How to Protect Your Identity When Shopping Online

Online retailers are not, as a rule, in the privacy business — their commercial incentive runs in the opposite direction, toward knowing you well enough to retarget you with ads for years after a single purchase, and toward accumulating enough purchase history to sell or license as a dataset in its own right. That asymmetry is not hidden or particularly subtle once you look for it; it is baked into checkout flows by design. Three small, low-effort habits flip most of it back in your favor without making online shopping meaningfully more inconvenient.

Habit 1: Disposable email for one-off purchases

For a single-shot purchase from a store you do not plan to revisit — a one-time gift, a piece of clothing from a brand you are trying for the first time — give them a disposable address at checkout instead of your real one. The transaction still completes normally: order confirmation, shipping updates, and delivery notifications all arrive exactly as they would with a real address. What does not continue is the relationship afterward — no promotional emails next quarter, no "we miss you" campaign six months later, because the address they collected no longer exists to receive any of it.

Habit 2: Virtual, merchant-locked card numbers

Most major banks and several dedicated services now offer virtual card numbers that you can lock to a single merchant, or even to a single charge, while your real card number never touches the retailer’s systems at all. Combined with a disposable email address, the merchant walks away from the transaction with nothing reusable: not a card number that works anywhere else, and not an inbox that still exists to receive anything mailed to it later. This is the single highest-leverage habit on this list for anyone worried specifically about a retailer’s own systems being breached later.

Habit 3: A deliberately minimal address and profile

Leave every optional field at checkout blank unless filling it in changes something you actually care about. The overwhelming majority of "tell us about yourself" prompts — birthday, interests, how you heard about us — exist purely to enrich a marketing profile, not to complete your order, and skipping them costs you nothing functionally. The same applies to account creation prompts at checkout: most retailers let you complete a purchase as a guest, and doing so avoids creating a permanent, growing purchase history tied to an account you never explicitly decided you wanted.

A worked example: buying a gift from a store you will likely never use again

Say you need a one-time gift from a boutique retailer you found through a social media ad and have no intention of buying from regularly. At checkout: use a disposable email for order confirmation and shipping updates, use a virtual card number locked to that single charge, skip the account-creation prompt in favor of guest checkout, and leave every optional profile field blank. The order completes exactly as smoothly as it would otherwise. The difference is what happens afterward — nothing, rather than a slow accumulation of marketing email, a profile entry in a retargeting system, and a card number the retailer keeps on file indefinitely.

When to skip these habits and use your real details instead

These three habits are calibrated for one-off or low-trust purchases, not every online transaction. A retailer you shop with regularly, where you want order-history tracking, loyalty points, or easy returns without re-entering details each time, is a case where creating a real account with your real address is a reasonable, deliberate trade rather than something to avoid. The judgment call is the same one that runs through this entire blog: is this a relationship worth the data it costs, or a single transaction dressed up as one? For a retailer you already trust and plan to use repeatedly, the convenience of a real account frequently outweighs the marginal privacy cost.

A word on physical shipping addresses

Unlike an email address, a shipping address generally cannot be made disposable — the package has to arrive somewhere real. What you can control is whether that address gets stored beyond the single delivery: many retailers offer a "use this address once, do not save it" option at checkout, distinct from the default "save to my account" behavior, and it is worth actively selecting it for one-off purchases from stores you do not plan to use again. Combined with a disposable email and a locked virtual card, this closes most of the remaining gap between "completed a purchase" and "created a durable, cross-referenceable profile" for a single transaction.

None of this is heroic effort, and none of it makes checkout noticeably slower. Together, these three habits remove the large majority of the data an average online retailer was hoping to collect on you from a single, otherwise unremarkable purchase.