Do PayPal's hidden addresses violate GDPR and United States state laws?

[2Flow2]

Hey there!

So PayPal seems to silently keep any address you use to ship a product to when you make a purchase online with a merchant through a PayPal checkout. Apparently, these "hidden addresses" are well-documented online and when I called PayPal's customer support today to remove my own "hidden addresses", they seemed well acquainted with these (I appeared to be far from the first person to call about them) and they erased them from my account upon my request.

The whole concept of these hidden addresses seem to be violation of privacy laws. Specifically, you cannot:

- View the addresses for yourself via your PayPal account. (They only appear when making a new purchase on a merchant's site that goes through PayPal to complete the purchase.)

- Remove the addresses yourself. (The only way to remove them is to call customer support via the phone. I was not able to successfully remove them via their online chat representatives.)

- Opt-out of having your addresses saved in the future. There is no way to indicate to them you would like them to stop saving your "hidden addresses".

I'm not raging mad, but I am annoyed that I have no control over my data that PayPal is secretly saving (without my consent, as far as I can tell from the User Agreement). I'm thinking of taking legal action, so I'm wondering if anyone else thinks these wouldn't be violating specific privacy laws like GDPR, California's CCPA, etc.?

Thanks! If they add functionality to allow users to opt-out of having their hidden addresses saved and give users the ability to delete past addresses themselves, this won't be an issue. 👍 But PayPal hasn't yet seemed to show any indication of intending to do this. (Maybe someone like @PayPal_Jae knows something I don't.)

Thanks, everyone!

[PayPal_Olivia]

Hi @2Flow2 

Thank you for your post, and welcome back to the Community Forum!

I understand your caution as relates to the way in which mailing addresses are retained. I would recommend that you review the PayPal Privacy Statement, found by clicking Legal at the bottom of the PayPal page. Within the Privacy Statement document are details about how we collect and store information, and the ways in which that information can be deleted, and under what circumstances. There are also instructions for reporting any issues regarding privacy, and ways to exercise your privacy rights.

I hope this information is helpful to you!

Olivia

[2Flow2]

Hi @PayPal_Olivia ! I appreciate your response! I read through the PayPal Privacy Statement as you suggested. I agree that it was very helpful!

Concerning the silent saving of addresses with no easy way to delete them, and no way whatsoever to opt-out of that collection, I wonder about the section in the PayPal Privacy Statement that says the following:

Choose how we collect Personal Information

You may choose to limit the Personal Information you provide when our apps or Services request it. To help make choices that are right for you, it’s important to understand that Personal Information helps us provide a richer, more personalized experience for you. Also, some Personal Information is required for our Services to function at all.

For example, sharing your contacts helps make it easier for you to find the people you want to send money to. If you choose not to share your contacts with us, you can still use our mobile apps, but some actions may not be as fast or easy as it would be if shared your contacts.

It does not feel that I am being allowed to "choose to limit the Personal Information [I] provide when [your] apps or Services request it" because I am unable to tell PayPal that "no, I do not want to save any of my past addresses that don't appear in my account." These particular pieces of information (that is, the "hidden" addresses) are also not "required for [your] Services to function at all" as mentioned in the Privacy Statement.

@PayPal_Olivia am I correct in assuming changing these features (such as giving users the option to opt-out from having "hidden" addresses saved, or giving users the manual option to delete these themselves) are not currently planned to be investigated or implemented by the Product team at PayPal in the near term future? I just want to confirm because I would hate to make this fuss and then have it be over something the company is already addressing.

Thank you, I look forward to your reply!