Amazon Shares Prime Members' Viewing Data in Violation of VPPA: Class Action

The complaint alleges Amazon Services discloses to its parent company consumers’ personally identifiable information (PII) “on a regular basis,” in violation of the VPPA and Washington's Consumer Protection Act.

Amazon has amassed consumers’ data and built profiles on them through its various subsidiaries and operations, said the complaint. Through Whole Foods, Amazon knows “what kind of foods we like”; through an Echo smart speaker, it knows “who we call on the phone”; and through Prime Video, operated by Amazon Services, it knows "what television programs and movies we watch,” it said.

The VPPA, though, limits what information Amazon Services can legally disclose to Amazon Inc., its affiliates and third parties “based on what we watch,” said the complaint. Under the VPPA, a video service provider can’t disclose the PII of a “renter, purchaser, or subscriber of its goods or services,” including “any information identifying a consumer as having requested or obtained specific video materials or services from a video tape service provider,” it said.

Yet Amazon Services discloses consumers’ PII to Amazon for audience measurement, marketing, market research, advertising and other data collection and analysis purposes, the complaint said. “None of these services are in the ordinary course of business as defined by the VPPA,” it said, and on information and belief, Amazon Services “discloses PII to other Amazon affiliates as well.”

The VPPA provides exceptions to the prohibition on disclosing PII, such as disclosure to a law enforcement agency related to a warrant; disclosure to anyone with informed, written consent; disclosure to the consumer himself or herself; and to any person if the disclosure is incident to the ordinary course of business, said the complaint. Though the ordinary course of business exception and informed, written consent exceptions are relevant to this case, neither applies to Amazon Services’ disclosures to Amazon, it said.

Meredith Beagle of Charles City County, Virginia, and Jordan Guerrero of Orleans Parish, Louisiana, allege Amazon has a “well-documented history of providing misleading and incomplete information to consumers about the use, storage, and disclosure of their personal information.” The plaintiffs cited the FTC’s June 21 suit against Amazon for violations of the FTC Act and the Restore Online Shoppers’ Confidence Act. The complaint also cited a 2021 Politico article in which a former Amazon employee is quoted as saying that the company has grown so fast “it doesn’t know what it owns," nor "where their data is at.”

Amazon’s “fine print” in disclosures about its use of consumer information and privacy are “intentionally scattered throughout a series of online pages that must be navigated via a maze of misleading hyperlinks,” said the complaint. The disclosures “acknowledge that Amazon Services can and is sharing PII-related video usage history with both Amazon affiliates and unaffiliated third parties, but not in the separate, distinct format mandated by the VPPA and not with a clear notification of the right to opt-out,” the complaint said.

Amazon’s terms offer an “inadequate opt-out for some information as to unaffiliated third parties,” but there is “no opt-out at all for Amazon affiliates,” the complaint said. Amazon’s “maze of fine print" says consumer data will be shared among its affiliates, it said. Though Amazon admits that it collects and discloses consumers’ data, it doesn’t obtain their consent or provide a “clear and conspicuous opt-out,” it said.

The terms of use for Amazon Prime Video state that separate conditions and usage rules may be applicable to the use of the service, “along with 'any rules or usage provisions specified on any product detail page or on any help or other informational page for the Amazon Prime Video service,’” the complaint said. The video terms of use page doesn’t clearly disclose that PII related to video usage “is disclosed to third parties, but 'buried' 22 paragraphs in “it vaguely states” that while viewing certain channels, sports events and live content, Amazon “may provide information about your viewing behavior to third parties for purposes of audience measurement and market research,” with a hyperlink to "further information” that identifies Nielsen as a third party, it said.

The link is buried at the end of a section titled “Digital Content” in the video terms of use and isn't in a "form distinct and separate from any form setting forth other legal or financial obligations of the consumer" as required under the VPPA, said the complaint. The disclosure applies to only one third party, includes three discrete items -- AMC+, Paramount+ and Thursday Night Football – “and does not include any explicit disclosures or information about video rental history," it said.

Beagle bought or rented 10 items from Amazon Prime Video and streamed other content from 2021 to 2024, said the complaint. Amazon collected the content she viewed “down to the precise number of seconds watched,” plus her name, address, credit card information and other PII, the complaint said. Beagle's PII regarding old rental data “is no longer necessary for the purposes for which it was collected,” the complaint said. Because no requests are pending for access to the information under the VPPA, the information “should have been destroyed months ago” but Amazon Services “continues to store this improperly-collected PII,” it said.

Guerrero bought, rented or streamed 196 items from Amazon Prime Video from 2016 to 2023, most for 30-day rental periods and 48-hour watch windows, the complaint said. He, too, has no outstanding requests to view this information, and no pending requests or orders are pending for access to this information for other purposes as described under the VPPA, it said. Both plaintiffs would like to buy, rent and stream additional video content in the future, “but would like to do so subject to the opt-out provision” provided by the VPPA, the complaint said.

The plaintiffs seek damages of $2,500 for each VPPA violation from “video tape service provider” Amazon Services, plus equitable relief, nominal damages for invasion of privacy, attorneys’ fees and costs, and pre- and post-judgment interest. Amazon didn't comment Monday.