Your Amazon Wish List May Be Broadcasting Your Home Address to Strangers — Here’s How to Lock It Down

For millions of consumers, Amazon wish lists are a convenient way to organize gift ideas, share holiday preferences with family, or simply bookmark items for later purchase. But a long-standing privacy vulnerability in how Amazon configures these lists means that your full name, city, state, and even your complete shipping address could be visible to anyone on the internet — including stalkers, scammers, and data brokers who compile personal dossiers for profit.

The issue, which has persisted for years despite periodic waves of public attention, stems from Amazon’s default privacy settings. When users create a wish list, Amazon does not automatically restrict who can view it or access the shipping address attached to it. Unless a user has manually adjusted these settings, their list — and the personal information tied to it — may be searchable and accessible to the general public.

A Default Setting That Favors Sharing Over Safety

As Lifehacker recently reported, the risk is straightforward: Amazon wish lists can expose users to doxxing, the practice of publishing someone’s private information online without their consent. The default configuration of Amazon wish lists allows other users to see the list owner’s name, and in some cases, their shipping address can be revealed when someone attempts to purchase an item from the list. This means that a stranger could, in theory, discover where you live simply by finding your wish list and going through the checkout process for one of the items on it.

The concern is not hypothetical. Content creators, streamers, and public figures who share Amazon wish lists with their audiences have reported instances of unwanted contact and harassment after fans or bad actors obtained their home addresses through this mechanism. But ordinary users are also at risk. Anyone who has ever shared a wish list link on social media, in a forum, or in a public profile may have inadvertently exposed their personal details to a far wider audience than intended.

How the Exposure Actually Works

The technical pathway is alarmingly simple. When a wish list is set to “Public” or “Shared,” anyone with the link — or anyone who searches for the list owner’s name on Amazon — can view it. If a third party adds an item from that list to their cart and proceeds toward checkout, Amazon may display the list owner’s shipping address as a delivery option. While Amazon does not show the full address in plain text during this process, enough information can be gleaned to identify a person’s location, particularly when combined with other publicly available data.

Amazon does offer privacy controls, but they are buried in settings menus that most users never visit. The company has not made significant changes to its default wish list privacy posture, even as awareness of digital privacy risks has grown substantially among consumers and regulators alike. Privacy advocates have long argued that platforms should default to the most restrictive settings and require users to opt in to sharing, rather than forcing them to opt out.

Steps to Protect Yourself Right Now

According to Lifehacker, the fix is relatively simple but requires manual action. Users should go to their Amazon account, find the “Lists” section, and review the privacy settings for each wish list they have created. The key changes to make are as follows:

First, set the list’s visibility to “Private” unless there is a specific reason to keep it shared. Second, check the “Shipping Address” setting within the list and ensure that no address is attached, or that the “Don’t spoil my surprises” option is enabled, which prevents purchasers from seeing the delivery address. Third, review the name displayed on the list — Amazon allows users to set a list-specific name, so instead of a full legal name, users can use a nickname or initials. Finally, users should audit any old or forgotten wish lists that may still be lingering on their accounts with default settings intact.

The Broader Problem With Platform Defaults

This issue with Amazon is part of a wider pattern across major technology platforms, where default settings tend to favor openness and data sharing over user privacy. Facebook, Google, LinkedIn, and others have all faced criticism and regulatory scrutiny for similar practices. The European Union’s General Data Protection Regulation (GDPR) has pushed companies operating in Europe to adopt more privacy-forward defaults, but in the United States, the regulatory framework remains fragmented, leaving consumers largely responsible for protecting themselves.

Amazon, for its part, has not publicly commented on the wish list privacy defaults in recent months. The company’s help pages do provide instructions for adjusting list settings, but there is no prominent warning during the list creation process alerting users that their information could be publicly accessible. Consumer advocacy groups have called on Amazon to change the default setting to “Private” for all new wish lists and to prompt existing users to review their settings, but no such changes have been announced.

Streamers and Public Figures Face Heightened Risk

The wish list vulnerability has been a particularly acute problem for Twitch streamers, YouTubers, and other online creators who often share Amazon wish lists as a way for fans to send them gifts. Several high-profile incidents have involved creators receiving unwanted packages or discovering that their home addresses had been circulated on harassment forums after being extracted through the wish list checkout process. Some creators have responded by using P.O. boxes or Amazon Locker locations as their wish list shipping addresses, but not all users are aware of these workarounds.

The risk extends beyond individual harassment. Data brokers — companies that aggregate and sell personal information — can use publicly accessible wish lists as one of many data points to build detailed profiles of individuals. A name, city, and set of purchasing interests gleaned from a wish list, when combined with information from social media profiles, voter registration records, and other public databases, can paint a remarkably complete picture of a person’s identity and habits.

What Amazon Could Do Differently

Privacy researchers have suggested several changes Amazon could implement to reduce the risk. The most impactful would be changing the default visibility of all new wish lists to “Private” and requiring users to take an affirmative step to make a list public. Amazon could also decouple shipping addresses from wish lists entirely, using a token-based system where purchasers can send a gift without ever seeing the recipient’s address — a model already used by some smaller gifting platforms.

Another option would be to display a clear privacy warning when a user creates a new list or changes a list’s visibility to “Public” or “Shared.” Currently, the process of creating a list provides no friction or notification about the potential exposure of personal data. A simple interstitial screen explaining the risks could go a long way toward reducing inadvertent exposure.

The Responsibility Falls on Users — For Now

Until Amazon makes structural changes to its wish list feature, the burden of protecting personal information falls squarely on the user. The settings adjustment takes only a few minutes, but the consequences of inaction can be severe, ranging from unwanted contact to full-blown stalking and harassment. As Lifehacker emphasized, this is not a new vulnerability — it has existed for years — but the growing sophistication of online harassment campaigns and data aggregation makes it more dangerous now than ever before.

For users who maintain multiple Amazon accounts or who have created wish lists for specific events like weddings, baby showers, or holidays, the audit process may take slightly longer. Each list has its own privacy settings, and changing the account-level default does not retroactively update lists that were created with different settings. It is worth checking each list individually to ensure nothing has slipped through the cracks.

The broader lesson is one that applies across all online platforms: default settings are almost never configured with the user’s privacy as the top priority. They are designed to maximize engagement, sharing, and ultimately, commerce. Taking a few minutes to review and tighten privacy settings on Amazon — and on every other platform where personal information is stored — is one of the most effective steps any consumer can take to reduce their digital exposure. The few minutes it takes to lock down an Amazon wish list could prevent a serious privacy breach down the line.