Introduction: the box that says more about you than you think
You ordered three things last month. A pair of shoes, a dietary supplement, a book. Each arrived in a cardboard box with a label stuck on it bearing your full name, your complete address, your floor, sometimes your building entry code, an order number and a barcode. You received four text messages, two emails and an app notification. A courier photographed your door as "proof of delivery." The box went out for recycling, label intact.
None of these steps is abnormal. Put end to end, however, they build a formidably precise file: where you live, with whom, when you're at home, what you consume, how often, and for how much.
Delivery is the blind spot of digital privacy. We're wary of cookies, we install an ad blocker, we refuse ad tracking on our phone — then we type our full address and mobile number into a checkout form, on a platform where we know neither the actual seller nor the logistics subcontractor. The paradox is complete: e-commerce is the only sector where we voluntarily hand over, several times a month, the most sensitive piece of information there is after our civil status — the exact place where we sleep.
This guide isn't a call to give up online shopping. It explains who handles your data along the logistics chain, what you can legally refuse, and the concrete habits that shrink the trail, from the cart all the way to the recycling bin.
Part 1 — Mapping the chain: ten players for one box
What actually happens when you click "Place order"
The illusion of online shopping is that there's only one party involved: the website. In reality, an order sets in motion a chain of data controllers and processors that share neither the same purposes nor the same retention periods.
| Player | What they see | How long they keep it (in practice) |
|---|---|---|
| The marketplace | Identity, address, complete purchase history, payment methods | Years (accounting obligations: 10 years for invoices) |
| The third-party seller | Name, delivery address, order contents | Variable, often with no clear policy |
| The picker / warehouse | Name, address, product reference | For the duration of shipping, plus logs |
| The carrier | Name, address, phone, email, delivery geolocation | 1 to 3 years depending on potential disputes |
| The last-mile subcontractor | Name, address, entry code, photo of the location | On a personal smartphone, sometimes |
| The pickup point (shopkeeper) | Name, reference, ID document shown | Paper register or the network's software |
| The payment provider | Identity, amount, merchant | Long banking retention periods |
| The merchant's marketing tools | History, segments, propensity scores | Until consent is withdrawn |
Eight to ten entities, then, for a pair of shoes. And here's the key point: no legal obligation says the carrier must know your name. It must be able to deliver. Collecting your name, email and mobile number is a matter of operational convenience and dispute prevention, not a legal requirement.
The label problem
The shipping label is the most underestimated item in the whole file. It travels physically, unencrypted, under the eyes of a dozen people, and it ends up out on the street. It typically contains:
- your exact first and last name;
- the complete address, including building, floor, and entry code if you filled it in;
- a phone number;
- an order reference that, on some sites, makes it possible to guess the contents;
- sometimes the merchant's name, which reveals the nature of the purchase (online pharmacy, specialist shop, sex shop, medical equipment supplier…).
A box left on the pavement with its label visible is an intelligence sheet handed to the first passer-by. Police forces regularly warn about burglars scoping out targets: high-end electronics packaging left outside a building signals what's inside the flat, and the label adds the floor.
Simple rule: a shipping label gets destroyed, not thrown away. A small cross-cut document shredder, or failing that a pair of scissors and two separate bins, is enough.
Part 2 — Decoupling your identity from your home
The principle: separate the "who" from the "where"
The whole strategy fits in one sentence: you need to break the link between your legal identity and the address where you sleep, whenever possible. Three families of solutions exist in France, with different levels of friction.
1. Pickup points and parcel lockers. This is the simplest and most accessible option. You're not having it delivered to your home, but to a shop or a locker. Automated locker networks (Pickup, Mondial Relay, Amazon Locker, Relais Colis) ask at best for a code, at worst for an ID document. You limit the exposure of your door and your schedule, and you avoid the photo of your landing.
2. PO boxes and business address services. La Poste offers PO boxes that let you receive mail without circulating your address. A caveat: not all PO boxes accept every parcel format, and some private carriers refuse to deliver to one. For professional activity, a licensed business address provider solves the problem for good — and that's the main reason freelancers use them: otherwise their home address would appear in public registers.
3. In-store collection. Underrated, but highly effective: in most cases you give out neither an address nor a phone number, just a name and an order number.
The name on the label
Nothing obliges you to write your full legal name in a delivery field, as long as the parcel reaches you and you're not trying to deceive anyone in a regulated transaction (payment, warranty, complaint). Several common and legitimate practices:
- give only your first initial;
- use a consistent spelling variant to trace leaks: if you receive marketing addressed to "Dupont-M3," you know exactly which merchant sold or lost your file;
- for a pickup point, stick to your surname if the network allows it.
That said, when collection involves an ID check, the name must match your document. The practical rule: variants for home deliveries, exact identity for checked collections.
Part 3 — The phone number, again and always
Why carriers insist on it
Carriers use your mobile number for three things: telling you the delivery window, calling you if access fails, and sending you the collection code. The first two are genuine. The third could go by email.
The result: your number ends up in the databases of half a dozen carriers and last-mile subcontractors, and sometimes on the personal smartphone of an independent courier who jotted it down to call you faster. That number, as we've detailed elsewhere on this site, is the pivot that makes it possible to stitch two files together.
A few concrete countermeasures:
- A secondary number dedicated to shopping. A prepaid SIM card in a basic phone, or a second line in a dual-SIM device, completely isolates the commercial sphere from the personal one. It's the most effective measure in this guide, and the cheapest over time.
- Never fill the "delivery instructions" field with a building entry code. That field is stored in plain text, duplicated, and displayed on the courier's screen. Prefer "intercom under the name X" or a time slot when you're home.
- Refuse SMS notifications when email is available. A dedicated shopping email address, in a mailbox separate from your personal one, soaks up the marketing without polluting the rest.
For situations where you need to send a one-off piece of information to a private seller — a second-hand platform, a consignment shop, a tradesperson — without handing over your main line, an anonymous SMS sending service avoids opening a permanent door to your mobile.
Receiving parcels while you're out
Being away is the moment privacy is won or lost. Three options, in order of discretion:
- The parcel locker: no human third party, no neighbour in the loop.
- A secure parcel drop box installed outside your home: the courier drops off, you collect. The device costs around fifty euros and removes half the problems — provided you have outdoor access.
- The neighbour: convenient, but every parcel left next door is information about your purchases and your absences handed to someone who never asked for it.
A word on the delivery photo. Now standard with several carriers, it immortalises your door, sometimes your doormat, your flat number and the visible contents of the parcel. These images fall under the GDPR the moment they're attached to your order: you can request access to them and then their erasure from the carrier, as data controller. Many don't know how to respond; that's precisely what makes the request worthwhile.
Part 4 — Taking back control on the merchant side
The customer account, that warehouse of memory
A customer account retains your entire purchase history, often with no stated limit. That's useful for warranties, and it's exactly what feeds marketing segments. Two disciplines compete: delete everything, or document everything.
The middle path looks like this:
- Check out as a guest whenever the amount is small and a warranty claim unlikely (consumables, books, small accessories).
- Create an account for appliances, computing, anything with a long warranty — and keep the invoice off the site, in a local archive on an encrypted external hard drive, so you don't depend on the merchant.
- Do a clear-out twice a year: delete inactive accounts, remove saved addresses, revoke stored payment methods.
The rights you almost never use
The GDPR and the French Data Protection Act give you levers you can pull directly, against merchants and carriers alike. The CNIL provides letter templates for each one.
| Right | What it gets you in practice | Response deadline |
|---|---|---|
| Access (art. 15) | The list of everything they hold: history, segments, delivery photos, recorded calls | 1 month |
| Erasure (art. 17) | Deletion, apart from accounting and tax obligations | 1 month |
| Objection (art. 21) | An end to marketing calls and profiling | Immediate in practice |
| Restriction (art. 18) | Freezing the processing during a dispute | 1 month |
| Portability (art. 20) | Export of your data in a readable format | 1 month |
If they stay silent, filing an online complaint with the CNIL is free and takes ten minutes. The authority's annual reports show a steady rise in complaints and penalties, with e-commerce and cold calling among the most frequent grounds. In other words: these requests don't disappear into the void.
You can also register with Bloctel, the official opt-out scheme for telephone cold calling, and report abusive text messages to 33700. Neither tool deletes data already collected, but they cut off the most irritating use made of it.
Part 5 — Purchases that deserve extra caution
Not all parcels are equal. Some reveal, by their very existence, information the GDPR classes as sensitive (Article 9): health, sexual orientation, religious beliefs, political or trade union affiliation.
- Online pharmacies and health and beauty shops: the merchant's name on the label is enough to flag a course of treatment. Always favour collection at a physical pharmacy or a pickup point, and check that the packaging is neutral.
- Medical equipment: a brace, a blood pressure monitor, a glucose meter are health data from the moment they're linked to your name. A upper-arm blood pressure monitor bought in a physical pharmacy, in cash, creates no row in any file.
- Books and politically engaged content: the purchase history of an online bookshop is an ideological profile.
- Connected devices: they create a second data stream after delivery. The issue is no longer the parcel, but the mandatory account that comes with it.
For payments, a virtual card with a single-use number — offered by several French banks and neobanks — stops the merchant from keeping a reusable identifier. And for pickup-point purchases at small shops, cash remains unbeatable.
Conclusion: three habits that change everything
You don't need to dismantle your life as a consumer. Three habits cover the essentials:
- Stop having things delivered to your door by default. Pickup point or locker for anything that isn't heavy or urgent. Your home address becomes information you choose to give out.
- A dedicated number and email for shopping. The commercial sphere stops touching the personal one, and leaks become traceable.
- Destroy labels, don't just bin them. The box goes out for recycling, the label goes into confetti.
The rest — access requests, cleaning up accounts, Bloctel — takes twice a year, one Saturday morning, an hour of your time. That's a small price for no longer shipping your address to ten companies a month, free of charge.
Key takeaway: you can't stop a parcel from existing. You can decide what it reveals.
