What Amazon does with your data

What it collects and does with your data

• Privacy notice states Amazon is 'not in the business of selling our customers' personal information to others' and lists four sharing categories: third-party transactions, service providers, business transfers, and protection of Amazon and others.
• Privacy notice says Amazon physical stores 'may use cameras, computer vision, sensors, and other technology to gather information about your activity in the store.'
• Privacy notice says Amazon uses personal data to develop or deploy its generative AI models and services.
• 10-K reports advertising services revenue of $68.635B in 2025, up from $56.214B in 2024; ads are sold on a per-click or per-impression basis.

Sensitive data

• in-store cameras and computer vision (Just Walk Out)
• voice recordings (Alexa)
• children's voice and geolocation data (per FTC COPPA complaint)
• home video (Ring)
• precise location (alleged SDK collection, pending suit)
• payment
• health (Amazon Pharmacy, One Medical; not researched in detail)

Enforcement and litigation

5 matters in the research. Where the research says alleged, pending, or settled without admitting wrongdoing, so does this page.

• FTC v. Amazon (ROSCA): FTC alleged Amazon used dark patterns to enroll consumers in Prime and obstructed cancellation. Settled: $1B civil penalty plus $1.5B in customer refunds. Amount: $2.5 billion.
• DOJ/FTC COPPA action over Alexa retention of children's voice and geolocation data. Settled with $25M civil penalty. Amount: $25 million.
• FTC action against Ring over employee and contractor access to customer videos. Settled for $5.8M. Amount: $5.8 million.
• Maxwell v. Amazon.com, Inc. and Amazon Advertising LLC (W.D. Wash. 2:25-cv-261): first class action under Washington's My Health My Data Act, alleging Amazon SDKs in third-party apps collected location data without consent. Pending as of last report found.
• Illinois BIPA class actions (Wilcosky, Hogan, others) alleging biometric collection via Amazon Photos, Alexa, Amazon Connect, virtual try-on, and Just Walk Out. Amazon disputes the allegations; pending per 10-K.

Who else holds your data

Organizations holding a copy of your data, as the research counts them: at least 5. Lower bound: Amazon plus its four disclosed sharing categories, each counted as at least one organization. Advertisers reach you through Amazon Ads and Amazon Marketing Cloud without receiving the raw record, so they are not counted.

Third parties: 4 disclosed recipient categories. Four sharing categories in the main notice. Separate state-specific and consumer health data disclosures exist and were not parsed.

Data brokers linked to Amazon

None. The research documents no flow between Amazon and a data broker.

Data practices score

14 of 15. Five components, each 0 to 3. How the score works

Sells or shares

2

Enforcement

3

Retail media scale

3

Sensitive data

3

Opt-out friction

3

Estimated emissions for one person

Research gaps

• Amazon does not disclose Prime membership; denominator is a CIRP estimate of US users.
• No measured email frequency study found for Amazon.
• State-specific privacy disclosures and Consumer Health Data Privacy Disclosure not parsed.
• No verified primary-source Amazon CPM.