Here’s a fun thought experiment: imagine handing your home address to every stranger on the internet. Sounds insane, right? Well, if you’ve ever had a public Amazon Wish List — for a wedding registry, a baby shower, a classroom supply drive, or just because you wanted your friends to know what to get you for Christmas — Amazon recently made a change that could do exactly that. And they barely warned anyone.
What Actually Changed on March 25, 2026
On February 25, 2026, Amazon quietly sent an email to users who had public or shared Wish Lists with a delivery address on file. The message said that starting March 25, 2026, the company would remove the option to restrict Wish List purchases to items sold only by Amazon. That restriction had been a privacy guardrail most people didn’t even know existed — and now it’s gone.
Here’s why that matters. Previously, if someone bought you a gift from your public Wish List, and the item was sold and shipped by Amazon, your street address stayed hidden behind Amazon’s fulfillment system. Amazon handled the shipping. The buyer never saw where you lived. The most they could see was your name, city, and state.
Now, with third-party sellers in the mix, the rules change completely. When a third-party merchant ships an order, they receive your full delivery address. And that address can show up in shipping updates, tracking information, order confirmation emails — sometimes even proof-of-delivery photos. The person who bought the gift might see it too.
Amazon’s “Solution” Made People Even Angrier
Amazon’s response to the backlash was, to put it gently, tone-deaf. The company’s official recommendation? Get a P.O. Box. Or use a non-residential address. That advice landed like a brick. P.O. Boxes cost money — typically $20 to $40 per month depending on your location and size — and they’re not exactly convenient for receiving packages. Some don’t even accept deliveries from all carriers. Telling people to pay extra for the privilege of not being stalked through a feature you just changed was, predictably, not well received.
The other option Amazon suggested? Remove your shipping address from your Wish List entirely. Which, sure, works — but it also defeats the entire purpose of a Wish List. If someone buys you a gift and there’s no address attached, where’s it going? Nowhere. The whole point is that people can send you things without having to ask for your address directly.
Who Gets Hurt the Most
This isn’t just about people getting annoyed. For certain groups, this change is a genuine safety threat. Think about who actually uses public Amazon Wish Lists: Twitch streamers, YouTube creators, TikTok influencers, adult content creators, teachers asking for school supplies, animal rescues soliciting donations, homeless shelters, and mutual-aid organizers.
For sex workers, this is especially dangerous. A 2025 survey of online sex workers found that 34% of respondents had already been doxxed — meaning someone published their real identity or location online without their consent. Within camming communities, doxxing was so common it was treated as an “expected” hazard of the job. Amazon Wish Lists had been one of the few tools that let these workers accept gifts from fans while keeping their physical location private. That safety net just got yanked away.
Streamers face similar threats. In 2025, a group of teens robbed Twitch streamer Amouranth after she inadvertently revealed the value of her Bitcoin wallet — around $20 million. She ended up in the hospital. Near the anniversary of that attack, the Amazon policy change hit a raw nerve among fellow streamers, especially women, who know that an exposed address can quickly escalate into real-world danger. Streamer @webegga posted a warning to her community: “Don’t get doxxed, stay safe out there gamers.”
The Privacy Problem Is Deeper Than You Think
Here’s what makes this particularly frustrating: Amazon’s default privacy settings have been a known problem for years. When users create a Wish List, Amazon does not automatically set it to private. It doesn’t warn you that your address could be visible. It doesn’t prompt you to use a nickname instead of your full legal name. The privacy controls are buried in menus that most people never visit. You have to know the problem exists before you can fix it.
Privacy advocates have argued for years that platforms should default to the most restrictive settings possible and require users to opt in to sharing — not the other way around. The EU’s GDPR regulations have pushed companies in that direction across the Atlantic, but in the U.S., the regulatory framework is fragmented. There’s no federal equivalent forcing Amazon to change its defaults.
Aaron Engel, Chief Information Security Officer at ExpressVPN, put it bluntly: “Someone could purchase an item specifically to gain access to delivery information and potentially figure out where you live.” That’s not hypothetical. That’s how doxxing works. Someone with bad intentions doesn’t need to hack anything. They just need to buy a $10 item off your list.
Address Data Can’t Be Unseen
One of the scariest things about address exposure is that it’s permanent in a way most data leaks aren’t. You can change a password. You can get a new credit card number. But your home address? Moving isn’t something you do because of a screenshot. And once an address is out there, it spreads fast — through screenshots, data broker databases, public tracking histories, and even customer support logs.
Even well-meaning people can cause harm. A fan who buys a gift and then shares a delivery screenshot on social media — maybe to show off their generosity — just broadcast someone’s address to the world. Pew Research Center has found that online harassment remains widespread in the U.S., and address exposure is a common way that harassment escalates into real-world threats. The Federal Trade Commission has warned that contact information can be used for stalking, identity fraud, and social engineering.
What People Are Actually Doing About It
Many users have simply deleted their Amazon Wish Lists entirely. Reddit threads filled up with people saying they wiped everything rather than risk it. Others are migrating to alternative platforms. The most talked-about option is Throne, a creator-focused wishlist platform that promises to never share a user’s address with purchasers. On February 25, 2026 — the same day Amazon sent its email — Throne posted on X: “We’ll protect your privacy” alongside a padlock emoji. The company says their protections apply even to Amazon items imported into a Throne wishlist, meaning creators can still get the products they want without the risk. The tradeoff? Items may cost a bit more.
Privacy researchers have also suggested that Amazon could fix this with a token-based gifting system — a model where the buyer sends a gift without ever seeing the recipient’s address. Some smaller platforms already do this. Amazon hasn’t shown interest in adopting anything similar.
How to Protect Yourself Right Now
If you have an Amazon Wish List — even an old one you forgot about — go check your settings. Here’s the step-by-step fix, straight from Amazon’s help page:
Go to Account & Lists, select Your Lists, tap the three-dot icon on the list you want to change, and hit Manage List. From there, change the privacy setting to Private (only you can see it) or Shared (only people you choose can see it). Under the Shipping Address section, either switch to a P.O. Box or commercial address, or select “None” to remove the address entirely. Also check the name displayed on your list — swap your full legal name for a nickname or initials. And don’t forget old lists. That baby registry from 2019? It might still be public with your address attached.
Also, uncheck the “Third-Party delivery agreement” in your Manage List settings if it’s still visible. If that box is checked, you’ve given Amazon permission to send your address to any seller who fulfills an order from your list.
Amazon Stays Quiet While Users Scramble
As of early 2026, Amazon hasn’t publicly commented on the backlash. No press conference. No blog post. No update to the policy. The company’s help pages provide instructions for adjusting your settings, but there’s no warning during list creation that your address might become visible. Alex Andrews, an executive at a sex work advocacy group, summed it up well: “When major platforms change privacy protections without considering criminalization and stigma, they aren’t just changing a feature — they’re removing a safety tool.”
In 2024, Amazon received roughly 14.9 million account closure and data deletion requests. That number tells you something about how people feel about trusting the company with their personal information. Amazon framed this Wish List change as giving gift buyers access to a wider selection of items and sellers. But what they actually did was shift the burden of privacy entirely onto users — many of whom had no idea the risk existed until it was too late.
Your address isn’t like a password. You can’t just reset it. Treat it accordingly.
