Twitter Tip Jar's PayPal integration exposes addresses, emails

Privacy researchers have begun voicing concerns about Twitter's Tip Jar integration, noting that users who receive their tips with PayPal are at risk of having their email addresses and even physical addresses exposed.

"We can't control the revealing of the address on PayPal's side," Twitter's head of product said in response to one researcher's concerns, "but we will add a warning for people giving tips via PayPal so that they are aware of this."

In other contexts, Twitter has strict rules about sharing people's personal information, including their home addresses and contact information. "Sharing private information can pose serious safety and security risks for those affected and can lead to physical, emotional, and financial hardship," those rules read. Users who violate these policies have their accounts locked until they delete the offending posts. Repeat offenders face permanent suspension.

Twitter did not, however, say it would suspend the Tip Jar integration with PayPal.

PayPal spokesperson Tom Hunter said users have two options when they're receiving payments through the platform. They can either sign up for payments for "goods and services," in which their addresses are shared, or sign up for payments for "friends and family," in which case they're not. "This is the standard functionality of the PayPal app and we will work with Twitter closely to ensure user awareness," Hunter said.

A user's default PayPal setting, which would then carry over to Tip Jar, depends on which type of account a user has, Hunter said. "If an account holder, for example, has a business account that is primarily used for selling or other goods and services, their account payment type is likely to default to Goods and Services," Hunter said. "Otherwise, the account should default to friends and family."

"Yes, this is a PayPal issue," tweeted Rachel Tobac, one of the researchers who first raised concerns about the exposure on Twitter. "Twitter integrated PayPal into their tip feature so it's now Twitter's responsibility to inform users about how using PayPal [with] Twitter Tip Jar impacts privacy as many Twitter users aren't aware."