PayPal’s data sharing controversy: New setting raises privacy concerns

PayPal has reportedly made a change to its privacy policy that allows the company to share user data with third-parties. There is a way to opt-out of this data sharing.

A report by 404 Media claims that PayPal has opted in users, without their explicit permission, to share their data with marketers. Why? Well, the company wants to offer users a “personalized shopping experience”.

Users discover opt-out feature for third-party data sharing, sparking debate on digital privacy

The article shows a screenshot that is related to a setting captioned, Personalized Shopping.

(Image courtesy: 404 Media)

The setting is described as follows,”Let us will share products, offers and rewards that you might like with participating stores.” A statement right below the toggle says that PayPal will start building more personal experiences for users starting early summer 2025, and that users can opt in or out of sharing at any time.

It also has a link that leads to a popup that says “PayPal will share recommendations with participating stores based on your shopping history and preferences. Your info helps participating stores show you products, offers and rewards you might like.”

See, the problem here is that the setting was enabled already. That’s not cool, or legal. You know why they did it, to collect the data before they start rolling out the “Personal Shopping experience.” PayPal isn’t the first company to resort to privacy-invasive marketing tactics, and won’t be the last, either. I mean, take a look at the Privacy Policy (Internet archive link).

PayPal's new privacy policy raises concerns

How to disable data sharing on PayPal

Go to this page: Settings > Data & Privacy > Manage shared info > Personalized shopping. Disable the toggle for the option under Personalized Shopping.

Now, if you don’t find the option, don’t be surprised. As a matter of fact, several users don’t even have the “Managed Shared Info” section, and that’s probably because this change seems to be region specific. PayPal seems to have introduced the feature primarily in the U.S. There is a way to force the option to show up. Sign in to your PayPal account and then visit this page: https://www.paypal.com/myaccount/privacy/settings/recommendations

A few users noted they opted out of interest based marketing under https://www.paypal.com/myaccount/privacy/.

Neither Martin nor I found the setting in our accounts, in Germany and India, respectively. However, the setting may also be available for users in Europe, one person from France said that GDPR did not protect them, because the option was available for their account, and enabled.

I did find an option to opt-out of third-party cookies (Google, Facebook, LinkedIn), under the Manage Cookies section, but these are not related to the controversial data sharing setting that PayPal has introduced. These options are for managing ads that PayPal displays.

Did PayPal notify users about the change?

Some users say that they received an email from PayPal about changes made to the Privacy Statement. In it, PayPal states that “Our updated Privacy Statement outlines how we’ll use info collected about you after November 27, 2024, to inform participating stores about what products, offers, and rewards you might like. You can opt out of this at any time in your profile settings under “Data and Privacy.”

Another user chimed in saying the email also mentioned that users living in California, North Dakota, or Vermont won’t have this setting enabled by default, and that they would need to turn on sharing for a personalized experience.

It is possible that the email could have landed in the spam folder, but I didn’t get one. Again, this is probably due to the region specific roll out.

I’ve said this many times, telemetry options should always be an opt-in feature, and not out.

Summary