Privacy Group Seeks Amazon Audit After FTC Findings

Privacy group Junkbusters yesterday asked the Federal Trade Commission to audit Amazon's privacy practices after the agency declined to act on a finding that the online retailer probably made deceptive statements.

In a letter dated May 25, the FTC said Seattle-based Amazon and its Alexa Internet subsidiary probably acted deceptively by collecting personal identifying data from customers in violation of their privacy policy, which claimed that information kept for tracking purposes was anonymous.

However, the agency decided not to take legal action against Amazon and its subsidiary.

The allegations stemmed from Alexa's zBubbles Web navigation service, which recorded Web addresses that users visited. Richard Smith, chief technology officer at the Privacy Foundation, complained to Amazon in 1999 that URLs sometimes contain user-identifiable information, such as e-mail addresses, and that the collection of such information should be prevented.

In early May, Amazon settled a class-action lawsuit stemming from the situation for less than $1.9 million — up to $40 for each member of the lawsuit — and agreed to delete some user-identifiable information.

In its letter, the FTC stated that the lawsuit had been settled and that zBubbles was no longer in service. The FTC also stated that Amazon and Alexa later adjusted their privacy policies to accurately reflect the information that was being collected.

Junkbusters president Jason Catlett called the FTC's actions inadequate. In a letter to new FTC chairman Timothy Muris, who replaces Robert Pitofsky June 1, Catlett urged the FTC to have an independent third-party auditor determine whether Amazon had violated its privacy policy at other times in the past.

Catlett also called for Amazon to make personal information available to customers and to allow deletions upon request.

“I think it's necessary to do this,” Catlett said. “We can't take Amazon's word.”

An Amazon spokesman referred questions to Alexa founder/CEO Brewster Kahle. Kahle said he was unaware of Catlett's proposal and that he considered the matter closed.

Kahle said he was happy with the FTC findings and that his company had never used any user-identifying information collected. He said there is no existing standard to separate user-identifying information out of a URL.

“If there were, we'd love it,” Kahle said. “We don't use [the data] and don't want it.”

Last week, the FTC closed another complaint by privacy advocates, including Junkbusters, aimed at Amazon. The FTC found that Amazon did not violate any federal laws last year when it changed its privacy policy to permit the sharing of customer data with other companies.

Related Posts