D
Verdict
EXHIBIT A
Amazon.
"we don't sell your data" (we just rent the hash of it).
Amazon swears it's "not in the business of selling" your data §4.1 — then hands ad companies a hashed email and an estimate of how much your eyeballs are worth §6.2. Your shopping, voice clips, Wi-Fi credentials, and in-store camera footage §2.2 all feed the recommendation flywheel. You can request deletion, but only where required by applicable law §9.1, and turning off cookies breaks your cart on purpose §8.3. Children's data? They "don't knowingly" collect it §10. Acquisition? Your file is a transferred business asset §4.3.
E-commerce / Cloud / Devices
Analyzed: 2026-05-23
§2 · The short version
TL;DR — 8 answers.
The eight things you actually want to know, at a glance.
TL;DR — 8 answers D
~ Do they sell your data?
YES Are they tracking you on other sites?
YES Can your data train their AI?
~ Who can see what you do?
~ Can you delete everything?
~ Do they honor your opt-out?
~ Special handling for minors?
YES Been fined for this before?
§3 · The details
The questions, answered.
No legalese. Every answer the way your most cynical friend would put it.
COND.
§6.2 Do they sell your data?
They say no. Then they share a hashed email and your estimated ad-value with ad companies. CCPA calls that "sharing." English calls it selling.
YES
§2.2 Are they tracking you on other sites?
Cookies and identifiers "on devices, applications, and our web pages" — plus partner sites running Amazon ad tech.
YES
§3.4 Can your data train their AI?
Voice clips, images, and "other personal information" feed Alexa and Amazon's models. No opt-out is offered in this notice.
COND.
§4.1 Who can see what you do?
Subsidiaries, third-party sellers in your transactions, service providers, ad companies, credit bureaus, law enforcement — and a future acquirer.
COND.
§9.1 Can you delete everything?
Only "to the extent required by applicable law." Updating info? They keep the old version too.
COND.
§8.3 Do they honor your opt-out?
You can opt out of personalized ads. But block cookies and your cart literally stops working — by design.
COND.
§10 Special handling for minors?
Under 13: not "knowingly" collected. 13–17: must have a parent involved — enforced by the honor system.
YES
§12 Been fined for this before?
€746M GDPR fine (Luxembourg, 2021). $25M FTC settlement for Alexa kids' voice retention (2023). $5.8M FTC settlement for Ring (2023).
§3 · The privacy card
At a glance, honestly.
Eight signals, color-coded. Like a model card for a machine — except the machine is reading your data.
Privacy Card · Amazon · Analyzed 2026-05-23
D
Data sold / shared YES MIXED
Cross-site tracking YES BAD
AI training YES opt-out: unavailable
Deletion right LIMIT. MIXED
GPC honored NO BAD
Keeps forever? YES BAD
Child protections COND. MIXED
Automated decisions YES human review: no
Collects
Identifiers, Location, Browsing History, Search & Purchase History, Contact Info +5 more
Shares with
Third-party advertisers, Third-party service providers, Co-branded business partners, Acquirers (business transfers) +1 more
§5 · The label they should have shown you
The Privacy Label, honestly.
An Apple-style label for what's collected and a Cranor-style back-of-pack for what they do with it. Every cell links to the exact line in their policy.
AMAZON — DATA COLLECTED
PER APPLE PRIVACY-LABEL TAXONOMY ↗
● USED TO TRACK YOU
Data shared with third parties for cross-property tracking.
Identifiers §2.2
IP address · Device identifiers · Advertising identifier · Cookies · Login + email + password
Location §2.3
Device location · In-store location via cameras and sensors
Browsing History §11.2
Full URL clickstream to, through, and from Amazon · Page interactions (scrolls, clicks, mouse-overs)
◐ LINKED TO YOU
Tied to your identity and stored against your account.
Search & Purchase History §11.2
Searches · Product views · Complete order history · Content streaming and playback details
Contact Info §11.1
Name · Address book · Phone numbers · Phone numbers used to call customer service · Email addresses of your friends
Voice & Biometric-ish §11.1
Voice recordings when you speak to Alexa · Images and videos in Amazon Services
Government ID §11.1
Social Security number · Driver's license number · Identity documents (sellers)
Financial §11.3
Payment card info · Bank account (sellers) · Credit history from credit bureaus · Corporate and financial information
Device & Network §11.2
Device log files · Wi-Fi credentials (if you sync them) · ISP details · Application usage · Crash data
Physical-World Surveillance §2.3
In-store camera footage · Computer vision · Sensor data from physical stores
○ NOT LINKED TO YOU
Aggregated, supposedly anonymous.
Other Data
— none claimed —
↓ BACK OF LABEL · WHAT THEY DO WITH IT (CRANOR FRAMEWORK)
Purposes
Order fulfillment & payment, Recommendations & personalization, Interest-based advertising, Voice, image, and camera services (Alexa), Fraud prevention & credit scoring, Service improvement / analytics. §3.1
6+ stated purposes. The interesting ones are buried in §7.
Sold or shared?
Yes. Third-party advertisers, Third-party service providers, Co-branded business partners, Acquirers (business transfers), Law enforcement / governments. §4.1
"We don't sell data" is technically true and substantively false.
Retention
Indefinite, with caveats. §7.1
No defined retention period. Amazon "usually keep[s] a copy of the prior version for our records" when you update info; the current Privacy Notice "applies to all information that we have about you and your account."
User controls
Deletion: Limited · Opt-out: Limited §9.1
Delete works. Opting out of inference does not exist.
Automated decisions
Yes. No human review. §3.5
Credit risk scoring · Fraud detection · Personalized recommendations · Ad targeting. All algorithmic.
Children's data
Under 13 blocked · 13–17 limited §8
Ad targeting paused for teens, but content profile still kept.
Breach disclosure
"As required by law." §15.3
Translation: the bare minimum legal window in your jurisdiction.
§5 · The receipts
The receipts, translated.
Five of the worst clauses, lifted verbatim. Strikethroughs are theirs. Marginalia is ours.
AMAZON PRIVACY NOTICE · Does Amazon Share Your Personal Information? §4.1
Information about our customers is an important part of our business, and we are not in the business of selling our customers' personal information to others. they're in the business of sharing the hash. We share customers' personal information only as described below the "below" is a four-bucket grocery list of recipients and with subsidiaries Amazon.com, Inc. controls that either are subject to this Privacy Notice or follow practices at least as protective as those described in this Privacy Notice. "at least as protective" = self-graded TECHNICALLY NOT SELLING
AMAZON PRIVACY NOTICE · What About Advertising? §6.2
We provide ad companies with information that allows them to serve you with more useful and relevant Amazon ads and to measure their effectiveness. "more useful" = more profitable We never share your name or other information that directly identifies you when we do this. "directly" doing a lot of work here Instead, we use an advertising identifier like a cookie, a device identifier, or a code derived from applying irreversible cryptography to other information like an email address. i.e., your hashed email. still you. HASH ≠ ANONYMOUS
AMAZON PRIVACY NOTICE · Business Transfers §4.3
As we continue to develop our business, we might sell or buy other businesses or services. In such transactions, customer information generally is one of the transferred business assets you are inventory. but remains subject to the promises made in any pre-existing Privacy Notice until they quietly update the notice USER = ASSET
AMAZON PRIVACY NOTICE · What Choices Do I Have? §8.3
Because cookies and identifiers allow you to take advantage of some essential features of Amazon Services, we recommend that you leave them turned on. we recommend you don't try For instance, if you block or otherwise reject our cookies, you will not be able to add items to your Shopping Cart, proceed to Checkout, or use any Services that require you to Sign in. "tracking is essential" — to us OPT-OUT = NO CART
AMAZON PRIVACY NOTICE · Intro §1
By using Amazon Services, you are consenting to the practices described in this Privacy Notice. "using" = clicking a product link once FORCED CONSENT
§6 · The deceptive design
Dark patterns spotted.
Tricks the policy and surrounding UX use to make you "consent" without really consenting.
Merely using Amazon Services counts as agreement. The only "no" is to log off the largest store on earth.
"By using Amazon Services, you are consenting to the practices described in this Privacy Notice.
Front of the notice: not selling. Four pages later: sharing your hashed email and ad-value estimate with ad companies. Same thing, different verb.
"we may share an advertising identifier and an estimate of the value of the ads they show you on our behalf so they can serve you with more effective Amazon ads
Reject cookies and the cart breaks. "Privacy or shopping" is presented as the only choice.
"if you block or otherwise reject our cookies, you will not be able to add items to your Shopping Cart, proceed to Checkout, or use any Services that require you to Sign in.
If Amazon is sold or restructured, your file ships with the box.
"In such transactions, customer information generally is one of the transferred business assets
Deletion and access are framed as favors, available only "to the extent required by applicable law" — i.e., not if you live somewhere with weak privacy law.
"you may have the right to request access to or delete your personal information
Opting out of personalized ads ships you to a separate "Your Ads Privacy Choices" surface. Opting out further requires updating settings on "the applicable Amazon website" — of which there are many.
"You will also be able to opt out of certain other types of data usage by updating your settings on the applicable Amazon website
§7 · What you can actually do
Your rights, by where you live.
Same company, wildly different rights depending on your jurisdiction. Direct links to the specific opt-out / delete / access flows.
EU (GDPR)
DIFFICULTY: MEDIUM
- ✓ Right of access
- ✓ Right to erasure
- ✓ Right to data portability
- ✓ Right to object to processing
- ✓ Right to lodge a complaint with a supervisory authority
Source: §13
§8 · Receipts
The actual sources.
Every claim above is anchored to a line in the policy we analyzed. Click any section ID to view it in context.
ANALYZED BY: claude (via Claude Code sub-agent) ·
PROMPT VERSION: honest-policy-v1.4-subagent ·
ANALYZED AT: 2026-05-23T17:05:00Z
SOURCE: https://www.amazon.com/gp/help/customer/display.html?nodeId=GX7NJQ4ZB8MHFRNJ · POLICY VERSION: 2025-12-31 · SNAPSHOT HASH: manual-pdf
SOURCE: https://www.amazon.com/gp/help/customer/display.html?nodeId=GX7NJQ4ZB8MHFRNJ · POLICY VERSION: 2025-12-31 · SNAPSHOT HASH: manual-pdf
- §1Intro — Consent by use"By using Amazon Services, you are consenting to the practices described in this Privacy Notice."
- §2.2What Personal Information About Customers Does Amazon Collect? — Automatic Information"We automatically collect and store certain types of information about your use of Amazon Services"
- §2.3What Personal Information About Customers Does Amazon Collect? — Physical stores"Our physical stores may use cameras, computer vision, sensors, and other technology to gather information about your activity in the store"
- §3.1For What Purposes Does Amazon Use Your Personal Information? — Operate & improve"We use your personal information to operate, provide, develop, and improve the products and services that we offer our customers."
- §3.2For What Purposes Does Amazon Use Your Personal Information? — Recommendations"We use your personal information to recommend features, products, and services that might be of interest to you"
- §3.3For What Purposes Does Amazon Use Your Personal Information? — Advertising"We use your personal information to display interest-based ads for features, products, and services that might be of interest to you."
- §3.4For What Purposes Does Amazon Use Your Personal Information? — Voice/image/camera (Alexa)"we use your voice input, images, videos, and other personal information to respond to your requests, provide the requested service to you, and improve our services"
- §3.5For What Purposes Does Amazon Use Your Personal Information? — Fraud & credit scoring"We may also use scoring methods to assess and manage credit risks."
- §4.1Does Amazon Share Your Personal Information? — "Not in the business of selling""Information about our customers is an important part of our business, and we are not in the business of selling our customers' personal information to others."
- §4.2Does Amazon Share Your Personal Information? — Service providers"These third-party service providers have access to personal information needed to perform their functions, but may not use it for other purposes."
- §4.3Does Amazon Share Your Personal Information? — Business transfers"In such transactions, customer information generally is one of the transferred business assets"
- §4.4Does Amazon Share Your Personal Information? — Law enforcement"We release account and other personal information when we believe release is appropriate"
- §6.1What About Advertising? — Third-party ads & links"Third-party advertising partners may collect information about you when you interact with their content, advertising, and services."
- §6.2What About Advertising? — Hashed-email sharing with ad companies"we use an advertising identifier like a cookie, a device identifier, or a code derived from applying irreversible cryptography to other information like an email address"
- §7.1What Choices Do I Have? — Retention of prior versions"When you update information, we usually keep a copy of the prior version for our records."
- §8.2What Choices Do I Have? — Per-site setting opt-out"You will also be able to opt out of certain other types of data usage by updating your settings on the applicable Amazon website"
- §8.3What Choices Do I Have? — Reject cookies = broken cart"if you block or otherwise reject our cookies, you will not be able to add items to your Shopping Cart, proceed to Checkout, or use any Services that require you to Sign in."
- §9.1What Choices Do I Have? — Access/deletion to extent required by law"you may have the right to request access to or delete your personal information"
- §9.2What Choices Do I Have? — Service degradation on opt-out"Depending on your data choices, certain services may be limited or unavailable."
- §10Are Children Allowed to Use Amazon Services?"We do not knowingly collect personal information from children under the age of 13 without the consent"
- §11.1Examples of Information Collected — Information You Give Us"information and documents regarding identity, including Social Security and driver"
- §11.2Examples of Information Collected — Automatic Information"the full Uniform Resource Locator (URL) clickstream to, through, and from our websites"
- §11.3Examples of Information Collected — Information from Other Sources"credit history information from credit bureaus"
- §12Conditions of Use, Notices, and Revisions"will never materially change our policies and practices to make them less protective of customer information collected in the past without the consent of affected customers."
- §13EU-US Data Privacy Framework, UK Extension, and Swiss-US Data Privacy Framework"Amazon.com, Inc. participates in the EU-US Data Privacy Framework"