UPDATE: Birchbox has discontinued its practice of sharing gift recipients’ addresses with gift givers. The company tells Consumerist that sharing the information was an “oversight.”

We live in a world where it’s becoming increasingly common for people to send gifts to others without ever knowing their mailing address. Many online retailers now let you at least purchase gift cards or gift subscriptions with only the recipient’s email address. But for some reason, Birchbox will also tell you the recipient’s full shipping address. 

Consumerist reader Mike recently purchased a three-month gift subscription to Birchbox for a friend, using only her email. He wasn’t surprised when he received a confirmation message from the website letting him know that the gift had been redeemed. What he was surprised to see was that Birchbox had provided him with the friend’s mailing address.

“Obviously, this has some privacy concerns and a potential to easily be exploited,” he says.

Just to make sure this wasn’t a fluke, Consumerist tested Birchbox’s system by purchasing a gift subscription. As you’ll see later in this story, we received the same type of revealing information that Mike did.

Giving The Gift

Mike tells Consumerist that the incident occurred shortly after he decided to gift a friend with a Birchbox subscription.

For those unfamiliar, Birchbox is a beauty subscription service that sends subscribers a box of four to five beauty or makeup samples for $10 each month. Birchbox hopes you like those products so much, you’ll buy full-sized — and full-priced — versions of those same products on its website.

The company offers a few ways to provide gifts:

1. Customers can purchase a gift card to the company that could then be redeemed either for boxes or full products.

2. A customer can purchase a three-, six-, or nine-month gift subscription to be sent to their friend.

Because you might not know your friend’s full mailing address when going with option two, Birchbox allows customers to simply send the gift via email.

In this case, the giftee will receive an email notifying them that someone has sent them a subscription gift. They can then redeem this gift for the boxes by providing their address and other personal information.

Redeeming The Gift

Once someone has redeemed the gift, the giver will receive a confirmation email. After all, it’s nice to know your gift was received and is being used.

 

But that’s not the end of your time with Birchbox, when the first gift — in this case a $10 Birchbox box — has been shipped, the sender receives a second email notification.

In addition to providing the sender with confirmation that the gift is on the way, the email also includes the entire address for the person receiving the gift.

 

That’s Concerning

Mike says he was immediately concerned about the way Birchbox handled his friend’s information. He quickly reached out to the company about the issue.

“This seems like a huge privacy issue – ostensibly you could ‘phish’ someone’s private address with only their email address and sending them a gift,” Mike told the company.

Instead of addressing his concerns, Birchbox replied with what appears to be a canned response.

“Thanks for thinking of Birchbox and for providing us with this feedback. Rest assured, I’ve passed your feedback along to our teams for further investigation,” the company’s customer service rep replied.

Consumerist reached out to Birchbox about the notification system and sharing of customer addresses.

A press rep for the company says it includes the gift recipient’s shipping information in the email “to let the gifter know that their recipient has successfully set up and claimed their new Birchbox Gift.”

Birchbox notes that by claiming the gift into their account, the recipient is confirming their gift and voluntarily providing their information for Birchbox and the gifter.

The system also appears to be a way for Birchbox to continue making sales.

For instance, the rep notes that “if the gifter would like to purchase the gift recipient a gift in the future, they will then be able to send the future Gift Subscription boxes or a Gift Subscription Gift Card directly to the gift recipient.”

When asked if the company allows customer to opt-out of sharing their address with someone sending them a gift, the rep said “not at this time.”

“However, I will be sure to pass this suggestion along to the teams that work with our gifting process,” the rep says.

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.