Faced with accusations that it violated users' privacy, online marketplace Etsy retreated from an attempt to add social-networking features to its site by publicizing users' names and their purchases.
The company said late Tuesday that it is now making all information about the buyers' purchases -- as well as feedback about items -- private by default. That move marks a turnaround from last week, when the company launched a people-search tool that allowed users to search by buyers' names. The tool also enabled people to discover the purchases users made by disclosing feedback from both buyers and sellers.
In one well-publicized post, a user at the Penny Arcade forums wrote about learning the real name of someone who had purchased sex toys from Etsy.
In addition, at least some of the Etsy purchase data made its way to Google. Blogger Jonathan Eyler-Werve wrote on Monday that a Google search for his own name turned up an Etsy profile as the fifth result, based on a 2009 purchase he made.
Etsy turned on the new people-search feature by default, meaning that users' information would be revealed unless they opted out. The company told people about the feature on its forums and also sent members email notifications.
Still, Etsy appears to have blindsided people, judging from the 120-pages of critical comments on Etsy's seller forums. "I find this whole thing seriously worrisome and creepy," wrote one user. "It's one thing to 'find people' on a social networking site, but when purchasing and the exchange of money is involved, well, I would never feel comfortable shopping on a site that provides that 'feature.' What happened to privacy?"
After reports about Etsy's people-search feature surfaced in the media this week, the company went on the defensive. "Did we make a mistake here? Yes, and we worked till late in the night yesterday to take a step in the right direction and plan our next steps," CEO Rob Kalin wrote on BoingBoing. The company later added that it had stopped publicly linking feedback (which included users' names) to particular purchases.
Given the recent surge in privacy litigation, Etsy might well find itself in court for allegedly changing the way it handled users' data without giving them adequate notice. Similar allegations have landed social networking sites Facebook and Classmates, as well as search giant Google in court. Facebook and Classmates were sued for allegedly revising their default settings to make more information about users public; Google was sued because when it launched the social-networking service Buzz, the feature revealed information about the names of users' email contacts, if users activated the feature without changing the defaults.
New York lawyer Scott Kamber, who has represented consumers in many privacy class-actions against Web companies, says his law firm is looking into the matter. "Just because actions seem outrageous as a business practice does not make them illegal in a privacy sense," he says in an email. "However, we have been contacted by a number of people who are outraged at having their purchase data exposed, and we are investigating whether Etsy's business folly is as illegal as it was unwise."
Consumers often face challenges when bringing privacy-related claims, says Seattle-based Internet law expert Venkat Balasubramani. Often, there's no specific law that people can say was violated. Morever, judges often require users to show they suffered economic harm as a result of a data breach. But, Balasubramani adds, some Etsy users might have viable claims that the company wrongly disclosed private facts, provided they can prove the company wrongly revealed highly sensitive, potentially embarrassing information about them.