I was on a webmastering forum and saw an ad that made a disturbing promise. They claimed that if a person makes a casual visit to your web site, they can obtain that person's email address, and either send emails on your behalf or supply the email address to you.
I've been fighting email spam since '91 and first sat down at a web browser in '95. My first thought was "Wow, what a webmaster would do if they could get a visitor's email address!" But of course web browsers didn't exactly have a settable HTTP header field of "Email:" (can you imagine!), and in fact, a lot of attention was given to try to preserve user privacy, such as the sandboxing of cookies.
But then, I thought, (using Doubleclick as a paper villain here)
Retailer X gets a banner ad from doubleclick.net. Doubleclick has their own cookie, e.g. DC1234567, and doubleclick also gets a Referer which gives away what page/product you're browsing, and it's been tracking your activities this way all over the web, all along.
But then, Retailer X (at DoubleClick's request) embeds your Retailer X ID number X56789 in the Doubleclick image URL... so DoubleClick is able to tie DC1234567 to X56789. Not too dangerous yet.
As it happens I do business with retailer X and they have my email, mail, phone, credit card etc. Either by gift, sale, or acquisition, Retailer X hands Doubleclick its customer list which links X56789 to [email protected], John Doe, 123 Main Street, Anytown USA. Which Doubleclick matches to DC1234567.
It's been tracking "DC1234567"'s browsing activity for years, and now boom! It can go back to every site I've ever browsed and say "We have the PII of your visitor!" Retailer Y (who I only casually browsed and never gave my info) could literally buy that from DoubleClick and send me a bespoke postal mail with a coupon for the exact things I browsed. Heck, a magazine could just slam me a subscription and start sending me bills.
But then, for 20 years, nothing like that ever happened. I never got one single postal mail. I didn't even get emails I didn't sign up for. I couldn't fathom a technical reason why it wasn't happening. It seemed to be a gentleman's agreement or taboo "not to do that". I figured privacy law like GDPR sealed its fate.
Has something changed?
Now I see this company openly advertising this. And come to think of it, recently I've had a couple incidents of getting emails or ticklers I didn't expect. Has my fear finally become a thing after 25 years?
How does their offering work technically - is it different than I originally surmised back in '96?
And why only now?