assume users will comply with new policies by default. This opt-out model forces users to take action to protect their privacy, rather than companies seeking permission first. The burden is shifted entirely to the user, and this has bigger implications for privacy laws. GDPR, for instance, clearly stipulates that companies must obtain explicit consent before processing personal data. Although PayPal has not rolled out the policy in all regions, these practices could push the boundaries of compliance with such regulations. PayPal's recent move to quietly opt users into data sharing is just one more example of how companies are taking liberties with user information, hoping that the default settings go unnoticed. By staying informed and regularly checking your privacy settings, you can prevent your data from being shared without your consent. It's time that companies adopt a more transparent approach, offering clear choices rather than assuming consent. Until that change happens, users must remain proactive, protecting their personal information from being used without their full understanding or approval.