I was on a webmastering forum and saw an ad that made a disturbing promise. They claimed that if a person makes a casual visit to your web site, they can obtain that person's email address, and either send emails on your behalf or supply the email address to you.

I've been fighting email spam since '91 and first sat down at a web browser in '95. My first thought was "Wow, what a webmaster would do if they could get a visitor's email address!" But of course web browsers didn't exactly have a settable HTTP header field of "Email:" (can you imagine!), and in fact, a lot of attention was given to try to preserve user privacy, such as the sandboxing of cookies.

But then, I thought, (using Doubleclick as a paper villain here)

Retailer X gets a banner ad from doubleclick.net. Doubleclick has their own cookie, e.g. DC1234567, and doubleclick also gets a Referer which gives away what page/product you're browsing, and it's been tracking your activities this way all over the web, all along.

But then, Retailer X (at DoubleClick's request) embeds your Retailer X ID number X56789 in the Doubleclick image URL... so DoubleClick is able to tie DC1234567 to X56789. Not too dangerous yet.

As it happens I do business with retailer X and they have my email, mail, phone, credit card etc. Either by gift, sale, or acquisition, Retailer X hands Doubleclick its customer list which links X56789 to [email protected], John Doe, 123 Main Street, Anytown USA. Which Doubleclick matches to DC1234567.

It's been tracking "DC1234567"'s browsing activity for years, and now boom! It can go back to every site I've ever browsed and say "We have the PII of your visitor!" Retailer Y (who I only casually browsed and never gave my info) could literally buy that from DoubleClick and send me a bespoke postal mail with a coupon for the exact things I browsed. Heck, a magazine could just slam me a subscription and start sending me bills.

But then, for 20 years, nothing like that ever happened. I never got one single postal mail. I didn't even get emails I didn't sign up for. I couldn't fathom a technical reason why it wasn't happening. It seemed to be a gentleman's agreement or taboo "not to do that". I figured privacy law like GDPR sealed its fate.

Has something changed?

Now I see this company openly advertising this. And come to think of it, recently I've had a couple incidents of getting emails or ticklers I didn't expect. Has my fear finally become a thing after 25 years?

How does their offering work technically - is it different than I originally surmised back in '96?

And why only now?

  • Um, this is not new at all. Nothing's changed. No agreements. What you describe is normal.
    – schroeder
    Mar 11, 2020 at 7:40
  • "I never got postal mail" - 1. how would you know if the mail you received was not from a database like this. 2. postal mail is expensive when you already have email.
    – schroeder
    Mar 11, 2020 at 7:41
  • @schroeder 1 because I would have noticed anything irregular, particularly tied to web activity and 2. penetration. I regularly browse some of the most monetized keywords on the web (my job), would a mesothelioma lawyer send you a postal piece? Oh yes they would. Mar 11, 2020 at 14:25
  • You're making leaps in logic. 1. You're assuming that the mail would have an observable tie to web activity. 2. Penetration is not profit. This type of database has been around forever. I've browsed and purchased off of these types of ad dbs over a decade ago. All based on cookies and web activity.
    – schroeder
    Mar 11, 2020 at 14:29


You must log in to answer this question.

Browse other questions tagged .