Tell HN: Shop Pay transmits your info to commerce sites if you're logged in | Hacker News Reader

Tell HN: Shop Pay transmits your info to commerce sites if you're logged in

14 pointsa12k5 comments

This is very annoying. If you use Shop Pay (https://shop.app/shop-pay) and you're logged in and browsing sites, Shop Pay transmits at least your name, email address, and possibly more to these sites.

In my mind, visiting a new commerce website, adding something to my cart, and the immediately being added to the site's email distro and receiving constant "did you forget something in your cart" checkout spam is a huge dark pattern on the site's owners. But Shop Pay shouldn't be transmitting any of my info to the site unless and until I actually check out or choose to sign up for their email distro (which I never do).

The first time this happened (visit new site, add something to my cart, immediately receive spam), I thought it was user error. The second time it became clear it was Shop Pay giving my details to websites.

View on HN

Ugh! I'm not too surprised to hear this. I deal with Shopify daily at work and once installed the Shop app to troubleshoot some problem we were seeing. I didn't get to the point of noticing what OP points out, but it immediately struck me as some kind of virus (not saying it's an actual "computer virus"!) -- it wants to take control of everything in regards to your interactions with Shopify stores, which is a huge amount of shops. I immediately uninstalled it... I think I made a clean break, maybe I'll never know.

The only way I'd ever install it again is if work buys me a separate phone and pays all costs associated with it.

(Now if I have to troubleshoot a Shop-related problem -- of which there are many, I'll say! -- I get someone else to do the "dirty work"...)

1. Are you sure there is no opt-out feature on shop pay site?

2. How can a shop possibly know where to whom to deliver a purchase, whom to bill etc if you don’t share that crucial personal info?

I agree that doesn’t mean you agree to spam, but it is a merchant fault not shop pay. As far as i see it.

If I'm not in the process of checking out, they don't need my email let alone my physical address.

1. Even if there is an opt-out (I don't see it in the shop pay account section), the payment processor shouldn't be transmitting my PII to anybody without my explicit permission. Otherwise any shady site could add a Shop Pay integration and do drive-by scraping of user data without their consent or knowledge.

2. Of course you have to share that when you checkout, but it's different if they're passively scraping it from a third-party without your knowledge & consent.

> but it is a merchant fault not shop pay

How is it not Shop Pay's fault? If they're the ones giving them the data.

Reply on news.ycombinator.com