A class action lawsuit filed in San Francisco federal court alleges Amazon secretly tracked and sold sensitive consumer data through mobile apps, raising new privacy concerns about the tech giant's data collection practices.
What happened
California resident Felix Kolotinsky discovered Amazon was collecting his personal data through the Speedtest by Ookla app on his phone. The lawsuit claims Amazon's advertising software development kit (SDK), embedded in tens of thousands of apps, created a "backdoor access" to consumers' devices without their knowledge or consent.
What's new
The collected data allegedly includes timestamped geolocation information that reveals where people live, work, and visit, potentially exposing sensitive details about their religious affiliations, sexual orientation, and medical conditions. The lawsuit claims users had no mechanism to opt out of this data collection.
Why it matters
This case joins a surge of litigation targeting companies' collection and sale of consumer location data. For domestic violence survivors and other at-risk populations, such detailed location tracking could pose serious safety risks. The lawsuit seeks damages and injunctive relief for California residents affected by these practices.
The big picture
This isn't Amazon's first privacy controversy. In 2023, the company paid a $25 million civil penalty for violating children's privacy through Alexa voice recordings. With over 200 million Prime subscribers worldwide, Amazon's data collection practices face increasing scrutiny from regulators and privacy advocates.
What they're saying
According to the lawsuit, "Amazon developed and disseminated a software development kit called the Amazon Ads SDK that enables backdoor access to consumers' devices and opens a direct data collection pipeline to Amazon and its advertising partners." The complaint alleges that "tens of thousands of app developers have embedded Amazon's Ads SDK into their mobile apps, allowing Amazon to siphon data from consumers."
Amazon has not yet responded to requests for comment about the allegations.
FAQs
What information does Amazon collect?
According to Amazon's privacy notice, the company may collect names, addresses, payment information, location data, device information, and even details about others residing at a customer's address.
How does an SDK work?
A Software Development Kit (SDK) is a package of tools that companies like Amazon provide to app developers to help them build applications. While SDKs make app development easier by providing ready-to-use features like advertising capabilities, they can also create a pathway for the SDK provider to collect data from anyone using apps containing their code.
What laws are allegedly being violated?
The lawsuit claims violations of the California Invasion of Privacy Act and the Comprehensive Computer Data Access and Fraud Act.
