Every Web site gets your IP address. The Net couldn't work otherwise, since each request has to include an address to which the response is sent.

IP addresses are assigned in blocks to ISPs, and there are databases that cross-reference those blocks to the territory served by ISPs; it's called "IP geolocation", and works with about 90% accuracy.

With the latitude and longitude of the IP address, you can consult a ZIP code database to determine the probable ZIP that probably matches the IP. There's some undertainty, because the territories are irregular and the databases usually just store the centroid and average radius.

So, a Web site can derive your location, including ZIP, from your IP address. You mentioned that it worked when you "threw in my real data", but which data? I'm thinking that it worked because your ZIP matched your IP, and the birthdate is irrelevant.

But then I played with it for a while, and I agree, it's spooky.

1) It really does seem to match names to birthdays; probably multiple-choice behind the scenes, what with duplicate names, and the one you enter has to show up somewhere on the list. I used "George Bush", DOB July 6, 1946, and it choked if any one component of the birthday was off.

2) Made-up names like "Hclywynia Bordlzwiechz" fail. If the system can't match the name, it doesn't give you a pass by default.

3) Common names like "John Smith" are statistically certain to work on any birthdate.

4) It's using IP geolocation to get a probable latitude/longitude, then consulting a ZIP code database. ZIP code boundaries are irregular and the databases specify only a centroid and average radius, leading to a lot of uncertainty in the match. To accomodate it, they use only the first digit. Being in California my ZIP has to begin with "9", and that's the only digit I had to match (I used an LA ZIP code and got in). The actual ZIP code of the White House didn't work with "George Bush".

All in all, I agree it's creepy, yet it's comprehensible and doesn't require any "spooky" technology. IP geolocation is freely available ( see http://www.geobytes.com/IpLocator.htm?GetLocation), as are public records databases with basic info. They don't have to get an accurate match in the sense of actually identifying you, they just have to get a plausible approximate match on name/birthday and IP/ZIP code. It works sufficiently well to pull off as a publicity stunt and successfully generate buzz--here we are, playing along!--but it's not a substantive invasion of privacy.