IOS – Does Apple Pay offer consumer privacy advantages over traditional payment on the web

apple-payiosprivacywallet

As a developer, I know that an Apple Pay payment seems to offer more privacy in some cases when online.

Can anyone elaborate the different scenarios Apple pay offers and what the consumer privacy risk is of each? For example:

  • A shoe vendor uses a "Apple Pay Merchant" such as Stripe or Braintree to process payments online. In this case the trusted URL is set to https://BrainTreeOrStripe.com/.well-known/apple-developer-merchantid-domain-association
  • A shoe vendor acts as an Apple Pay Merchant, and the above URL points to their own website (Payless.com)

In the above examples some information identifying the user is shared with some parties and not others.

My question is regarding PII (Personally Identifiable Information) or even a per-user tracking identifier that may exist. I'd like to know when any of that data is shared between the merchant, the payment network, and/or other parties.

A risky example shows itself when I use ApplePay with two different merchants (medical processing and a nightclub), and that data is subsequently correlated by two merchants willing to share data or perhaps it's observed on the payment network itself. My fear is that insurance rates will rise simply because I'm buying drinks for friends at a nightclub, but the data makes it appear that I'm buying all those drinks for myself.

Best Answer

Apple Support Document, Apple Pay security and privacy overview, throws some light on the security and privacy offerings when using Apple Pay on Web.

Relevant quote from the article:

When you use Apple Pay within apps or on the web

...

To securely transmit your payment information when you pay in apps or on the web, Apple Pay receives your encrypted transaction and re-encrypts it with a developer-specific key before the transaction information is sent to the developer or payment processor. This key helps ensure that only the app or the website that you’re purchasing from can access your encrypted payment information. Websites must verify their domain every time they offer Apple Pay as a payment option. Like with in-store payments, Apple sends your Device Account Number to the app or website along with the transaction-specific dynamic security code. Neither Apple nor your device sends your actual payment card number to the app.

...

When you use Apple Pay on your iPhone or Apple Watch to confirm a purchase from your Mac in Safari, your Mac and the authorizing device communicate over an encrypted channel via Apple servers. Apple doesn’t retain any of this information in a form that personally identifies you. You can disable the ability to use Apple Pay on your Mac in Settings on your iPhone. Go to Wallet & Apple Pay and turn off Allow Payments On Mac.

Related Question