MetaCity Sold Its "Verified Resident Address" Database — Collected From Users Who Entered Real-World Addresses for Physical Merchandise Delivery — to a Third-Party Data Broker Without User Consent or Notification

A data broker has begun offering a database of real-world residential addresses linked to MetaCity avatar usernames as a purchasable dataset. The dataset originates from MetaCity's Merchandise Delivery feature, which collects real physical addresses from users who purchase physical MetaCity-branded goods for delivery. MetaCity has confirmed it licensed the address data to the data broker as a 'standard data partnership.' The database contains approximately 2.1 million address records priced at $0.04 per record. Users who provided physical addresses for merchandise delivery were not notified of the sale and did not receive a specific consent prompt for third-party data sharing.

The gap between what MetaCity's terms of service technically permit and what users understood they were agreeing to when they entered their home address to receive a MetaCity-branded hoodie is the center of this story. Users engaging with the merchandise checkout flow were completing what appeared to be a standard e-commerce transaction — providing a shipping address so a physical product could be delivered to them. The mental model of that transaction does not include: this address will be indexed by your avatar username, combined with behavioral data about your platform activity, and licensed to a commercial data broker who will sell it to any purchaser at four cents per record. MetaCity's position is that the terms of service discloses data sharing with business partners. The question regulators and consumer advocates are now asking is whether a general data-sharing clause buried in a platform agreement constitutes meaningful consent for the sale of home addresses to a commercial intelligence broker.

The "MetaCity Verified Resident Profiles" branding used by the data broker is worth examining in its own right. The dataset is described in the broker's product listing as verified — meaning the addresses have been confirmed as accurate through the merchandise delivery process, not merely self-reported. The avatar username linkage means each record connects a real-world location to a known online identity. The behavioral dimension, if the broker has appended additional MetaCity activity data to the address records, would make these profiles substantially more valuable — and substantially more sensitive — than a bare address list. The broker's product listing does not specify whether behavioral enrichment was included in the licensed dataset. MetaCity has not addressed what data fields were included in the sale beyond confirming the partnership exists.

The Address Was for a Hoodie. The Hoodie Was Delivered. The Address Was Then Sold.

The regulatory exposure for this sale is significant in jurisdictions with specific protections for home address data or that require explicit consent for third-party commercial data sharing. MetaCity operates in multiple jurisdictions with varying data protection frameworks, and a general TOS clause permitting business partner data sharing does not universally satisfy the explicit consent requirements those frameworks impose. At least four consumer protection bodies have been notified of the sale by digital rights organizations that reviewed the data broker's product listing. MetaCity has not stated whether it conducted a legal review of the data sale against applicable regulations in each jurisdiction where address data was collected, or whether users in specific jurisdictions were excluded from the licensed dataset on regulatory grounds.