The Asos hack put it in sharp relief: when an online retailer gets breached, your date of birth walks out the door alongside your name, email, and address. Individually, a DOB is low-value intelligence. Combined with other leaked credentials, it becomes a verification key that lets criminals impersonate you to banks, help desks, and government agencies. Cybersecurity professionals are now saying plainly what the privacy-conscious have practiced for years — stop giving retailers your real birthday. The extraction pipeline is straightforward. A retail breach yields name, DOB, email, and address. That dataset gets enriched on the dark web with phone numbers, employment history, social media profiles, and credentials from other breaches. The result, as Datos Insights security expert Serpil Hall describes it, is an "enriched identity profile" — a dossier good enough to pass phone verification with your bank or trick a company help desk into handing over account access. The scam may not materialize for months or years after the original breach. Retailers have little incentive to stop collecting the data. Alexandre François of WhoisXML API surveyed 14 retailers and found eight — more than half — demanded a date of birth at sign-up. The reason is marketing, not security: a full DOB gives retailers precise age segmentation for targeting. The business value to the retailer outweighs the security cost to the consumer, a textbook misaligned-incentive problem. The practical advice from ESET's Jake Moore and François converges on a simple hierarchy. First, leave the birthday field blank if the form allows it. Second, if the field is mandatory, enter a fake but consistent date — François suggests the first of your birth month — so you can remember it for account recovery without exposing the real thing. Third, use a disposable email address for retail accounts so a breached address can be abandoned without disrupting your primary inbox. The only contexts that legitimately require your real DOB are those where it functions as an identity key checked against official records: banks, tax authorities, passport and driving licence agencies, right-to-work verification, police. A shop is not one of them. Age-restricted purchases like knives may require age verification, but that is a different and narrower ask than surrendering a full date of birth. The deeper structural problem is that consumers are conditioned to fill in every field on a form, treating mandatory and optional fields identically, while retailers design forms to maximize data collection with no obligation to minimize it. There is no regulatory requirement in most jurisdictions forcing retailers to justify why they need a DOB. Until that changes, the burden falls entirely on individuals to practice data hygiene — an asymmetry that benefits the data collectors and penalizes the uninformed. This is a small-scale example of a pervasive pattern: personal data flows upward to companies that monetize it, while the risks of breach flow downward to individuals who never consented to the exposure. The advice is sound — lie about your birthday online — but the fact that it is necessary at all reflects a system designed to extract personal information with minimal accountability.
