Assembly Bill 161 and the big privacy issue with e-receipt solutions

With invoices and receipts being legal documents, end-to-end encryption may be the only possible method that serves the privacy requirements when digitizing receipts.

The fact that Assembly Bill 161 (the bill to ban paper receipts) was rejected by Californian lawmakers on the basis that banning them would cause privacy concerns has been some fantastic news for some reasons but most importantly, due to the fact that it shows that existing receipt digitization solutions may not have solved any problems after all; they may have simply created new ones.

There are numerous studies on the barriers of digital receipts, most recently, citing the following barriers:

1. Retailer resistance against sharing sales data (which could lead to vulnerabilities for some)
2. End user privacy
3. Lack of infrastructure and standardization

In fact, this is exactly what we observed in early design thinking stages behind our venture Xiippy.ai as well. In reality, items 1 and 2 were the only reasons why despite complexities, we decided to add end-to-end encryption to our product suite hence making it possible to own a receipt delivery platform that maintains zero knowledge of the contents of the delivered receipts.

We believe item 3 is a serious problem too, however, mostly due to scattered attempts at solving the problem without respecting previous standardization attempts.

Universal Business Language already includes universal data models and schema for invoice and receipt advice that could have been the common language of speaking invoices and receipts between systems.

Without inventing the wheel, this is what we have done at https://Xiippy.ai which is to align all our data models to this universal schema for easier adaptability and integration opportunists.

There have been many many attempts at solving the paper receipts problems that can be categorized into the following groups:

1. Those who thought it is as easy as texting or emailing PDF e-receipts

This group, mostly giant retailers, transformed the big problem into a simple one to gain an important advantage: to get the customer to identify themselves to the retailer. Now, all of us know, once you provide your email or phone number, you will be reached out for unsolicited “deals”. And good luck unsubscribing. That said, the deals may be all good for some! Now, let us ignore the fact of publicizing your personal details to a stranger at the cashier (or to other people around at the time).

But what about the fact that receipts will be distributed in multiple mail boxes or text messages? Not so good! This leads to the need of having all receipts in one easy to access place, not 200! This promotes the idea of centralized collection of receipts.

Moreover, e-receipts are just a bunch of text and image. It is itemized receipts that follow a data model in which each item has its own identity for a much deeper level of analyzability that you don’t get with e-receipts.

Apart from receipt digitization, the Jobs To Be Done for these businesses is in fact to identify an anonymous customer which Xiippy.ai already makes possible without the need to get consumers’ details and email addresses.

2. Those who have not gotten the underlying motives of the retailers

Among those who act as a centralized receipt wrapper, this group thought they had a solution but their solution was never solving the underlying problem with receipt digitization, which is what we call ‘opposing interests’ between both ends of the receipt generation and consumption processes.

Whilst some businesses may want to be socially responsible by saving tress and the environment and adopting digital receipts by absorbing costs of inefficient and expensive solutions the intake of which requires massive changes made to point of sale systems, majority of businesses, especially small ones, have a deeper level of interest in turning the hand-over of a receipt into the start of a relationship with customers and be able to bring them back into the store again.

To this group, the idea that digital receipts are ‘good’ experience and save the environment may not establish enough reasons for the retailer to go through the pain of changing point-of-sale systems or adopting new ones or even integrating with 3rd party systems.

In a double-sided market, it is the paying customer that makes or breaks even though the end users may set the final tone after the initial release.

Effectively, a receipt digitization solution that can not fulfill the needs of its main paying customer (i.e. the retailer) can not succeed and this group can not escape this fate.

3. Those who have never scaled despite massive backing by banks

This group is the most interesting of all, thinking they have solved the solution but in deed, they may have created some new ones along the way, which Xiippy.ai has now solved.

Firstly, receipts are legal documents between a seller and a buyer and banks have nothing to do with them unless someone makes them a bank’s business. Banks already have the data on who is buying from where and what is missing for them is the detailed itemized list which they would appreciate to own despite the fact that legally, they can not use the data for credit checking. In fact, it may be an exposure point for banks to maintain and handle such private information, affecting the risk profile of their entire ICT landscape.

Simply imagine a data breach led to your entire purchase history (which may include medication lists and all other details) being publicized. The consequences could be big for both individuals and the potential bank(s) involved.

Secondly, these players must have also realized that only receipt digitization is not enough for a retailer to lend their sales data (and in fact their customer data) to 3rd parties. In other words, such a problem (paper receipts) for a retailer is non-existent. They simply can email or text invoices if they did want to do so. As a result, these players have turned into becoming an accessory to banks’ desires to own itemized purchase histories. So their whole attention and solution has been focused on solving a ‘job to be done’ for banks, not the retailers, not the people: to have everyone’s purchase history available to the banks.

These solutions are as easy as saying “let’s have some APIs and SDKs, get retailers to integrate and pass receipts to us, and then at later stages, get someone who has a mapping between payments to identities, to come and pick the right receipt to show them to the right user, say in an internet banking system”.

The bit that is missed in this scenario is the naive view that the receipt digitization party must, out of the box, out of the blue, be viewed as a saint to be trusted by all parties involved since they simply deserve the trust.

The question to ask, however, is “why”. Why should the retailer and their customers, all of a sudden, put all their trust into an intermediary to solve their receipt issues. So far, we have a paper receipt problem. If we adopt these solutions, we will end up with a big privacy problem on top of the other issues. All the GDPR and CCPA buzz has a philosophy behind it.

Point is that the retailers can not simply show the user a quickly-disappearing note that ‘We’re gonna share your business with us with our receipt partner who would have to do share it with your bank . Check this checkbox so we remain complaint to GDPR and CCPA.’

Quite simply put people don’t always buy potatoes and soft drinks. There are things we buy that can literally make us uninsurable, or unlendable, or unemployable! Who deserves such a high level of trust to know all these things about you? Imagine there is one who really deserves the trust to own all your passwords with the idea that they won’t look into your inbox. What if their systems get compromised despite their attempts to be trustworthy. Can you afford that? The answer is simply NO.

This is effectively why the bill to ban paper receipts in California (Bill 161) got rejected for: simply because no solution in the market has solved the underlying privacy problem associated with receipt digitization, not anymore though!

Xiippy also makes receipts available in banking and accounting apps and systems but with assurance that no one, not even we ourselves, can access businesses’ sales data and end users’ purchase history. If a bank, committed to GDPR and CCPA and similar legislations, and with intent transparency, have the true intention of only making receipts available to their customers via internet banking systems and apps, they should have no problems with the concept of zero-knowledge receipt delivery.

And if the argument is ‘the data is used to create custom offers for customers’ benefits’, we, at Xiippy, have also made the very same exact outcome possible via decentralization of purchase history and our patented zero-knowledge marketing and loyalty management scheme, which is a world’s first concept.

4. Those who want to simulate all private aspects of paper receipts

Let’s be realistic: there is no other way to solve the paper receipts problem except for simulating how paper receipts are delivered: ‘completely private and even anonymous’. So you walk into a shop, buy things, and without identifying yourself, you get your receipt and walk away. Your bank may know you have had a transaction with the retailer but would not have a way of knowing what the contents of the transaction are. If you use cash, you will be completely private, electronically.

Now, to match this level of privacy and anonymity, there is only one way to transfer receipts: the end-to-end encrypted way, and that is what Xiippy’s multi-patented product suite does.

According to Kano, delightful features become ‘basic requirements’ when time passes by. End-to-end encryption in receipt digitization may well be a delightful feature now but a time will come at which it will have turned into a ‘necessary requirement’, just like end-to-end encryption has been to ‘text messaging’. In 2020, as a text messenger, you either do end-to-end encryption or you don’t even exist, no matter if you are a giant like Facebook, Google or Microsoft; end-to-end encryption has officially become a basic need with text messaging!

The Xiippy Team