Your Receipt Is Watching You

Opting for a digital receipt may feel like a paperless convenience. Tap, pay, get a receipt in your inbox or on your phone. No clutter, no handling of chemical-coated paper, no problem. Digital receipts are efficient and increasingly popular. One provider of digital receipt services describes digital receipts as a simple technological transition: “A digital receipt is an electronic version of the conventional paper receipts you receive when you buy something or make a transaction.” But to businesses, digital receipts are not just “cheaper than paper receipts,” they also “provide a better customer experience, and they’re more effective for post-purchase marketing.” In other words, digital receipts are helping businesses monitor their customers. So that email or text receipt isn’t just a record of your purchase; it’s a data grab. And it may be collecting more than just your itemized list.

Digital receipts are now a quiet tool for retailers to track, profile, and market to consumers long after the sale is done. When a cashier asks for your email or phone number to send a receipt, that information is typically folded into customer relationship management systems, matched with loyalty data, and used to build marketing profiles. In some cases, it’s shared or sold to third parties, and regardless, it’s vulnerable to hacks and privacy breaches. And what happens to your data if the company goes under?

What makes this practice problematic isn’t just the scope of the data collected. It’s the lack of meaningful notice or consent. Consumers making purchases in stores are not meaningfully informed that item-level data is being extracted from their receipts. Surely, consumers expect that stores monitor inventory and units sold, but not the who/when/how data on each item in every transaction. And while a digital receipt might include a vague line in a privacy policy somewhere, that information isn’t provided to the consumers at the register, and requesting a receipt often requires consenting to the data transaction.

States and Congress are starting to treat what once seemed like a harmless checkout step as something much more significant. When disclosures are buried or consent is presumed, those practices can cross the line into deceptive or unfair conduct. That’s where consumer protection law comes in, but unfortunately, very few of the laws passed so far are comprehensive. Statutes like the California Consumer Privacy Act, which require businesses to disclose what data they collect and how it’s used, and to give consumers a way to opt out, can serve as a model. Now, more states are following California’s lead and passing their own data privacy laws. But as a recent Boston Globe opinions piece stated: “Data privacy laws are only as good as their consumer protections.” 

While none of the business behavior discussed here is necessarily unlawful, when companies obscure how the data is used or fail to provide real opt-out mechanisms, they risk violating consumer protection laws designed to ensure fairness in the marketplace. Digital receipts can carry behavioral signals—what you bought, when, how often—that help companies target ads, tweak prices, and shape their marketing. It's a rich stream of behavioral data, collected without much transparency, and without clear ways to opt out. So for now, digital receipts aren’t just a greener alternative to paper, they’re a vector for data collection. Until companies get clearer about how they use that data—and give consumers a real choice—expect scrutiny to grow.