Amazon Wish Lists Expose Kids

Amazon.com’s wish list feature is a great way to let relatives know what a kid wants. But it’s also potentially a great way for predators to connect with kids.

Wish lists let anyone pick from the vast array of products on the site and arrange them on a personal page to make it easy for friends and family to easily select and buy something that won’t be exchanged or sent to the thrift store after the holiday. Creating a wish list is easy. Users register or sign in, search for products and then click the “Add to Wish List” button.

But would-be recipients of largess must provide their shipping addresses at registration, and, Amazon.com warns them, “We will display your city and state to help your friends and family identify you. We won’t, however, show your phone number or street address to others.”

While most people immediately bombard everyone they know with e-mails announcing their wish lists, for some reason, the online retailer seemed to think it important to allow users to search by name. Amazon.com didn’t return calls requesting comment.

Site visitors can search wish lists by name, presumably to see whether anyone they want to gift has set one up. However, it’s relatively easy for a stranger to find a kid simply by searching for a common first name, then scrolling through the list to find those who have listed last names, cities and states. Clicking through to the wish list gives a good indication of how old the person is.

For example, there’s a girl named Latisha in Alabama who wants a tetherball set, and a little boy in Wisconsin named Austin who wants a Chicken Dance Elmo.

If you’re Margaret Lee and you live in a city, this isn’t a big deal. But it’s all too easy to get the address and phone number of someone with an unusual name living in a little town.

“If you have an uncommon name, and you have the first and last name of the parent, you can get an address and a MapQuest to their house,” aid Donna Rice Hughes, president of Enough Is Enough, a national non-profit focused on making the Internet safe for kids and parents.

No matter how old you are, online privacy and safety experts say it’s a bad idea to publish your last name or other identifying details on the Internet.

“It’s a very unsafe practice,” said Rice Hughes, who wrote the book “Kids Online: Protecting Your Children In Cyberspace.” She added, “We’re finding more and more practices that appear to be okay and safe, but that remove all the barriers for an Internet predator to access a child. With online profiles and wish lists, a predator doesn’t have to look very hard to find personal information about anyone.”

In April 2003, 11 groups led by the Electronic Privacy Information Center (EPIC) asked the Federal Trade Commission to look into Amazon.com’s practice of letting kids post reviews of toys. Some included their full names, ages and even addresses with their reviews.

EPIC said Amazon.com didn’t manage and monitor its review process, nor was there any other mechanism by which it complied with the rules of the Children’s Online Privacy Protection Act of 1998. But the FTC concluded that the site wasn’t aimed at children and therefore didn’t break the law. EPIC disagrees.

Lillie Coney, an EPIC associate director specializing in children’s privacy, said that in the case of wish lists, Amazon.com should discourage users from adding their last names.

“It would have been a good idea to the limit amount of information provided, such as last names,” she said. “If you’re truly family or a friend, you already know that. You’re trying to make sure there’s some anonymity in there.”

Another online wish list service, Kaboodle, which is still in beta, lets users protect their wish lists with passwords if they choose.

Google also has a wish list feature for its Froogle comparison-shopping service, and it follows these experts’ recommendations: It’s searchable only by e-mail address, so that only people who already communicate with an individual can find his or her wish list. Each wish list is identified by a unique URL that can be e-mailed to family and friends. Moreover, on the wish list page, the giftee is identified only by that e-mail address.

But Amazon’s system is more accessible to anyone. “As a company, they’re thinking about service to their customers,” said Coney, “but they should have given a little more thought. Less information is always better.”

Rice Hughes said Amazon.com should at least passively warn parents about the dangers. “It would be good, family-friendly policy to know let parents know that any type of personal information or the name of their child is fair game for anyone,” she said.

Amazon.com’s own family-friendly brand may have given parents a false sense of security, according to Parry Aftab, an attorney specializing in Internet safety and author of “The Parent’s Guide to Protecting Your Children in Cyberspace.”

“Parents should think before they click,” she said. “When they do things on the Internet on a site they trust, like Amazon.com, they don’t realize that 700 million people on the Internet can see it.”

“The issue isn’t whether we can sue Amazon.com,” Aftab said. “It’s whether Amazon.com can help parents understand what they should and shouldn’t post.”

The bottom line, said these experts: Never post your last name online, no matter how old you are — or what you want for the holidays.