Etsy users irked after buyers, purchases exposed to the world

Etsy—a site where crafters and artists sell their goods—has found itself at the center of a new privacy debacle after it opted everyone into a new system that exposes users' real names and purchase histories. Better yet: the user base hasn't even been notified.

<a href='http://meincmagazine.com/web/news/2011/03/etsy-users-irked-after-buyers-purchases-exposed-to-the-world.ars'>Read the whole story</a>

 

[Anita Man]

Etsy are tools. First they don't police their site for chinese "handmade" junk and now this. Boo for being grubby greedy bastards.

 

[btmlltt]

Fack! Privacy settings updated.

 

[C Boy]

I think this might just work if Etsy combines user histories with Match.com or eHarmoney.

 

[apoptygma]

I hope they get screwed over for this... it's unacceptable in every way.

 

[potato44819]

Fack! Privacy settings updated.

++

Ty Ars for the coverage on this.

 

[SirOmega]

Thanks Ars for the heads up! Etsy settings changed.

 

[The_Mighty_Squid]

I find Etsy news amusing since they are headquartered in the same building I work in. Seem like nice enough folk. Maybe I won't hold the elevator for them for a few days after reading this even though I don't use Etsy. That'll teach em!

 

[metrometro]

Thanks to Ars for picking up my tip.

Related story here, with some screenshots:
http://www.eylerwerve.com/2011/etsy-com ... of-buyers/

 

[eJacqui]

I find Etsy news amusing since they are headquartered in the same building I work in. Seem like nice enough folk. Maybe I won't hold the elevator for them for a few days after reading this even though I don't use Etsy. That'll teach em!

You should pop down and tell them to respond to my requests for comment.

 

[Xavin]

It amazes me what these companies think they will be able to get away with. Do they have nobody working there that could tell them what a terrible idea this was? I wish companies would hire me just to tell them when they are about to step into an internet hornets nest.

 

[Ars of Ares]

Yikes.

 

[DNick]

Holy crap - I guess it's time to start reading those annoying privacy policies, and to stop thinking the TRUSTe logo gives you any protection.

Here's one of the good parts: Your username, Etsy ID or alias is displayed throughout Etsy (and so available to the public) and is connected to all of your Etsy activity. Other people can see your purchases, items for sale, store, feedback, ratings and associated comments. You have the option to publicly display your full name.

http://www.etsy.com/policy/privacy

 

[eJacqui]

Holy crap - I guess it's time to start reading those annoying privacy policies, and to stop thinking the TRUSTe logo gives you any protection.

Here's one of the good parts: Your username, Etsy ID or alias is displayed throughout Etsy (and so available to the public) and is connected to all of your Etsy activity. Other people can see your purchases, items for sale, store, feedback, ratings and associated comments. You have the option to publicly display your full name.

http://www.etsy.com/policy/privacy

Yeah, this is one of the new changes to the policy that existing users weren't notified about.

 

[metrometro]

How this could be in compliance with ANY independent privacy guidelines, I don't know. This is exactly what that little TRUSTe logo is supposed to prevent. I pinged the TRUSTe press office with some basic questions -- Did you review the current policy, as Etsy implies? -- but they haven't replied. I'll share out if they do.

 

[clm100]

Aaaaaaand account closed. Fuck you Etsy, unacceptable.

 

[Artema]

Favorited is not a word.

 

[Artema]

"Without limiting the above, in an effort to respect your privacy and Etsy's ability to keep the community free from bad actors, Etsy will not otherwise disclose your personal information to law enforcement, other government officials, or other third parties without a subpoena, court order, legal process, or substantially similar legal procedure, except when Etsy believes in good faith that the disclosure of information is necessary to protect Etsy's rights, prevent imminent physical harm or financial loss, or to report suspected illegal activity."

From the privacy policy.

 

[EtsySeller]

The privacy breach is actually even bigger than described above.

A few weeks ago, etsy released a Friend Finder feature. It allows anyone with a gmail, yahoo or aol account to allow etsy to search their entire address book to "find friends" that registered on etsy using an email address you have access to. Therefore, even if someone you hardly know registered on etsy without providing their real name or a recognizable user name---you can still connect them to the email address they used during sign-up.

To make the scheme even more unethical, etsy did send out an email telling users they were changing the site privacy policy, but nowhere in the email did they say WHEN the feature was going live. Nor did they give directions on exactly how to opt-out.

That's right---you have to OPT-OUT of all these features. Otherwise, etsy automatically makes each username, email address and real name searchable by default.

 

[egoodman85]

Hey, just want to clarify something as an Etsy employee. It's not your *purchases* that are public - it's your feedback on those purchases. I know it's a small distinction, but it's not like we have some sort of desire to publicize our members' purchases. Feedback is public by default just like it is on eBay - to increase accountability and transparency. It's also worth noting that feedback has been public since the site's launch (in fact, the option to make it private was only added recently). The new People Search feature does not change this at all.

 

[frodough]

sounds like the programmer just coded the search function and made it live without testing. who in their right mind would give user the option to set their purchase history public much less defaulting it to 'everyone' to begin with. this is 9000 accounts of fail.

 

[pavon]

How this could be in compliance with ANY independent privacy guidelines, I don't know. This is exactly what that little TRUSTe logo is supposed to prevent. I pinged the TRUSTe press office with some basic questions -- Did you review the current policy, as Etsy implies? -- but they haven't replied. I'll share out if they do.

Yeah, I just filed a complaint with TRUSTe. If they don't yank their endorsement from Etsy after this, I will consider their seal to be worthless.

 

[peragrin]

It amazes me what these companies think they will be able to get away with. Do they have nobody working there that could tell them what a terrible idea this was? I wish companies would hire me just to tell them when they are about to step into an internet hornets nest.

Common sense isn't really common, and for most it doesn't make any sense either.

 

[Killing Time]

How this could be in compliance with ANY independent privacy guidelines, I don't know. This is exactly what that little TRUSTe logo is supposed to prevent. I pinged the TRUSTe press office with some basic questions -- Did you review the current policy, as Etsy implies? -- but they haven't replied. I'll share out if they do.

Yeah, I just filed a complaint with TRUSTe. If they don't yank their endorsement from Etsy after this, I will consider their seal to be worthless.

it already is, i have absolutely no idea why people think that seal matters.

 

[EtsySeller]

egoodman85, thanks for the clarification, but it still doesn't excuse etsy's broad range of disregard for its users' privacy. Etsy corporation has taken "transparency" to a new low.

An ambiguous username which can be tied to an email account that leads directly to feedback is still unethical.

And since you mentioned "accountability" --- why isn't etsy answering any of the questions or concerns about any of this? Rampant closing of threads, muting sellers and refusing to acknowledge the overwhelming anger over these features isn't helping the company's public image.
Do all of you getting paychecks from etsy honestly think this is ethical?

 

[Artema]

TRUSTe is now reporting:

"The URL http://www.etsy.com/ does not belong to a TRUSTe licensee."

 

[pavon]

TRUSTe is now reporting:

"The URL http://www.etsy.com/ does not belong to a TRUSTe licensee."

Where did you see that? This says otherwise.

 

[doho7744]

You know if I wanted everyone to know about me increasing my collection of homemade phallic devices thru purchases via Etsy I would have posted it on facebook/twitter and whatever else these kookie kids are using to self promote.

 

[Artema]

TRUSTe is now reporting:

"The URL http://www.etsy.com/ does not belong to a TRUSTe licensee."

Where did you see that? This says otherwise.

On the previous post is a link to file a complaint. I entered the URL and got that.

 

[NortonII]

Ironically I just had to disable Facebook integration on Arstechnica since I hadn't noticed that was auto enabled till just now.. Opt in is easy to do I guess.

 

[eJacqui]

Hey, just want to clarify something as an Etsy employee. It's not your *purchases* that are public - it's your feedback on those purchases. I know it's a small distinction, but it's not like we have some sort of desire to publicize our members' purchases.

I've added some clarification to the story. By the way, it's difficult to find a press contact on Etsy, and no one has responded to the inquiry I made through the site earlier.

 

[baealiel]

Note in response to the comment from the Etsy employee. I just went and took a look and it's not just _your_ feedback that they can see when they search for you, it's all feedback on the purchase. Meaning that if the seller(s) leaves feedback for you, then anyone can see your purchase(s).

 

[metrometro]

The real question here isn't when are they going to undo this, but when's are they filing for an IPO? Oh, wait, they already did. Social networks are valued by the markets by counting the user base and multiplying by a number between 1 and 100 depending on the strength of the revenue model, and the hysteria in investors. Social networks are bubbling, ecommerce sites are not. Hence the switch to "social commerce" whatever that is.

So they can have a community of let's say they have 1000 sellers. Or they can have 50,000 sellers+buyers. The difference in eventual market cap is 50x when the IPO rolls around. This is a classic pump-and-dump move with the "social network" member numbers in anticipation of the planned 2011 IPO.

IPO annoucement: http://www.thealarmclock.com/mt/archive ... ipste.html

So, just to be clear on the moral issues here: Not an accident. THEY DID IT FOR THE MONEY.

 

[thefearlessone]

Thanks for the heads up, just removed my name from my Etsy account and requested that it be closed. Most of the seller's I follow have an account on artfire, I don't have time for facebook style privacy games from an e-commerce site.

 

[Rob Kalin]

Some clarifications will be helpful.

Feedback has always been public on Etsy, for our entire six years. It's *only* the feedback system that makes purchases visible. (It's not like there's a canonical list of all my purchases somewhere.) So, nothing new here.

Recently, we added a feature for people to use their real names on Etsy. I personally find my experience on Etsy to be more meaningful, now that I can show who I am. Of course some people won't want to do this, so it's optional, and can be changed easily on the site.

We fully realized that combining the above two features results in being able to connect a person's identity with (some of) their purchases, via the feedback system. As such, and in compliance with our TrustE agreement, we emailed all members prior to adding real names.

This statement is misguided:

> Previously, users could search Etsy for seller names, but the names of buyers were not
> exposed as part of the search. Not only are buyers searchable now, they're even searchable
> by real name if that info is in their account profiles

Once your real name is on Etsy, it's indexed by Google, Bing, AltaVista, HotBot, Lycos etc. So adding our own people search is not enabling anything that wasn't possible before -- we're just making it a bit easier to find folks without leaving Etsy.

We do have plans to give buyers on Etsy the ability to hide feedback for certain purchases. We certainly appreciate privacy, and we spend a lot of time on these issues.

I'm happy to address any other concerns, feel free to email me. It's just my first name (as signed below) at etsy dot com.

- Rob

 

[thefearlessone]

@Rob - I'm glad to hear you're considering working on your members' privacy concerns at some point in the future.

I will not be waiting around to find out when that is.

 

[WoodeGA]

Yo, Rob at Etsy.

I can look up some lady's adult purchases (there's a link in your discussion forums). She probably doesn't know. You really, really think this is ok? For real? I mean, you're totally serious?

Okay, I used to think Etsy was pretty awesome, except for the non-handmade used crap that folks sell on there. But not any more. You wil NEVER have me as a customer, and I linked this article on FB for my friends to see.

Utter fail, Etsy.

 

[metrometro]

It's not like there's a canonical list of all my purchases somewhere.- Rob

Yes, there is. It's the seller feedback. Sellers always give feedback in the hopes that you reciprocate. When you make that list and include a link to the item description, that is the list of all your purchases. Here's yours:

Vintage Industrial Cooper's Table
Gull-Wing Bench with drawer
Make My Wishes Come True - Clipboard
Uncomplicated - a simple modern box clock
Unfurled with Green Interior

I can go on but your purchases are boring. Sex shops, less so. Gay bookstores? Hmm. Drug items? Getting more damaging...

Simple fix: hide the items. Keep the feedback. Also, quite defending something indefensible. You exposed my purchases without knowledge or consent.

 

[xoa]

Feedback has always been public on Etsy, for our entire six years. It's *only* the feedback system that makes purchases visible. (It's not like there's a canonical list of all my purchases somewhere.) So, nothing new here.

Recently, we added a feature for people to use their real names on Etsy. I personally find my experience on Etsy to be more meaningful, now that I can show who I am. Of course some people won't want to do this, so it's optional, and can be changed easily on the site.

"Optional" and "opt-in" are not the same things Rob. What you have done is created a situation, per what baealiel pointed out, where a user in the past could have made a private purchase and since then taken no action whatsoever (including ceasing to use the site), and yet now their real name and purchase is widely and trivially available. This certainly won't bite everyone, but as a someone who's worked at some eCommerce companies I feel safe in saying that ever creating such a situation even for a fraction of your user base is extremely foolish. "Opt-out" policies are nitroglycerine, you are making a dangerous choice anytime you have anything to do with them, and at this point in the Web there is simply no excuse not to know it.

If people honestly found the new choices useful as you say you do, and you explained it to them clearly, then they'll choose to opt-in. You can reasonably have it be a default for new users as well, although again, better have clear and careful explanation as the default expectation in general is that one's purchases are secret unless a specific choice is made otherwise. But if you set up a situation of "don't use that email much anymore (or at all)? Don't leave anything but a seller does? Your dildo purchases are now on Google!" is just begging for an Internet publicity storm. If it even remotely catches you by surprise then holy crap.

 

[godel]

I notice that Etsy still has a full green signal on Web of Trust (WOT), including the privacy rating.

That's got to change! If you have a WOT account it's time to log on and make your thoughts known.