3

This weekend, Paypal started sending me emails with discount offers based on websites I visit in incognito mode on my phone.

  • I have an Android smartphone and am browsing in incognito mode in Chrome. I have the latest security updates for my phone installed (they're issued monthly) and Chrome is up-to-date
  • I have a Paypal account but only use it rarely; I have never logged into my Paypal account on my phone, but have logged into my account from my PC on the same home network (and therefore same IP address).
  • I close all my incognito tabs (thus clearing any cookies) every day or two
  • On two separate occasions over two days, about an hour after I visited the website for a retailer, Paypal sent me an email offer to save $5 if I made a purchase on that retailer's website with Paypal (these were two different retailers). I have never before received this kind of email offer from Paypal.

I do not believe this is a phishing scam. The emails from Paypal look completely legit, with the correct email address and none of the typos, misplaced graphics, or other telltale signs of a copycat email. The emails do not ask me for my credentials or include a link to a login page; they do include a valid link to the retailer's real website (not a similar looking phishing website). They instruct me to purchase an item from the website and use Paypal as my payment method in order to redeem the offer.

I am trying to think of an explanation for this disturbing invasion of my privacy. Unless Paypal is knowingly using illegal spyware to monitor web browsing on smartphones, this seems like the most likely explanation (though I'm not sure if it's legal): The retailers have an agreement with Paypal to send Paypal a list of every IP address that visits their website; Paypal correlates this with a list of known IP addresses of their users and emails the users it recognizes with offers.

Are there other possibilities I haven't considered? What can I do to protect myself from Paypal's monitoring of my private web browsing, other than resetting my modem to change my IP address?

Improve this question
3
  • if websites have some embedded PayPal integration, then it is possible that the embedded integration sends an HTTP request to PayPal each time you load the web page.
    – Esther
    May 30, 2022 at 17:56
  • @Esther Such a request could not contain my account info, since I've never logged into Paypal on my phone, so we'd assume that Paypal's correlating my IP address as I suggested in the question?
    – Kevin
    May 30, 2022 at 18:03
  • IP address, other network information, location.
    – Esther
    May 30, 2022 at 19:37

1 Answer 1

Reset to default
6

PayPal details in its privacy policy all of the ways it collects data, as well as the kinds of data it collects. If sites have PayPal integration, then they send an HTTP request to PayPal each time you visit the site, which for sure includes your IP address, and may also include other information about your device. Specifically, from the above-mentioned privacy policy:

Such information may include, but is not limited to, your device type; your device’s network connections; your device’s name; your device IP address; information about your device’s web browser and internet connection you use to access the Site or Services; Geolocation Information; information about apps downloaded to your device; and biometric data.

They can collect at least some of this information about you regardless of whether or not you are logged into an account on the device.

All of this can be used to identify that visit with your account, even in Incognito Mode. You can use whatismybrowser.com or privacy.net to see some of the personal information that websites have access to, even when in incognito mode.

Improve this answer
12
  • 2
    This is true, but not quite applicable in this particular case. The OP is saying that PayPal was accessed from a PC and the other websites from a smartphone. Thus, except of IP, they have nothing in common. Browser fingerprints are useless in such case.
    – mentallurg
    May 30, 2022 at 20:44
  • IP and other network info (WiFi access point, ISP, etc)
    – Esther
    May 30, 2022 at 20:49
  • 3
    Browser cannot access info about WiFi access point, ISP, etc. The information about browser agent, display resolutions etc. is useless, because PC and smartphone are different devices. Furthermore, the ISP is determined by IP and, even if contained in the request data, it would not give any additional info. Thus, only IP is common for PC and smartphone.
    – mentallurg
    May 30, 2022 at 21:31
  • True, I saw those on the websites I linked, which can see/guess a lot of information from your browser, but they guess that based on IP. So yes, it's pretty much just IP address then, which doesn't take any high-level conspiracy to obtain, just a website embed that sites willingly add to enable you to use PayPal on their sites.
    – Esther
    May 30, 2022 at 21:35
  • I should have thought to check PayPal's privacy policy; I was just shocked at this particularly invasive marketing behavior. I've been using the internet since the 90s and have never before received emails from any company or service based on my browsing history on other websites while not even logged in to an account.
    – Kevin
    May 31, 2022 at 20:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .