You can view the information that various websites — like Facebook, Google, and LinkedIn, to name a few — have about you by submitting a data request. A corporate data request is a curiously asymmetrical notion: These companies don’t request your information, they just take it (sometimes even if you don’t use their services), yet you have to request your own information from them. It’s a bit like if you have a stalker who’s been shadowing you around, meticulously documenting everywhere you go, everyone you talk to, and everything you do, who’s now handing you a form to fill out if you want to see the boxes of files they’ve been keeping on you. I decided to request my data from Amazon, which courteously affords me the opportunity to join the ranks of the numerous third parties that can also get my data from Amazon.
The Roach Motel
The first thing I learned is that Amazon is in no hurry to give you your data, nor does it really encourage you to ask for it in the first place. I couldn’t even figure out how to navigate to the request page without turning to a search engine. In fact, Amazon seems keen to discourage data requests, as making one is a labyrinthine endurance test of being bounced from one webpage to the next, waiting for weeks, and then downloading, extracting, and combing through dozens of files. Requesting your data from Amazon is an exhausting procession that feels a little bit like a text adventure game designed by Franz Kafka.
Once you’ve actually made it to the preliminary “Request Your Personal Information” page, Amazon suggests that you can also access “a lot of your personal information in Your Account.” This is the first iteration of a refrain that you will run into multiple times throughout the protracted data request process, repeated every step of the way.
Amazon’s “Request My Data” selection menu.
Screenshot: The Intercept
After you click on “Request My Data,” you’re taken to a page with a drop-down menu where you can “select the data that you want,” with the option “Request All Your Data” in the 16th position, at the very bottom of the menu. And in case you’ve forgotten that you can also see some of your data in your account settings, Amazon offers a helpful reminder: “Don’t forget you can access a lot of your data instantly, as well as update your personal information, from Your Account.”
Once you submit your request, you’re taken to the “Data Request Creation” page, which thanks you and informs you that “You’re almost done…” but now need to click a verification link in your email. Amazon at this point makes some intonations about how this email verification step is necessary because your privacy and security are the company’s top priority, though considering that when your data is available you’ll need to check your email anyway, it’s not clear how checking your email twice adds any security. And by the way, in case you’ve forgotten already, Amazon also reminds you on this page that “You can access a lot of your data instantly, as well as update your personal information, from Your Account.”
Amazon’s “Data Request Creation” message.
Screenshot: The Intercept
At this point, you’ll need to pop over to your email and click the “Confirm Data Request” link. Doing so will take you to the “Data Request Confirmation” page, which informs you that Amazon has “received and [is] processing your request to access your personal data.” This feels a little strange, as you don’t recall ever making Amazon jump through this many hoops when it wanted to access your data. (This page again reminds you that you can get “a lot of your data … from Your Account.”)
The “Data Request Confirmation” page also informs you that you may be in for a bit of a wait. Though Amazon says that it will “provide your information to you as soon as we can,” “soon” is apparently meant to be interpreted on a monthly time scale, as the page further states that “usually, this should not take more than a month.” Though of course, “in exceptional cases, for example if a request is more complex or if we are processing a high volume of requests, it might take longer.” This protracted time frame forms an intriguing juxtaposition to the otherwise universal emphasis on speed that facilitates shopping on Amazon. “If you have to click multiple buttons, if you have to wait for too long, if you have to answer a lot of information — all of those things create friction, and friction exponentially kills the joy of shopping,” Nadia Shouraboura, a former member Amazon’s management board, said in the 2014 CNBC documentary “Amazon Rising.”
Amazon’s “Data Request Confirmation” message.
Screenshot: The Intercept
Given Amazon’s obsession with speed and eliminating friction to foster faster consumerism, the dawdling data solicitation process seems like it just might be intentional, designed to dissuade requests. A far simpler explanation comes through an invocation of Hanlon’s razor, the old adage to “never attribute to malice that which is adequately explained by stupidity.” Amazon whistleblowers cited by Politico have said that the company “has a poor grasp of what data it has, where it is stored and who has access to it.” If that’s the case, then it stands to reason that it can take a month or more for Amazon to process a data request. As former Amazon chief information security officer Gary Gagnon succinctly put it in an interview with Reveal, “we have no fucking idea where our data is.”
Asked whether the company takes a long time to fulfill data requests because it doesn’t have a good grasp on where customer data is kept, Amazon spokesperson Jen Bemisderfer said the company “strongly reject[s] the assertion that we don’t keep track of customer data. Producing [customer data] reports requires that we know where data is stored. Amazon maintains multiple and complementary tools and processes to systematically identify where personal data is stored and how it flows.”
Bemisderfer did not directly address a question about whether Amazon intentionally makes the data request process difficult, instead writing, “We are committed to providing customers with access to their information and are always looking for ways to improve the customer experience.”
It ultimately took about 19 days for Amazon to fulfill my data request, in stark contrast to its reported median time of 1.5 days to process a data request, as per the company’s California Consumer Privacy Act disclosure for 2020. There was no option for expedited Amazon Prime data delivery and no button equivalent to an instantaneous Buy Now (née 1-Click) option when selecting my data. When the data was finally ready, Amazon sent me an email expressing outright jubilation at the fact that it had managed to find my information, stating: “We are happy to confirm that we have completed your data request.” And since it’d been a few weeks, Amazon also understandably thought that I could use another reminder that I could “find all the available information” related to my Amazon profile (“including reviews”) on my profile page.
Amazon’s “Your personal data is ready to download” email.
Screenshot: The Intercept
Clicking the link to download the data in the arrival email in turn took me to the “Download your Amazon Data” page, which once again (for the sixth and, mercifully, final time) helpfully reminded me that “You can access a lot of your data instantly, as well as update your personal information, from Your Account.”
On the data download page, under the veneer of endless consumer choice, I was presented with a total of 74 separate zip files that had to be downloaded individually (though enterprising users have built scripts to help automate the process). This turn toward extreme granularity is doubtlessly not unappreciated by the ever-discerning consumer who, despite explicitly requesting all of their data from the drop-down menu earlier in the request process, may nonetheless now only wish to download the cryptic Advertising.1.zip and Advertising.3.zip but may studiously want to avoid Advertising.2.zip, and is therefore thankful to be spared the burden of being saddled with two additional kilobytes of extraneous data.
The Amazon data download page that Nikita Mazurov received.
Screenshot: The Intercept
Amazon is here employing a kind of reverse dark pattern: Instead of irksome layout gimmicks designed to trick users into inadvertently doing things (like subscribing to mailing lists), Amazon is using an irksome layout pattern to discourage you from downloading all of your data. Specifically, this is kind of a “roach motel” model reminiscent of when Yahoo presented users with more than 300 buttons to individually press to opt out of third-party data collection from its partners. Except in Amazon’s case, you have to go through this process to merely view your data, not opt out of it.
“You Can Access a Lot of Your Data”
Once you’ve gone through and painstakingly downloaded all of the zip files, you need to extract the contents of each one either using a program included with your operating system or (if you can’t find one already on your computer) a free tool like 7-Zip. The extracted data is predominantly in the form of CSV files, which can be opened in a spreadsheet editor like Calc, included with the free office productivity suite LibreOffice. (Microsoft Excel will work too.)
While Amazon’s reminders that you can access “a lot” of your data by looking around your account and profile settings is doubtlessly true (given that “a lot” is a nebulous quantifier), what becomes apparent when looking over your requested Amazon data is that the company collects a lot of information that you cannot view in those settings.
In skimming over this trove, one thing became very clear right away: Amazon sure seems to love to retain information. Though the company states that it is legally required to keep certain data like order history, other information like search keywords seems to be retained at Amazon’s discretion. The company intricately logs chat and email interactions you’ve had with buyers, sellers, and Amazon; your cart history; your orders, returns, and reviews; and your searches (for the past three-and-a-half years), or at least those made while logged into your account. The spreadsheet that lists your search history (Retail.Search-Data.Retail.Customer.Engagement.csv in Retail.Search-Data.zip) contains 65 fields with information like search terms, your IP address, how many search results you clicked on, how many search results you added to your basket, and how many search results you ended up buying. The file also includes fields with unclear titles. For instance, one column marked “Shopping Refinement” sporadically lists cryptic strings of numbers like “26,444,740,832,600,000” for various search queries.
Aside from keeping a meticulous ledger of all your site activity, Amazon also takes the liberty of holding on to data you may have had the mistaken impression you deleted. If you click “Remove” on any address you have stored in the “Your Addresses” portion of your Amazon account, this in fact only removes the address from that page, not from Amazon’s records. Addresses that you have removed from your account are merely labeled as “Is Address Active: No” in Retail.Addresses.pdf (within Retail.Addresses.zip). On its “Add and Manage Addresses” customer service page, Amazon makes no mention of the fact that deleted addresses are only deleted from being visible to you on your account page and are not actually deleted from Amazon’s servers. Given that account recovery security questions for various services can be along the lines of “What’s the name of the first street you lived on?” or the fact that people sometimes use their old house or apartment numbers as their PINs, gaining access to a user’s comprehensive list of old addresses can be particularly advantageous for someone who has access to your Amazon account and wants to expand their reach.
Amazon’s advertising data on you is inexplicably divided across three zip files. Advertising.3PAudiences.csv (in Advertising.1.zip) lists “Audiences in which you are included via 3rd Parties.” It’s not explained how Amazon acquires this third-party audience data, but according to this dataset I apparently am a homeowner, in possession of a luxury sedan and SUV, and in the 45 to 54 age range. This was all news to me, as I am none of those things. It genuinely feels good to know that Amazon is wasting resources on harvesting inaccurate audience demographic information from third parties.
The two Advertising.AdvertiserAudiences.csv files (in Advertising.1.zip and Advetising.2.zip), meanwhile, list “Advertisers who brought audiences in which you are included.” It’s not clear what this field actually means — for instance, if “brought” is a typo for “bought” — but at any rate, my data is apparently somehow linked to a total of 167 advertisers, including Carrington College, Clever Cutter, Fitbit, HCA Healthcare, the Leukemia & Lymphoma Society, and something called Animal Friends. Three Canadian banks — Bank of Montreal, Royal Bank of Canada, and Scotiabank — are disproportionately represented in this list of advertisers that have hoovered up my data; I don’t know why, though I did several times order gifts to Canada.
There are also zip files dedicated to other Amazon services like Alexa, Amazon Games, Amazon Music, Kindle, and Prime Video. I don’t make use of those, so mine were empty, though it does at this point come as no surprise that Amazon keeps track of, for example, how long you watch individual Prime Video offerings and which country you are in when viewing them, or which books you read on your Kindle, down to which pages you look at.
Overall, from my Amazon data request I learned that I never did find a good “DIY plasma ball kit” or a decent “summer watermelon recipes” book, but I am decidedly happy that Amazon thinks I’m a 45 to 54-year-old luxury sedan-driving homeowner and that multiple Canadian banks have a competing interest in me.
Minimizing Data Exposure
There are numerous steps one could take to minimize the amount of information Amazon is able to collect. You could be sure that you’re using ad-blocking software like uBlock Origin to reduce the chance of advertisers tracking your browsing habits and buying or selling that information. You can also peruse Amazon through the private mode in your browser, or at least while being logged out of your Amazon account. And if you don’t want Amazon to have your IP address, home address, phone number, and credit card information, you could always use a virtual private network for browsing, a Post Office box for shipping, a temporary burner phone number for account verification, and a temporary or virtual credit card number. It may also not be an entirely bad idea to periodically start fresh, via Amazon’s ever-helpful “Request the Closure of Your Account and the Deletion of Your Personal Information” page.
The post I Want You Back: Getting My Personal Data From Amazon Was Weeks of Confusion and Tedium appeared first on The Intercept.
This post was originally published on The Intercept.
