Additional State-Specific Privacy Disclosures
Last Updated: June 28, 2024
This additional state-specific privacy disclosure page ("Disclosure") supplements the Amazon Privacy Notice and is effective as of June 28, 2024. The Amazon Privacy Notice describes the personal information that we collect, the sources from which we collect it, the purposes for which we use it, the limited circumstances under which we share personal information, and with whom we share it. These additional disclosures are required by certain state privacy laws, and provide a Notice at Collection under the California Privacy Rights Act:
- Categories of personal information collected. The personal information that Amazon collects, or has collected from consumers in
the twelve months prior to the effective date above, fall into the following categories
established by the California Privacy Rights Act and other state privacy laws, depending
on which Amazon Service is used:
- identifiers such as your name, alias, address, phone numbers, IP address, your Amazon account log-in information, or a government-issued identifier (such as a social security number, which may be required for tax purposes if you are a Seller, or an ID you provide for identity verification, which in some cases may reflect citizenship or immigration status);
- personal information, such as a credit card number or other payment information;
- information that may reveal age, gender or gender identity, race, sexual orientation, or other protected classifications, for example if you create a child profile, baby registry, or wedding registry, or if an author voluntarily self-identifies their racial or gender identity for cataloging purposes;
- commercial information, such as purchase and content streaming activity;
- internet or other electronic network activity information, including content interaction information, such as content downloads, streams, and playback details; the content of email and text messages, such as those you can send with Alexa or that are processed through Alexa's VIP Filter; or information used to prevent and detect fraud or other unauthorized activity, including informing customers if such activity were to affect them;
- biometric information that is used to identify you, such as your palm scan, if you choose to enroll in features that collect this information;
- geolocation data, such as the location of your device or computer, which may in some cases constitute precise geolocation information;
- audio or visual information, such as voice recordings when you speak to Alexa, or images and videos collected or stored in connection with Amazon Services;
- education information, such as information you provide through educational skills you link to your account through Alexa;
- professional information, for example data you may provide about your business if you are a Seller;
- inference data, such as information about your purchase preferences; and
- health data, such as if you provide your allergy information as part of your Alexa Emergency Assist subscription. Our Consumer Health Data Privacy Disclosure provides additional information about “Consumer Health Data” under certain state laws.
- Categories of personal information disclosed for a business purpose. The personal information that Amazon may have disclosed for a business purpose to
the third parties identified in the "Does Amazon Share Your Personal Information?"
section of the Amazon Privacy Notice in the twelve months prior to the effective date above falls into the following categories
established by the California Privacy Rights Act and other state privacy laws, depending
on which Amazon Service is used:
- identifiers such as your name, address, phone numbers, IP address, or government identifier, for example if we use a third-party carrier to deliver your order, or if we use a third-party service to verify your identity, certain types of ID you provide for identity verification, which may in some cases reflect your citizenship or immigration status;
- personal information, such as a credit card number or other payment information, for example if we use a third-party payment processor;
- information that may reveal age, gender or gender identity, race, sexual orientation, or other protected classifications, for example if you choose to participate in a survey distributed by a survey provider;
- commercial information, such as the details of a product or service you purchased if a third-party service provider assists in providing that product or service to you;
- internet or other electronic network activity information, such as if we use a service provider to help us gather crash reports for analyzing the health of our devices and services, or information relating to our prevention and detection of fraud or other unauthorized activity, which may require disclosing certain information about potentially affected customers to law enforcement;
- geolocation data, which may constitute precise geolocation data, such as providing a delivery partner the location of your garage in order to deliver a package if you use Amazon Key;
- audio or visual information, for example if a service provider reviews recordings of customer service phone calls for quality assurance purposes, or if we use a service provider to fulfill your order to print images from your Amazon Photos account;
- education information, for example coursework you may direct us to share with the operator of an educational Alexa skill;
- professional information, for example if we provide your account details to a service provider for verification as part of enrollment for an Amazon Business account;
- inference data, for example if we use a service provider to help us optimize the accuracy of your shipping address to make sure your order reaches you; and
- health data, for example if you pre-save your allergy information as part of your Alexa Emergency Assist subscription to be available for first responders via the Urgent Response feature.
- Advertising. As explained in the "What about Advertising?" section in the Amazon Privacy Notice,
Amazon shares limited information to help ensure you receive more useful and relevant
Amazon ads and to measure their effectiveness. Any personal information Amazon may
have shared for the purpose of cross-context behavioral advertising, as that term
is defined by the California Privacy Rights Act, in the twelve months prior to the
effective date above falls into the following categories:
- identifiers such as a cookie, a device identifier, or a code derived from applying irreversible cryptography to other information like an email address; we do not share your name or other information that directly identifies you with ad companies.
- internet or other electronic network activity information, such as whether you downloaded an app or other measures of ad effectiveness; for example, if you have already downloaded one of our apps, we will share an advertising identifier and data about that event so that you will not be served an ad to download the app again.
- inference data; while we do not share your specific shopping actions like purchases, product views, or searches with ad companies, we may share an advertising identifier and an estimate of the value of the ads they show you on our behalf so they can serve you with more effective Amazon ads.
- Children and Teens. As stated in the Amazon Privacy Notice, Amazon allows children or teens to use certain products or services, such as Amazon Kids, with parental involvement or permission. These products and services may collect data from children and teens who use them, and that data may be disclosed in a limited set of circumstances, such as if we use a service provider to help us gather crash reports for analyzing the health of our devices and services. We do not serve cross-context behavioral ads to children, or to teens under 18 years old unless they opt in.
- Your Data Rights: You may have certain data rights under state privacy laws, including to request information
about the collection of your personal information by Amazon, to access your personal
information in a portable format, and to correct or delete your personal information.
If you wish to do any of these things, please visit Data Privacy Queries, Request Your Personal Information, or contact Customer Service.
Additionally, you may have the right to opt out of the processing of your personal data for cross-context behavioral advertising (also referred to as targeted advertising under certain state privacy laws). To do so, please visit "Your Ads Privacy Choices", where you can opt out of cross-context behavioral advertising, or our Advertising Preferences page, where you can opt out of interest-based advertising. You can also enable the Global Privacy Control (GPC) on your browser to opt out of cross-context behavioral ads.
You may have the right to appeal the denial of any of these rights by submitting a form that will be provided to you if we deny a data request. Depending on your data choices, certain services may be limited or unavailable. To ensure the security of your Amazon account, we will generally ask you to verify your request using the contact information you have already provided. If you do not have an account, or if you are an authorized agent under applicable state law, visit here.
- No sale of personal information. In the twelve months prior to the effective date of this Disclosure, Amazon has not sold any personal information of consumers, as those terms are defined under the California Privacy Rights Act.
- De-identified Data Disclosure. Amazon may use de-identified data in some instances. Amazon either maintains such data without attempting to re-identify it or treats such data as personal data subject to applicable law.
- California Privacy Rights Act Sensitive Personal Information Disclosure. The categories of data that Amazon collects and discloses for a business purpose include "sensitive personal information" as defined under the California Privacy Rights Act. Amazon does not use or disclose sensitive personal information for any purpose not expressly permitted by the California Privacy Rights Act.
- California Privacy Rights Act Retention Disclosure. To enable your continued use of Amazon Services, we keep your personal information for as long as it is required in order to fulfill the relevant purposes described in the Amazon Privacy Notice, as permitted or as may be required by law, or as otherwise communicated to you. For example, we retain your transaction history so that you can review past purchases (and repeat orders if desired) and what addresses you have shipped orders to, and to improve the relevance of products and content we recommend.
- California Privacy Rights Act Non-discrimination Statement. Amazon will not discriminate against any consumer for exercising their rights under the California Privacy Rights Act.
- Colorado Privacy Act and Oregon Consumer Privacy Act Profiling Disclosure. Amazon does not engage in profiling of consumers in furtherance of automated decisions that produce legal or similarly significant effects, as those terms are defined under the Colorado Privacy Act or the Oregon Consumer Privacy Act.
- Oregon Consumer Privacy Act Controller Entity Disclosure. The controller entities that are subject to the Amazon Privacy Notice and this Disclosure include Amazon.com Services LLC, Amazon Advertising LLC, and Audible, Inc.
- Annual Reporting for 2023.
Access Requests. In 2023, Amazon received approximately 901,000 requests from Amazon.com customers to initiate the data access process. For approximately 485,000 of these customers, their request was not completed because the customer did not complete the verification process or canceled the request. The remaining approximately 416,000 requests were processed with a median return time of less than 1 day.
Deletion Requests. In 2023, Amazon received approximately 11.8 million requests from Amazon.com customers to initiate the account closure and data deletion process. For approximately 6.8 million of these customers, their request was not completed because the customer did not complete the verification process or canceled the request. The remaining approximately 5 million requests were processed with a median processing time of approximately 25 days.
Cross-Context Behavioral Advertising Opt-Out Requests. In 2023, Amazon received approximately 192.7 million cross-context behavioral advertising opt-out requests. The large majority of those requests are from visits to our website with GPC already enabled. All requests were processed with a median processing time of no more than 5 days.
Correction Requests. In 2023, Amazon did not receive any requests from Amazon.com customers to correct their data.
