It’s more than that, at least from a EU perspective. Don’t know what is legal in the US, but manipulating URLs in an obviously malicious way and without the user’s explicit knowledge and consent would be highly illegal here.
As far as I know they steal cookies but don’t change the URL.
Also, I think the bizarre market practice of “last click takes attribution” seems to be also common in EU.
Unfortunately just because it’s shady doesn’t make it immediately illegal even here in EU.
And the response from PayPal Honey shows they want to fight it in court. Which don’t think they would do if they thought it would have been considered highly illegal.
They found a loophole and abused it to steal creators (and users).
I just checked the original video. It works a little bit differently than plain URL replacement. They open another tab in the background and then send a manipulated URL to get the affiliate cookie set to their own. Guess it’s for the courts to decide if that is a legal practice or not. But to me it seems that the malicious extension sends a manipulated URL to the server pretending to do that on user’s behalf, without his knowledge. That is classic malware behavior.
Among other accusations, MegaLag said that if a YouTuber or other creator promotes a product through an affiliate link, if the viewer has installed Honey, the extension will surreptitiously substitute its own link when the viewer makes a purchase — even if Honey didn’t provide any discounts. That means Honey, not the creator, receives the affiliate revenue for the transaction.<<
It’s more than that, at least from a EU perspective. Don’t know what is legal in the US, but manipulating URLs in an obviously malicious way and without the user’s explicit knowledge and consent would be highly illegal here.
Are they modifying URLs?
As far as I know they steal cookies but don’t change the URL.
Also, I think the bizarre market practice of “last click takes attribution” seems to be also common in EU.
Unfortunately just because it’s shady doesn’t make it immediately illegal even here in EU.
And the response from PayPal Honey shows they want to fight it in court. Which don’t think they would do if they thought it would have been considered highly illegal.
They found a loophole and abused it to steal creators (and users).
I just checked the original video. It works a little bit differently than plain URL replacement. They open another tab in the background and then send a manipulated URL to get the affiliate cookie set to their own. Guess it’s for the courts to decide if that is a legal practice or not. But to me it seems that the malicious extension sends a manipulated URL to the server pretending to do that on user’s behalf, without his knowledge. That is classic malware behavior.
https://youtu.be/vc4yL3YTwWk?t=281