Square's parent company Block sells access to customers' email addresses used to receive receipts, which privacy experts say falls short of best practices
When COVID-19 forced Compass Coffee to close down its Washington, D.C.-area shops, the roastery's owners turned to email to stay in touch with customers.
Context & Ripple Effects
Block has been building toward this for years: Square launched email marketing tools for brick-and-mortar merchants back in 2015, then partnered with BigCommerce in 2017 to use anonymized transaction data to pre-qualify merchants for loans. Selling access to receipt email addresses extends that playbook from aggregated data to direct customer contact.
The contrast with peers is sharp — Amazon fired an employee for sharing users' email addresses with a third-party seller and treated it as a law-enforcement matter — while privacy experts say Block's practice falls short of best practices. The move also lands on a company whose merchant trust is already strained by complaints that Square withheld 20%-30% of customers' payments, and which just agreed to pay $45M to settle state claims that Cash App failed to protect users from fraud.
First-order effects
- Merchants like Compass Coffee gain a ready-made marketing channel built on email addresses customers provided only to receive receipts, while those customers receive commercial mail they never explicitly opted into.
Second-order effects
- Rival POS and payments providers face a fork: match Block's data-monetization revenue or market themselves as the privacy-safe alternative, just as state attorneys general — fresh off the $45M Cash App settlement — have a demonstrated template for pursuing Block over consumer-protection lapses.
Third-order effects
- If the pattern holds, the transactional touchpoints of payments platforms — receipts, payment confirmations, loyalty prompts — become monetized advertising inventory by default, pushing consent standards for transactional email toward a regulatory battleground between platform ad businesses and consumer-privacy enforcers.
The trend: Payments platforms are converting every transactional touchpoint into monetizable marketing inventory, testing how far a data business model can stretch before consent norms and regulators push back.