Heh, if you think that's bad... there's a certain popular "#1 Money Saving Hack", coupon-clipping browser extension (wink wink) that sees everything you buy on practically every major e-commerce site even when you didn't use one of their coupon codes.

And then said browser extension, which promised to never ever sell your data to a third party, got bought out by PayPal for 4 billion USD.

Really makes you think.

> And then said browser extension, which promised to never ever sell your data to a third party, got bought out by PayPal for 4 billion USD.

I guess selling the whole company owning the data isn't technically selling data to third parties...

Check out any privacy policy that says they will never share or sell your data; the two boilerplate exceptions are law enforcement and transfering ownership of the parent entity. Two pretty big loopholes.

Uhh those seem like two really small loopholes. Buying the whole company makes sense. What is the alternative, the purchasing company has to accept that they'll purge all user accounts?

Law enforcement.. What do you want them to do? Turn down a legal court order and say "naaa"?

> Uhh those seem like two really small loopholes. Buying the whole company makes sense. What is the alternative, the purchasing company has to accept that they'll purge all user accounts?

Why not? The alternative is to allow a business model, in which you start a company with the sole purpose of vacuuming up data and delivering it to highest bidder by getting acquired.

> What is the alternative, the purchasing company has to accept that they'll purge all user accounts?

Have a transition window (say 3 months) before the sale goes into effect where users get to choose to either keep the account and allow the new owner access to the data, or to have their data destroyed. After that window, data from anyone who didn't respond gets deleted.

> Law enforcement.. What do you want them to do?

Go to jail or shutdown the site, like the Lavabit guy.

This led me to look up Honey's own privacy policy and I do not see such a disclaimer regarding change of ownership, in fact it specifically references what they can share with PayPal. [0]

>We know how important your personal data is to you, so we will never sell it. We'll only share it with your consent or in ways you'd expect (as we explain here). That means we will share your data if needed to complete your purchase, with businesses who help us operate Honey, or if we are legally required to do so.

>We may also share information in the following cases:...with our parent company, PayPal, Inc. and affiliates and subsidiaries it controls, but only for purposes allowed by this Privacy Policy;

So that sounds like commercial use of personal data is specifically protected with regards to the new parent. The policy does specify they can share your data in an "aggregate or anonymized format" without any caveats, though.

Sure does still raise the question of what PayPal spent $4bn on. From what I can read online, online retailers see a lot of benefit from the way Honey incentivizes users to complete a purchase instead of abandon the cart.

[0]https://www.joinhoney.com/privacy

That is the privacy policy that users agree to if they joined post acquisition (probably because Paypal doesn't expect to sell it at this time), which is different than the policy that users agreed to when they joined pre-acquisition. They may have been forced to accept the new policy post acquisition anyway.

I think the weasel is this nibble here:

> but only for purposes allowed by this Privacy Policy;

The privacy policy is between the user and Honey, not the user and PayPal, which implies they are still legally separate entities ("parent company"). Unless Honey has an agreement with Paypal that it can audit and enforce - which as a subsidiary, why would it want to - then once PayPal has the data, its actual use of it is governed by the privacy policy between the user and PayPal if there is an existing relationship or ???

It sounds like all Honey and Paypal need to do is find a half plausible justification from the PP for the data transfer; once it's handed over, Paypal is basically free to do whatever it wants.

I think seeing all the random items is collateral damage. It can possibly be fixed (only show purchases in the category that you referred?).

As the affiliate, the insights are invaluable. Imagine you hosted a sleep blog and directed people to a particular memory foam pillow. If you saw they ended up purchasing a different pillow, you could change the link to better serve your readers.

Or if you saw that they ended up purchasing essential oils, perhaps you’d want to write a post about using oil diffusers to fall asleep.

The affiliate link tracking is supposed to give you a better picture of your audience. Usually it works, but getting 50M views from every source on the internet is obviously a case where there’s no common “audience”.

No one doubts that it's useful for the people standing to make money off of this. I think the question was whether it was an invasion of the reader's privacy, who probably don't realize that the blog owner can now track their buying habits.

Only in the aggregate. The site owner doesn't know who purchased what. Only Amazon (obviously) knows.

The site owner only sees that 35 people bought book X while 24 people bought book Y.

Anonymous data can easily become identifiable when it's small enough, as GP was saying.

If someone runs a tiny blog that they attempt to monetize with affiliate links, and one of their only readers at the moment is their mother, I don't think they'd be happy seeing that one of their readers purchased a sex toy.

This is exactly the right approach. Anything specific enough can be traced back to an individual.

Why not ask people for this kind of stuff in an honest[1] way? If that doesn't work well because people rarely want to share that information, collecting without asking doesn't seem right.

[1] By "honest", I mean like a pop-up with a question or two and a clear "Not now" button. Not another cookie banners or passive collection.

> * Imagine you hosted a sleep blog and directed people to a particular memory foam pillow. If you saw they ended up purchasing a different pillow, you could change the link to better serve your readers.*

If I buy a memory foam pillow from company B instead of company A then I don't want company A to know at all. If I wanted company A to know then I would tell company A why I didn't purchase its product.

Maybe it was that I didn't see company A's product. Or maybe it's because company A is a piece of garbage. Maybe it's because company A employs deceptive practices and I don't want to give company A my money.

In that example company A isn’t the one who sees it or gets money. It’s the third party sleep blog who you just clicked a link on for “top 5 memory foam pillows”. Now they see which one people buy most and can give that the favorable rating

Shouldn't the blog be giving the favorable rating to the pillow they think is the best, not the one that's most likely to sell through?

And then what does that say about the written article? It's just metrics driven for what is the "best". It's truly a terrible system that's taken place over the last 20 years or so.

I think it's simply because you do forward someone on a website.

Also, imagine it's not Amazon but a much smaller website. Just bringing a client (someone who actually paid) is already a good deal.

So, I believe it's a totally fair commission rule.

I made it very clear that I have no problem with the commission paid:

> To be clear, I have no problem with affiliates getting commission on random stuff.

The problem is disclosing random purchases. You can pay a commission without that disclosure.

Ah damn. I somehow misread your initial message. My bad.

I run sites using Amazon's Associates affiliate program. I also track all outbound clicks from me site.

Luckily, Amazon scrubs any identifying info from their affiliate reports. So say I post an affiliate link to a book and then look in Google Analytics to see 50 readers clicked the link. The next day, I can log into Amazon's report and see I had 50 clicks and 30 sales of the book along with an addition sale of 40 toys, 10 movies, and 3 dildos.

However, I can't actually see which of my 50 readers bought what, if anything. Those 3 dildo purchases are completely anonymized, along with everything else. However, being told I also sold 40 toys really helps me because it lets me know I should probably start writing more about toys since that's what my readers are buying.

I'm also limited to 200 unique Amazon "tags", so I can't assign a unique tag to each of my readers to track them individually.

You can't match up the product with an actual user or person in any way.

Create a web page of various recommendations, send it to a specific friend whose household regularly makes purchases on Amazon. Unsuspecting friend clicks on affiliate link, now you know all things they buy in the next 24 hours.

Works anywhere else where the audience can be identified, and click frequency is low.

Oh, no definitely not. Nope. There's no way that a company can see that you've purchased Some Things within the past 24 hours and definitely can't correlate those purchases with receipts. Nope that's not a thing. Definitely not. No way at all. Especially since companies aren't owned by parent companies. That would totally be impossible.

/s

Correct. As the affiliate blog you see nothing involving receipts or personal info for purchasers. It’s just a jumble of all your referral purchases

Unrelated but on Amazon is it possible to get order details if you have an order ID? You used to be able to scrape email for details but now you just get the ID itself.