Recent Developments: Amazon is currently facing a class action lawsuit for allegedly collecting and selling sensitive location data from millions of California residents through its Amazon Ads software development kit. This case underscores the growing concerns surrounding data privacy and the use of SDKs in mobile applications.
The lawsuit, filed in US District Court by Felix Kolotinsky of San Mateo, California, accuses Amazon of obtaining “backdoor access” to consumers’ devices by distributing the Amazon Ads SDK to numerous mobile app developers who then incorporated it into their applications. This software reportedly allowed Amazon to gather extensive timestamped geolocation data without users’ knowledge or consent. Kolotinsky claims that Amazon accessed his personal data through the “Speedtest by Ookla” app.
The complaint alleges that the collected data exposed details about consumers’ living, working, shopping, and visiting habits, potentially revealing sensitive information such as religious affiliations, sexual orientations, and medical conditions. It is further claimed that Amazon utilized this data to create detailed consumer profiles for advertising purposes, which is in violation of California’s penal code and state laws against unauthorized computer access.
This case is part of a broader trend of legal actions against tech companies and data brokers concerning the usage of geolocation data and SDKs.
In a similar vein, Texas recently sued insurance provider Allstate for allegedly tracking drivers through cell phones using SDKs, using the data to set insurance premiums and sell information to other insurers. Another class action lawsuit in 2024 accused Twilio’s SDK of secretly collecting sensitive data from consumers in violation of multiple statutes.
This is not the first time Amazon has been embroiled in privacy controversies. In 2020, the company terminated several employees for sharing sensitive customer data with third parties, including email addresses and phone numbers.
In June 2023, Amazon agreed to pay $31 million in penalties to settle privacy violations related to its Alexa voice assistant and Ring doorbell cameras. The lawsuit alleged that the company stored children’s voice recordings indefinitely and used them to enhance its Alexa algorithm, contravening the Children’s Online Privacy Protection Act.
Amazon has yet to respond to these latest allegations. The lawsuit, Kolotinsky v. Amazon.com Inc., seeks damages for millions of California residents and calls for injunctive relief to cease the unlawful data collection.
