4

As a developer, I know that an Apple Pay payment seems to offer more privacy in some cases when online.

Can anyone elaborate the different scenarios Apple pay offers and what the consumer privacy risk is of each? For example:

  • A shoe vendor uses a "Apple Pay Merchant" such as Stripe or Braintree to process payments online. In this case the trusted URL is set to https://BrainTreeOrStripe.com/.well-known/apple-developer-merchantid-domain-association
  • A shoe vendor acts as an Apple Pay Merchant, and the above URL points to their own website (Payless.com)

In the above examples some information identifying the user is shared with some parties and not others.

My question is regarding PII (Personally Identifiable Information) or even a per-user tracking identifier that may exist. I'd like to know when any of that data is shared between the merchant, the payment network, and/or other parties.

A risky example shows itself when I use ApplePay with two different merchants (medical processing and a nightclub), and that data is subsequently correlated by two merchants willing to share data or perhaps it's observed on the payment network itself. My fear is that insurance rates will rise simply because I'm buying drinks for friends at a nightclub, but the data makes it appear that I'm buying all those drinks for myself.

  • 2
    It appears like you're looking for an article about Apple Pay as it relates to privacy, although it's not clear who's privacy, the consumer or vendor. To avoid being closed as 'too broad', you should edit this question to focus on a single question that better fits this site's Q&A approach. – fsb Jul 18 '18 at 13:39
2

Apple Support Document, Apple Pay security and privacy overview, throws some light on the security and privacy offerings when using Apple Pay on Web.

Relevant quote from the article:

When you use Apple Pay within apps or on the web

...

To securely transmit your payment information when you pay in apps or on the web, Apple Pay receives your encrypted transaction and re-encrypts it with a developer-specific key before the transaction information is sent to the developer or payment processor. This key helps ensure that only the app or the website that you’re purchasing from can access your encrypted payment information. Websites must verify their domain every time they offer Apple Pay as a payment option. Like with in-store payments, Apple sends your Device Account Number to the app or website along with the transaction-specific dynamic security code. Neither Apple nor your device sends your actual payment card number to the app.

...

When you use Apple Pay on your iPhone or Apple Watch to confirm a purchase from your Mac in Safari, your Mac and the authorizing device communicate over an encrypted channel via Apple servers. Apple doesn’t retain any of this information in a form that personally identifies you. You can disable the ability to use Apple Pay on your Mac in Settings on your iPhone. Go to Wallet & Apple Pay and turn off Allow Payments On Mac.

  • My main question is regarding PII (Personally Identifiable Information) or any per-user tracking identifier that may exist. I'd like to know if any of that data is shared between the merchant, the payment network and other parties. The risk is if I use ApplePay with two different merchants (medical processing and a nightclub) that the data can be correlated by two merchants willing to share data or can be observed on the payment network itself. – Ran Dom Jul 18 '18 at 14:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .