Using PayPal for Twitter's Tip Jar could reveal tipper's address to the recipient and possibly recipient's email to the tipper; Twitter says it will add a label
WiredBrian Barrett
Context & Ripple Effects
Twitter had just opened its creator-monetization door: the Tip Jar launch let all English-language users send tips and let journalists and experts accept them, routing payments through third-party services including PayPal. Within three days, security researchers found that PayPal passes the sender's name and address to whoever receives a tip, and can hand the recipient's email back to the tipper.
The flaw matters because Twitter positioned tipping as casual fan-to-creator support, not a transaction that exchanges physical-world identity data between strangers. Twitter's response — adding a label warning users what PayPal shares — is a patch on a design problem, and the platform's subsequent move toward crypto rails looks like a structural answer.
First-order effects
Tippers using PayPal expose their name and street address to any recipient they tip, and recipients' emails leak to senders in some cases — until Twitter ships the label warning, users are opting into doxxing themselves with each payment.
Second-order effects
Twitter accelerates toward payment methods with no address attached, integrating Strike's bitcoin wallet for Tips months after this story (rolling out Tips globally on iOS) and later letting creators add ethereum addresses plus Paytm support.
Third-party payment integrations become a liability surface for platforms: every new payment option added to a social product now carries an obligation to audit what personal data the provider exposes between strangers.
Third-order effects
If the pattern holds, creator tipping migrates toward wallet-based rails precisely because they decouple payout identity from home address, leaving legacy processors like PayPal competing for social payments on trust disclosures rather than convenience.
The trend: Social platforms are building creator-payment stacks that favor pseudonymous crypto wallets over traditional processors whose KYC data flows into peer-to-peer transactions.
Huge heads up on PayPal Twitter Tip Jar. If you send a person a tip using PayPal, when the receiver opens up the receipt from the tip you sent, they get your *address*. Just tested to confirm by tipping @yashar on Twitter w/ PayPal and he did in fact get my address I tipped him. …
The only problem with this take is that PayPal and Venmo doesn't allow sex work using their platforms. Twitter let's us post our tiddies but we won't be able to safely sell our work here. https://twitter.com/...
@RachelTobac @yashar this is a good catch, thank you. we can't control the revealing of the address on Paypal's side but we will add a warning for people giving tips via Paypal so that they are aware of this.
Yeah this is for content creators who use PayPal for tips. This has always been a thing. PayPal will show your real information if you have a normal account. Start a PayPal business account today. Like right now. It's free and protect your information. https://www.paypal.com/... …
Twitter's Tip Jar allowed users to express their gratitude; however, there was one unfortunate wrinkle: Sending someone money via PayPal could reveal your home address. https://www.wired.com/...
Warning all: @Twitter's new “Tip Jar” feature reveals the recipient's email address that's linked to their account, even when you don't send them any actual money (I got permission from @jason_kint to show his email in this video) Thread here: https://twitter.com/... https://twit…
Good find @ashk4n — he found that he could see some (but not all) PayPal Twitter Tip Jar recipient's email addresses without even sending them money. His best guess is that some PayPal users haven't setup a ‘nickname’, which then reveals their email address quickly in the flow. h…
We had Twitter tipping supported in @brave since way back in August 2019 (and no email address breach). Anonymous by default, up to you to tweet or dm about it. https://twitter.com/... https://brave.com/tips/
This whole trend of tech companies like @Twitter outsourcing their “QA” to outside researchers and regulators is *really* starting to get old. @RachelTobac @brbarrett (also see: @onepeloton @facebook or whatever other terrible news story this week) https://twitter.com/... https:/…
NOTE: the #privacy issue I flag below is *different* from the one @RachelTobac discovered whereby #tipjar reveals the sender's physical address https://twitter.com/... Both are problematic as they're not adequately disclosed and create digital + physical risks for @Twitter users …
For those that want to use the Twitter Tip Jar, be careful what service you sign up with! It seems like Venmo (which PayPal owns) doesn't share this info in a transaction, but if there are any issues like this for it, please call it out and I will RT ASAP. https://twitter.com/...