48

Please know that I'm genuinely asking because I don't understand.

So a user posted a question titled Please don't share my e-mail with Amazon without my express consent. I don't understand what is wrong with Stack Overflow giving away those email addresses.

I consider one's email address to be like a home address. It certainly can be used to identify you, but it's not a secret (if it were, then it would be anonymized/asterisked out like your password whenever you typed it in). So if I wanted to send a bunch of greeting cards, and Hallmark said I can just upload the home addresses of the people I want to send the cards to, I would do exactly that. Would I be violating those people's privacy?

I guess it boils down to two things that I don't understand:

  1. Stack Overflow didn't tell Amazon who owned the email address (AFAIK), so how does giving an email to them affect your privacy. I can see how it would be annoying because now Amazon knows the email is probably active so they might try to send you marketing stuff, but anyone can send spam to any email these days, and Amazon's Unsubscribe button isn't broken (again, AFAIK).
  2. Your email isn't especially private. I can easily see how disclosing your password, or SSN, or some other information that is meant to be secret is a privacy violation, but I don't understand why email would fall under this.
24
  • 33
    #1 is a big issue for a lot of people. Think of it like using someone else's computer. It may not be that big of a deal for you, but a lot of people don't like their stuff being used without permission. They gave SO permission to use their email, and then SO "gave" Amazon permission by proxy, which the users didn't approve. Commented Feb 7, 2019 at 23:00
  • 59
    Because what they did is against the law. Commented Feb 7, 2019 at 23:00
  • 70
    @HereticMonkey: It's against the GDPR, which Stack Overflow is beholden to. That's a finer line than "against the law" since the United States has no such requirement.
    – Makoto
    Commented Feb 7, 2019 at 23:02
  • 5
    @Makoto They are skating a very fine line with US laws regarding PII. True they may have not violated the letter of the law, but it's pretty darn close (of course IANAL). Commented Feb 7, 2019 at 23:11
  • 13
    IANAL - AFAIK, providing an email address to a third party is not directly a violation of any US law. If said third party abuses this data (e.g adds you to a mailing list against your consent), then that makes the third party liable for potentially violating the CAN-SPAM act.
    – Makoto
    Commented Feb 7, 2019 at 23:20
  • 4
    So, say I am someone who despises Jeff Bezos to the point of me NEVER wanting my email to be disclosed to him. Do you not see a problem with me going to stack 'here is my email', and then turning and giving that same email to someone else? An email address is considered PII (personally identifiable information). ANY business you deal with should be greatly aware of whatever PII they have, and make 100% sure this isn't leaked. Had SO asked the people 'hey we need, to move this faster, to share emails with Amazon', I am sure a lot of people would have backed out.
    – Patrice
    Commented Feb 8, 2019 at 0:16
  • 10
    All these people now feel that the trust they put in SO was violated by carelessness, for an easier process (they just wanted to have an easier time sending out the gift cards after all). I have a problem with a corporation doing something like leaking PII for an easier time sending cards. PII should be valued more than that
    – Patrice
    Commented Feb 8, 2019 at 0:17
  • 69
    "So if I wanted to send a bunch of greeting cards, and Hallmark said I can just upload the home addresses of the people I want to send the cards to, I would do exactly that. Would I be violating those people's privacy?" Yes, unquestionably so. Those people gave you their address. Unless they explicitly told you it was okay for you to pass their address on to other parties, then you are expected to keep that information to yourself. If I tell you my wife is pregnant, and you go tell the entire office, then I have every right to be upset. Same logic. Personal information is personal.
    – Cody Gray Mod
    Commented Feb 8, 2019 at 1:18
  • 14
    @Greg even without the name linked to it. 'I never wanted to be on Amazon's mailing lists' should be respected. If I give my email to SO, Knowing from SO's privacy policy they won't share it with third parties. But they did it anyway. You genuinely don't see the concern about an organization not respecting their own privacy guidelines?
    – Patrice
    Commented Feb 8, 2019 at 2:12
  • 5
    @Patrice For example, in the comments, someone said that SO doing this is "...a serious data/privacy breach that could cost millions of dollars". That seems a little exaggerated. Commented Feb 8, 2019 at 2:19
  • 11
    @Greg considering my email is my main 'identity' online, and linked to many many services, I prefer to be the one dictating who has it. You can not care about who has your personal data. But I think that in our current climate (with what's happening about FB, Google leaking all the info they can, GDPR, etc), I would assume anyone in the IT industry is more than aware how serious these kind of things can be taken. Practicality or not irrelevant.
    – Patrice
    Commented Feb 8, 2019 at 2:23
  • 7
    Stack doesn't seem to have enough checks and balances to prevent emails from being leaked this way. Do you feel like subscribing to SO jobs now and putting your CV on it? Can you trust their privacy policy? Trust is everything for an organization that REQUIRES people to give them their PII to work with them. People threatening lawsuits, maybe that's exaggerated (although you never know... People have sued for sillier stuff I'm sure). But that is a serious mistake, with definite implications, and shouldn't be taken lightly.
    – Patrice
    Commented Feb 8, 2019 at 2:24
  • 34
    @Greg I suggest familiarizing yourself with GDPR. In particular the section titled "What constitutes personal data?": "any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier. ... including name, identification number, location data or online identifier...". An email address is an online identifier. Your home address is location data.
    – user4639281
    Commented Feb 8, 2019 at 2:37
  • 13
    @Michael Email addresses are not "public information", and there are privacy laws on the books in many countries that protect you from the kind of harassment you are telling people to get over (including, in part, the US)..
    – TylerH
    Commented Feb 8, 2019 at 16:12
  • 23
    For the record: I did not intend for this to happen the way it did when asking that question. My intention behind the question is that I was disappointed that my e-mail got shared without my consent, and that I would like them to ask before they do so in the future. I think the response from both Tim and Anita was excellent. I certainly don't stand behind any comment talking about lawsuits, firings, stuff like that, and will certainly feel guilty if stuff like that happens (it probably won't), but unfortunately the discussion is out of my hands.
    – Erik A
    Commented Feb 8, 2019 at 17:47

6 Answers 6

35

Anita Taylor gave a pretty detailed response about what happened, while she was busy working backwards to put guard rails in place for instances where we might consider extrinsic incentives again. And we should be able to offer those incentives, because they're fun, and responsible people can have nice things.

When you respond like Anita did (and I have done this a gazillion times), you have to come out and say the awfulness, my gosh, I'm sorry for all of it and start working backwards as soon as you realize you have a cascading mistake.

And when you do that, you'll inadvertently appear to have glossed over what's really important to a group of upset people who are struggling to tell you stuff. Anita understood what was wrong, she said it here:

We are reviewing our policies and will be training the product managers, marketing staff and researchers who typically provide compensation to users on how to avoid issues like this in the future.

She is a being of energy and operates on multiple planes at once. She was already fixing the crux of what was making everyone so mad, it just didn't come out enough. If she had just shared the notes she wrote internally, it would have been a totally different story.

We screwed up the most in setting expectations.

Why? Because we didn't really know how fulfillment was going to work. That didn't call a screeching halt to things because we have a clear business case for offering the cards, provisions in our privacy policy for sharing information for strictly fulfillment purposes, and the third-party had an agreeable set of terms on their side, so it fit. Okay, great, from the user's view this won't be an inconvenience, let's make sure that goes out soon. Are you starting to see how it happened, now, and how it took a minute for us to realize what was getting everyone upset?

But all of that above doesn't mean squat to someone that gave you their information and expected you to email them some digits, or possibly follow up to ask for shipping info to send a physical card. We needed to tell people that things changed and give them the option again, because that's what they expected we'd do. And at the end of the day, that's the only reason that we really care about, because the whole thing was an effort to build goodwill. But it got out of hand because we couldn't slam on the brakes and communicate introspectively fast enough.

When good-faith comes into question, things get dreary.

A simple "Hey, we can't manually fulfill these gift card things, can we give your details to Amazon or do you want a shirt or something instead?" is what people wanted from us in this situation. And that's what they'll get from us in the future. What we thought they wanted was not another email from us about it after helping us so much.

When what they got wasn't that, questioning everything started looking like a good idea to some, and maybe rightfully so given the precedent that some big companies set with how they treat user data. By the time we started getting the right message out, everyone was shouting and we went right into the weeds.

So, what do we do?

Not do what we did. I'm serious.

It seems like it should have been such an easy mistake to have averted and the good news is, it is easy to avert, because now we know. Also, washing a spoon cup-side-up under any significant water pressure is also a bad idea (even if that grime comes off!), you find these things out along the way.

It was a big deal because we weren't clear enough what the 'that' in we'll never do that again actually meant.

And we're sorry about that.

9
  • 12
    I totally get the apology part - and I don't think anyone here hasn't accepted that this was a Big Oops moment on your part, and that you're taking steps to correct it - but I don't think that's the point of this question. The OP wanted to know why this was such a big deal in general.
    – Makoto
    Commented Feb 11, 2019 at 19:59
  • 3
    @Makoto I considered that, but while this ends in an apology, it contains a pretty honest narrative of how and why this got to be what the OP calls a big deal. I don't feel it's a stretch to say this answers the question, it actually answers a few, but this felt like the best place to say all of it. I'll look at it more to see it how you do, though.
    – user50049
    Commented Feb 11, 2019 at 20:14
  • 4
    @Makoto The answer to that question in general is rooted in psychology and I think Tim nailed it quite tactfully (it is also one of the reasons politics are so divisive these days): people leave the facts at the door and assume bad faith... and before you know it becomes us vs them with a chasm of false beliefs a mile wide between them. How do you reliably prevent that from happening is a question I have yet to be able to answer, and if you figured that out you'd, and I honestly don't think I'm overstating this, probably deserve a Nobel Prize... Commented Feb 12, 2019 at 1:31
  • 3
    This answer leaves me with the impression that you (as a company) still misunderstand the severity of the situation. As mentioned already elsewhere, this is a GDPR data breach that must be reported. With Erik.A bringing it to your attention, the Dutch GDPR authority would be the relevant authority to contact. At this point, you should understand you have a legal issue at hand, which means: STOP. Contact a knowledgeable lawyer NOW. I might write some Law.SE answers, but when things go this wrong I will stop giving detailed advice. This is time to get professional help.
    – MSalters
    Commented Feb 12, 2019 at 13:49
  • 3
    @MSalters: Um...calm down? It isn't like they don't know what you're telling them. Tim went out on a limb to post this and while I respect the tenseness of the situation, that comment doesn't really help anything or anyone. Let cooler heads prevail.
    – Makoto
    Commented Feb 12, 2019 at 16:39
  • 5
    @MSalters I find your comment interesting: "I'm not qualified to answer this question but you're definitely in violation." I'm not sure how to reconcile those two parts of your comment. Commented Feb 12, 2019 at 18:49
  • 2
    @TemporalWolf: Knowing that you are in problems is way easier than pleading your way out. It's like skiing - I can tell when somebody has fallen over. Doesn't mean I can tell what he should have done to avoid that.
    – MSalters
    Commented Feb 12, 2019 at 20:35
  • 5
    I don't understand why this answer isn't on the original question along with that of Anita. Commented Feb 19, 2019 at 9:57
  • 1
    This would have made a great stand alone post. Thank you for this Tim, it's very mcuh appreciated. Commented Feb 19, 2019 at 15:21
101

You seem to greatly misunderstand how powerful and influential an email address is these days.

An email address is a relatively unique identifier which allows online users to tie every facet of their activity together in one place. Email is how you reach people for everything, realistically, and given how pervasive spam email is even today, not everyone wants their address made public.

Worse yet, knowing someone else's email address gives malicious actors an area of attack. The website Have I been Pwned? catalogs attacks based (typically) on an email address, and in reality, that's all you need to determine if a user is using a vulnerable or already compromised service. Presto; you've managed to find more about this person than they wanted to share.

Lastly, there are people out there who just don't want to be added to the marketing email campaigns out there. No one should have to endure emails they don't want, especially from a site who promises to force third parties to adhere to the same standards as they do.

So yeah, it's a big deal. Stack Overflow is one of the only sites I can really trust with my personal information, for what information I provide them. If they violate that trust, they may never get it back.

14
  • 4
    "given how pervasive spam email is even today" Um, what? Spam is more pervasive now than it ever was, if only because email itself is more popular, so there are (1) larger volumes of emails being sent and (2) more people who can be reached, thus making it more lucrative. Not to mention the fact that spam distribution technology has improved. I guess you would argue that anti-spam technology has improved, but Red Queen Hypothesis.
    – Cody Gray Mod
    Commented Feb 8, 2019 at 1:20
  • 3
    @CodyGray The argument you just presented is exactly why it seems like a silly thing, in my opinion, to get worked up over. The worst Amazon could do is send me spam, but they could've done that otherwise, and I can unsubscribe or add them to my spam filter. Commented Feb 8, 2019 at 2:02
  • 6
    @CodyGray I think Makoto was implying that we should have solved the spam issue by now, at least in part, instead of it just getting worse. Commented Feb 8, 2019 at 2:33
  • 7
    @TheWanderer Look up the Red Queen Hypothesis. As you build a better spam filter, the spammers build better and more creative ways of getting around it. In other words, it's a continual arms-race, and no one will ever win. Another form of this is the colloquialism that if you try to make your product idiot-proof, the universe will quickly start building better idiots.
    – Cody Gray Mod
    Commented Feb 8, 2019 at 2:35
  • 42
    @Greg Schmit: "The worst Amazon could do is send me spam": No, the worst Amazon could do is giving forward the email address to others. And those also to others and so on and so on until you will not even know who has it at all and from where. And because Amazon now knows that this email address correlates to an SO user and probably parts of the name are in the email address, Amazon probably also knows who owns that email address. And if that one had filled his SO profile properly then ... Commented Feb 8, 2019 at 9:13
  • "you've managed to find more about this person than they wanted to share" - I can punch in any email into Have I Been Pwned and find out information on that email. Commented Feb 8, 2019 at 17:05
  • 7
    Until ~6 months ago we could search for an email in Facebook and it'd show the person's profile.
    – brasofilo
    Commented Feb 8, 2019 at 17:28
  • 6
    @GregSchmit: Yes, but you'd have to know it first. You can type random email addresses if you like but that won't really accomplish much. Upon getting someone's email address, you can see if they were listed as part of some embarrassing breaches, which may not be information you want to volunteer or have volunteered on your behalf.
    – Makoto
    Commented Feb 8, 2019 at 17:30
  • @brasofilo and phone numbers, it was a good way to screen calls. Commented Feb 8, 2019 at 17:30
  • 3
    @brasofilo: Yeah, but that doesn't make it okay. That also reinforces my point about how there's not really any law against this kind of thing in the US.
    – Makoto
    Commented Feb 8, 2019 at 17:31
  • 3
    @Makoto, it was not my intention to imply it is ok; just noting what kind of info we can extract from an email. In fact, if the email has a profile in some sites Google Contacts will pull it all.
    – brasofilo
    Commented Feb 8, 2019 at 17:34
  • I just put my address into Have I Been Pwned and it said that my email address was stolen from Evony in June 2016 and several others. But I have never even heard of Evony or some of the other sites they mention my data being stolen from. Then it said I should sign up for something - clearly it is making up info just to get me to sign up for something. It seems like a marketing scam as far as I can tell. Commented Feb 11, 2019 at 23:45
  • 4
    @JerryJeremiah: Troy Hunt is a reputable and credible security researcher. He's been doing this for a long time. He's not selling you anything. But I suppose you don't have to trust it if you don't want to. It isn't like he needs your email address; it already exists in one form or another on the site.
    – Makoto
    Commented Feb 11, 2019 at 23:46
  • @LordFarquaad I guess that whole concept of the security of your home relying on an email address being secret seems unbelievably stupid. It's like buying a house and storing my life's savings in it, but not having any locks on it, just relying on the fact that no one knows that I own that house. Emails just aren't supposed to be secret, just like home addresses or first names. Commented Mar 30, 2019 at 6:30
20

You say:

Consider one's email address to be like a home address ... So if I wanted to send a bunch of greeting cards, and Hallmark said I can just upload the home addresses of the people I want to send the cards to, I would do exactly that. Would I be violating those people's privacy?

But if you ordered something from a small online shop and gave them your address, would it be alright for them to turn around and give your home address out to others? What about a marketing group who will send spam mail advertisements and salesman to your door on a regular basis?

If your home address is truly public information would you be ok posting it on stack overflow?

Most people would not agree with any of the above happening.

2
  • 3
    It wasn't posted publicly nor given/sold to a marketing group... so both of your examples are not really applicable. Presumably Hallmark has a privacy policy on what it does with those emails and it would be on OP to ensure that policy meets whatever privacy policy he agreed to with his friends... and since no one I know agrees on a privacy policy with friends you can do whatever you want, legally speaking. Commented Feb 8, 2019 at 17:29
  • 12
    @TemporalWolf In 2016, amazon made $3 billion on ads, making them one of the largest ad companies in the world. Source If that doesn't qualify them as a marketing group, what does? Amazon has also filed various patents in recent years aimed at obtaining and tracking user data for the purposes of advertising. If they are interested in your showering habits, I'm guessing they are more than happy to have your email address. Commented Feb 8, 2019 at 23:08
-20

I think it's important to realize there is already a lot of misinformation/misunderstanding surrounding this issue:


No one has received any spam email as a result of this disclosure

People have proposed it might happen and that would be the worst thing ever.

The original complaint, as confirmed by the OP themselves, does not include anything about this, just that they didn't like the original act or the reminder emails (which, as part of an ongoing exchange are definitely not spam)


This does not appear to be a clear cut GDPR violation (with the caveat of IANAL)

StackOverflow's Terms of Service (under GDPR - Data Processing Addendum) says "Customer acknowledges and expressly agrees that Stack Overflow may engage third party Sub-processors in connection with the provision of the Services."

  • Is providing a gift card a provision of the Services? I'd say so, since they said they would provide a gift card.

  • Was this a breach? Doesn't look like it. It looks like the business offloaded a specific part of their service as they expressly got consent to do so in the TOS. So long as that disclosure followed the third-party data privacy requirements, they are within their TOS.

  • What if Amazon spams these people?!

    a) That hasn't happened, so again, that's a hypothetical at this point

    b) I feel like people have just assumed SE sent a bare list of emails to Amazon with a note: "send these email addresses some gift cards... and w/e you may want, idc." rather than what seems more likely: absent any evidence against, it's just as likely they entered a normal business agreement with an agreed upon privacy policy that meets the requirements for disclosure. Again, there is no evidence this is or isn't the case. Anyone speaking on this matter outside employees, myself included, is conjecturing.


People are incredulous as to why 81 extra gift cards would cause such a burden

We have no way of telling whether or not the total additional burden was 81 gift cards. Perhaps they planned on a ~40% validity rate (581/1500), which if they had only had 500 respondents would have been 200 gift cards. Perhaps not. Take into consideration the additional burden of customer support for those cards after the fact and there is a substantial management cost which can be offloaded by letting a company that makes gift cards handle the gift cards... why do personally what the gift card company will do for you? Besides, they will probably be better at it than you are.

It also doesn't matter: this has no bearing on the issue of the legality of the disclosure and seems instead to just be being used to frame the employees responsible as lazy.

People can't even agree on the number of exposed emails, despite the program manager explicitly listing it... I think that says a lot about how much due diligence people are doing prior to posting their outrage.


At the end of the day, as I mentioned in the OP, I think the original complaint was totally valid (I would have preferred if I was told/asked prior to this disclosure as I'm not a fan of Amazon). Should they have thrown a "Amazon will be handling gift card delivery" message in? Probably, out of courtesy.

Since then, there have been a lot of armchair lawyers (here included) weighing in on the issue. I would be interested in seeing what actual lawyers think of the issue, as I cannot say for certain this doesn't violate GDPR, only that it's not obvious that it does so.

13
  • If my answer was hyperbolic in saying that this did happen, let me know and I'll edit that out quick-fast and in a hurry. You're absolutely right and I have watched the comments on this spiral a bit faster than they should have.
    – Makoto
    Commented Feb 8, 2019 at 17:29
  • @Makoto I wasn't responding directly to your (or any) answer (I hadn't actually read yours to be honest - due diligence all around ;) ), but don't see any specific claims in your answer. In my opinion, it does imply that this event has lead to someone receiving marketing material, but that's subject to interpretation. Commented Feb 8, 2019 at 17:37
  • 11
    You point out that Amazon might be a Data Processor in the sense of the GDPR. But that term is narrowly defined. A Controller–Processor relationship can only exist if SO and Amazon signed a Data Processing Agreement that covers these gift cards. This is likely not the case, otherwise SO would have already mentioned this. That leaves the more likely explanation that SO disclosed personal information without a suitable legal basis.
    – amon
    Commented Feb 8, 2019 at 17:47
  • 1
    @amon I am not a lawyer, so I'm not going to get into the nitty gritty of the law on either side of the pond. My point is you're conjecturing. There is no evidence for or against that claim. It's pointless to conjecture given we're missing the critical information: For all we know they've signed an agreement some broad topic, like "the Services" in the TOS... and that's assuming your claim is accurate (I'm not qualified to make a judgement on this). The intent was instead to show layman-accessible reasonable doubt. Commented Feb 8, 2019 at 17:59
  • 17
    This answer is blatantly wrong, from the first big bold sentence on down. Erik most definitely indicated that he received spam. Let's just look at the three parts of the definition, as applied to reminder e-mails: "Unsolicited". check (the recipient never requested any contact from Amazon). "Commercial". check (the fact that the product, a gift card, was paid by SE rather than the recipient does not change the commercial nature). "E-mail". check. Yup, definitely spam.
    – Ben Voigt
    Commented Feb 10, 2019 at 4:17
  • 2
  • 3
    @TemporalWolf: The CAN-SPAM act was crafted to allow spam (by wiping out the consumer protections already in effect at the state level). I'm proud to disagree with its useless definition of spam.
    – Ben Voigt
    Commented Feb 11, 2019 at 18:59
  • @BenVoigt I'd say your definition is overly broad, and there is a clear chain of solicitation (customer to SE, SE to Amazon). Given your definition, I'm looking forward to "Grandparents across America plead guilty to spamming their grand kids, face fines for sending birthday/holiday giftcards." Commented Feb 11, 2019 at 19:29
  • @TemporalWolf: Not all UCE is going to be penalized. Generally it also has to be in bulk. Returning to the privacy concern, people shouldn't be signing family members up to distribution lists. There's a big difference between a one-time contact initiated by a personal acquaintance (which includes family members) and Amazon choosing to send subsequent notices. Really, there wouldn't be a problem if SE and Amazon had agreed to the following rule: "One message, e-mail address not to be stored or used for any other purposes. Initial message may include an invitation to opt-in to future contact"
    – Ben Voigt
    Commented Feb 11, 2019 at 19:54
  • @BenVoigt So you don't object to any part of this except Amazon sending reminder emails? I wouldn't say a gift card, even if the company sends reminder emails, constitutes a distribution list. Commented Feb 11, 2019 at 20:03
  • @TemporalWolf: If Amazon operated as SE's agent in fulfilling SE gift cards, and adhered to SE privacy practices. I don't see the problem. Well, the e-mails should have the "on behalf of" header set to a valid e-mail actually answered by SE staff to make it clear to the recipient that the email is in the context of the SE relationship. And then there can be NO further storage of email list at Amazon, and NO further e-mails from Amazon as a result of these gift cards, unless opted-in by the recipients.
    – Ben Voigt
    Commented Feb 11, 2019 at 23:37
  • @TemporalWolf: CAN_SPAM is not relevant; this is a GDPR violation. And while StackOverflow may think it's a US company and not directly affected, they got Amazon Germany to handle at least some of these cards. Therefore SO probably needs to contact Amazon's legal team as well. With its German subsidiary Amazon is under direct EU jurisdiction, so those lawyers are not going to treat it as a non-issue.
    – MSalters
    Commented Feb 12, 2019 at 13:54
  • @MSalters CAN SPAM was directly related to Ben Voigt's claims. Concerning GDPR, it's very likely not, for reasons I've already stated pretty extensively. Unless you're privy to insider knowledge on this specific case and case law concerning GDPR, you're just conjecturing. Commented Feb 12, 2019 at 18:29
-21

Talking about email addresses

It certainly can be used to identify you

An email address can be used by you to identify yourself, but it's not reversible in a vacuum. Tell me who owns [email protected] (totally made up). I'm rather confident that you could chase that address for days without ever finding any additional information about it. I've created a few email addresses over the years that are similarly impossible to trace by virtue of being used one time for a service with no connection to anything else of mine. So yeah, you're technically correct in some circumstances.

But we don't live in a vaccum, and an unfortunately large number of companies have been lax with security, which means that an email account is somewhat likely to be connected somewhere with an exposed source of additional, private information. This leads to the next part.

[An email address is] not a secret

True, but that's not to say that an email address is never a secret or part of one. The fact that an email address is active is secret. The connection of an email address to multiple services or its owner is secret. SO certainly believed that the email addresses it released are associated with real people, which should make the email addresses themselves private.

Talking about why it's such a big deal

SO has a lot of users who REALLY care about keeping all their information private. We've got some people who are just generally security-conscious, we've got some Internet-style mountain men who viscerally hate the idea of anybody knowing anything about them, and we've even got some people here who could get imprisoned or killed for stuff they've posted (I was kinda joking about the mountain men, but I'm not joking about this one sadly.) There have been numerous meta posts over the years with people informing SO of potential data leaks and vulnerabilities, so it should be pretty clear to SO that the community as a whole is NOT okay with any privacy leak.

In all fairness, the email list that SO sent out is highly unlikely to have actually exposed anybody who was going to be materially harmed by the exposure, but that process could expose such a person, and that's a problem.

3
  • 8
    An email address is almost never stored in a vacuum but there is a lot of secondary information around that email that can be used to determine a lot of accurate information about someone and since email address are generally unique and not re-used for another person you can get a lot more information over an physical address or phone number which can be re-used by other people.
    – Joe W
    Commented Feb 8, 2019 at 18:36
  • @JoeW What about email addresses created at mailinator.com Commented Feb 11, 2019 at 23:46
  • 1
    @JerryJeremiah You are talking about a very specialized service that accounts for a small fraction of email addresses (and by its very nature would not be used for the purpose that is being discussed here). As I said in my comment it is almost never stored in a vacuum which would account for exceptions like this. Not to mention that sites can block domains like these for security reasons.
    – Joe W
    Commented Feb 12, 2019 at 0:11
-38

Everybody who has an account here has agreed to the Stack Exchange privacy policy. Not reading something one agrees to does not make one exempt from it.

There are some words about email and other personal data on that agreement.

Stack Overflow partners with third parties to display advertisements on our public Network and within our Talent Platform. These partnerships provide third parties access to the developer community to promote themselves or services and to provide you with visibility into companies and third parties seeking to recruit you for employment opportunities, and for other purposes. In providing this opportunity, Stack Overflow and its third party partners may collect and use your personal information to tailor your advertising experience to suit your interests, skills, as well as to monitor your account activity in order to optimize our Products and Services. (...) our advertising products and services require us to collect certain personal and non-personal information on you, which includes:

(...)

  • Information you have provided to us directly (...)

If you want to have an account here, you should give up trying to keep your email address private from the corporate internet at large. If you find it important to hide some piece of information that your email service provider has already sold to world + dog, though, use a burner email account or limit yourself to browsing as an unregistered user.

4
  • 2
    @Magisch "it has to be..." it depends on where in the world you are. May be the case in Europe due to GDPR, but AFAIK that is not the case outside EU.
    – Geeky Guy
    Commented Feb 8, 2019 at 12:14
  • 9
    @Renan The GDPR applies to "all companies processing and holding the personal data of data subjects residing in the European Union, regardless of the company’s location". It is not limited to the EU itself.
    – Marvin
    Commented Feb 8, 2019 at 16:02
  • 1
    It's true that in the US, the applicable federal law (the CAN-SPAM Act) doesn't have an opt-in requirement, other places (like the EU, Canada, etc) do. And there are big pushes from states and even some corporate entities now to change this in the US (in part because of breaches like this, but mostly due to a desire for unified legislation nation-wide as opposed to 50 separate laws from 50 separate states).
    – TylerH
    Commented Feb 8, 2019 at 16:06
  • 17
    I'm staying out of this but need to mention the fact that Stack Exchange is a registered corporation in the United Kingdom. The question of GDPR's extraterritoriality is not relevant in this case; Stack is in their jurisdiction until at least the end of March. Commented Feb 8, 2019 at 17:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .