Yesterday I described a complaint this site had received about Etsy.com, an online marketplace that recently (and reportedly retroactively) made seller and buyer information available in a new People Search tool that can be linked to the user’s real name and username. While Etsy.com users can prevent some of the exposure by changing their privacy settings on their account, creating a default and what is said to be a retroactive opt-in for exposing real names and feedback on purchases is not privacy respectful in this site’s opinion. Etsy.com did not respond to an inquiry I had sent them asking to explain or comment on the concerns and allegations that they had not notified users of this significant change. As it was presented to this blog, a user would seemingly have to check the privacy policy or read the forums to find any indication of the change.
This site was apparently not the only one to discuss the concerns being raised by some Etsy members. Mary Landesman of About.com, Jonathan of Eyler-Werve, and Jacqui Cheng of ArsTechnica also covered the privacy concerns. Jacqui raises the question of whether Etsy.com will find itself with Facebook Beacon-like lawsuits down the road with this change in its privacy policy and practices.
Some of the comments in response to the Ars Technica article are particularly interesting. A number of people have noted that Etsy.com displays the TRUSTe seal on its site. A commenter who tried to file a complaint with TRUSTe about Etsy.com said that it returned a message that Etsy.com is not a TRUSTe licensee, although another TRUSTe web page indicates that they are. It seems like TRUSTe is getting some flak by commenters on ArsTechnica and Wyler-Werve who would like them to look into the situation.
For its part, individuals who said they are employed by Etsy.com posted comments under Jacqui’s report. It seems that Jacqui had the same lack of response from Etsy.com using their contact form as I had. In any event, “egoodman85” writes:
Hey, just want to clarify something as an Etsy employee. It’s not your *purchases* that are public – it’s your feedback on those purchases. I know it’s a small distinction, but it’s not like we have some sort of desire to publicize our members’ purchases. Feedback is public by default just like it is on eBay – to increase accountability and transparency. It’s also worth noting that feedback has been public since the site’s launch (in fact, the option to make it private was only added recently). The new People Search feature does not change this at all.
And Rob Kalin writes:
Some clarifications will be helpful.
Feedback has always been public on Etsy, for our entire six years. It’s *only* the feedback system that makes purchases visible. (It’s not like there’s a canonical list of all my purchases somewhere.) So, nothing new here.
Recently, we added a feature for people to use their real names on Etsy. I personally find my experience on Etsy to be more meaningful, now that I can show who I am. Of course some people won’t want to do this, so it’s optional, and can be changed easily on the site.
We fully realized that combining the above two features results in being able to connect a person’s identity with (some of) their purchases, via the feedback system. As such, and in compliance with our TrustE agreement, we emailed all members prior to adding real names.
This statement is misguided:
> Previously, users could search Etsy for seller names, but the names of buyers were not
> exposed as part of the search. Not only are buyers searchable now, they’re even searchable
> by real name if that info is in their account profilesOnce your real name is on Etsy, it’s indexed by Google, Bing, AltaVista, HotBot, Lycos etc. So adding our own people search is not enabling anything that wasn’t possible before — we’re just making it a bit easier to find folks without leaving Etsy.
We do have plans to give buyers on Etsy the ability to hide feedback for certain purchases. We certainly appreciate privacy, and we spend a lot of time on these issues.
[…]
Although it appears that Etsy.com did send out an email a month ago to users about a change, it’s not clear that everyone understood the implications of the change or got the email. Jonathan writes on Eyler-Werve:
The notification that privacy policy was changing was sent a month ago to buyers with a current email address on file. But it did not mention the key problem: that real name and buyer history would be visible to search engines like Google. It is very hard to argue based on that privacy policy change message (which I never got, as one data point) qualifies as informed consent of those outcomes. You can see it in the User forums. Even now, lots of people blunder into the privacy threads with no idea that this stuff can be found on a Google search.
I’m glad they’re making changes. But it’s a little late. Etsy users posted 120 pages of complaints, and nothing. One story on Ars Technica, and the policy changes in an hour. Damage control. Not impressive.
The changes Jonathan refers to were posted last night at http://www.etsy.com/teams/7716/announcements/discuss/6818578/.
And even if Etsy.com did send out a notice of the change by email, if they created a default opt-in consent to transactions retroactively so that they now displayed the user’s real name, that is unacceptable as far as this privacy blogger is concerned.
Whether Etsy.com is sued over any of this remains to be seen. So far, none of the commenters have indicated that they are filing an FTC complaint, but that may be another alternative route for dissatisfied buyers or sellers.
The email I got from Etsy at the start of this year was about how to remove my email from the new lookup system on the site. It also requested that I link my email contacts to Etsy so they would be added into the mix as well. I suppose that was People Find part one. The email explained how to opt out of the feature and edit our personal profiles if we chose.
I did NOT get an email on any of my three accounts regarding my real name or shop names being added to Google search in this capacity. Nor did I get an email concerning my buying or browsing activities being available on Google. Not one. Period.
And this little fact was NOT mentioned in the announcements that the staff members made selling the People Search feature which was just rolled out.
I can’t call them liars, but it’s very odd that no one is coming forward saying they got an email addressing these issues. Everyone got an email regarding the rollout of the email address book linkups. I opted out, refused to fork over my contacts, and hadn’t put my name in my profiles from the start.
It’s downright slimey for the people at Etsy to say that this is our own fault and that nothing has changed; buyer/seller/feedback has always been public on the site. This was NOT available to the masses via Google.
The people who run Etsy are stinking sacks and cowards who to stupid things without regard for how it impacts the site’s users, and then run and hide when the poo hits the fan.