What Online Retailers Actually Collect

When you buy something online, you expect to share your name, shipping address, and payment details. But most e-commerce platforms collect significantly more: your browsing behavior within the site, your device fingerprint, your IP address, items you viewed but didn't buy, time spent on product pages, and often your location. This data is used to personalize marketing, shared with third-party ad networks, and sometimes sold.

You can't always avoid sharing data, but you can reduce how much you give away unnecessarily.

Use a Dedicated Payment Method

One of the most effective consumer protections is limiting the exposure of your primary financial accounts:

  • Virtual card numbers: Services like Privacy.com (US) let you create single-use or merchant-locked virtual card numbers. If a retailer is breached, only that card is compromised — not your real account.
  • PayPal or Apple Pay: These act as intermediaries — the retailer sees only a transaction token, not your full card number.
  • Credit cards over debit cards: Credit cards offer better fraud protection and dispute resolution under consumer protection law.

Create Accounts Thoughtfully

Many sites prompt you to create an account for "faster checkout next time." Consider the tradeoffs:

  • Guest checkout is almost always an option — use it for one-off purchases to avoid creating a persistent data profile.
  • If you do create accounts, use a unique password via your password manager and a separate email alias (tools like SimpleLogin or Apple's Hide My Email generate throwaway addresses that forward to you).
  • Avoid "Sign in with Google" or "Sign in with Facebook" — this connects your shopping profile to your social data and grants additional permissions.

Check Privacy Policies Before You Buy (Sort Of)

Realistically, no one reads full privacy policies. But a few quick checks are practical:

  1. Search the site's privacy policy page for the words "sell" and "third party" — these sections tell you if your data is being shared with partners.
  2. Look for a dedicated "Do Not Sell My Information" link (required by CCPA for California-based or California-serving businesses) — click it even if you're not in California; many companies honor it broadly.
  3. Check if the site uses standard security (HTTPS, visible as a padlock in your browser bar) — a basic but important baseline.

Manage Your Browser's Role

Retailers use tracking pixels, cookies, and third-party scripts extensively. A few browser habits make a real difference:

  • Block third-party cookies. Chrome is phasing these out, but you can disable them now in browser settings. Firefox blocks them by default.
  • Use uBlock Origin to block tracking scripts that follow you from site to site after viewing a product.
  • Browse in a private/incognito window for casual browsing to prevent shopping behavior from being stored locally.
  • Clear cookies after major shopping sessions if you prefer not to be retargeted indefinitely.

Be Cautious With Loyalty Programs and Apps

Retail loyalty programs are data collection programs with a discount attached. Understand what you're trading:

  • Store apps often request permissions (location, contacts, notifications) far beyond what's needed for shopping.
  • Loyalty programs link your purchase history across time to a persistent profile tied to your name and email.
  • This data is frequently shared with data brokers and used for targeted advertising beyond that retailer.

If the discounts are meaningful to you, participate — but use an email alias, provide only required fields, and review the app's permissions on your phone.

Spot and Avoid Fake Shops

Not all data risks come from legitimate retailers. Fake online stores harvest payment data directly. Warning signs include:

  • No verifiable physical address or contact information
  • Prices dramatically below market rate
  • Recently registered domain (check via whois lookup tools)
  • No independent reviews — or only five-star reviews with generic text
  • Pressure to pay via wire transfer, cryptocurrency, or gift cards

After the Purchase: Follow Up on Your Data

Your rights don't end at checkout. Under CCPA (California) and similar laws, you can request deletion of your data from a retailer you've shopped with. Look for their privacy policy, find the data deletion or consumer request form, and submit a deletion request — especially for one-time purchases where there's no ongoing relationship needed.