The starting point for this article was a text by the Swiss provider Proton about how Amazon tracks its customers[1].
The legal situation in Germany is better.
The account01In everyday life, Amazon is a dozen services
Asked what they use from Amazon, most people would answer "the shop" and maybe Prime. The list is longer. Amazon includes, among other things:
- Amazon.de and the Prime subscription with delivery, Prime Video and Prime Music
- Echo and Alexa, the voice assistant in speakers, displays and cars
- Fire TV, as a stick, as a box and built into televisions from several brands
- Kindle and Audible for books and audiobooks
- Ring, the doorbell with a camera, and Blink for indoors
- IMDb for films, Goodreads for books you have read, Twitch for streams
- Amazon Web Services, on which a large part of the rest of the web runs
Each of these services is a privacy disaster in its own right. Link them and run them through just one user account, and you get a worst-case scenario.
Amazon's own privacy notice describes which data is collected in the process: what you buy and look at, device identifiers, IP address, location, voice recordings, content you create in Amazon apps[2]. The information therefore comes from Amazon itself. All of this data comes together in one profile.
Who can look at this data is a separate question. In November 2021, WIRED and Reveal from the Center for Investigative Reporting analysed internal documents from 2015 to 2018 and interviews with former employees[28]. According to them, customer service could call up the order history of any account so that queries could be handled quickly.
Former employees report that colleagues used this to look up the purchases of celebrities, including Kanye West and actors from the Avengers films, down to orders of sex toys. Others called up the accounts of ex-partners and acquaintances. Both were forbidden under Amazon's own rules. A spokesperson denied to WIRED that abuse of these rights was "widespread"[29].
What this article does not cover
Amazon as an employer, working conditions in its warehouses and the dispute over its market power over retailers are separate topics and only appear here where they touch on privacy. How an Amazon purchase fits into an ordinary day is covered in this article; who buys the data generated along the way, in this one.
02Since March 2025, every Alexa request goes to the cloud
An Echo listens constantly and transmits as soon as it believes it has heard its wake word.
Until 2025 it worked like this: the device checks locally whether the wake word was spoken, and only then sends audio to Amazon. For some devices there was also the setting "Do Not Send Voice Recordings", which kept processing entirely on the device.
Amazon switched this setting off on 28 March 2025[3]. The company's reasoning: the new AI features need the computing power of the cloud[4]. Anyone who had used the option was automatically switched to "Don't save recordings". Since then the audio goes to Amazon in every case; after processing it is only deleted instead of kept.
For Germany there is an additional restriction that makes this worse. Asked about it, Amazon said: "The features described in this article never existed in Germany and Austria." (our translation)[4] Local processing was an offer for English-language devices in the US. An Echo in a German living room has therefore been sending its audio from the start.
What remains is the choice between saving and not saving. It is in the Alexa app under "Alexa Privacy" and then "Manage Your Alexa Data". BUT: without saved recordings, Alexa can no longer tell the people in the household apart[3].
03There are people at the other end
In 2019, Bloomberg reported that Amazon employs thousands of staff and contractors worldwide to listen to, transcribe and annotate Alexa recordings in order to improve speech recognition[5]. The teams were based in places including Boston, Costa Rica, India and Bucharest. Two employees at the Bucharest site described nine-hour shifts with up to a thousand audio clips.
They included recordings nobody hands over voluntarily: medical conversations, family arguments, children's voices. A second investigation a few weeks later found that the reviewers could also access home addresses.
Amazon then introduced the setting that lets you opt out of human review. To this day, the use of recordings is switched on by default.
The FTC put a figure on how many people had access in 2023. Its complaint states that between August 2018 and September 2019 around 30,000 Amazon employees had access to Alexa recordings, roughly half of them without a business reason. The authority calls this an overly broad allocation of access rights that breached Amazon's own security rules[6].
04What the FTC found
On 31 May 2023, Amazon agreed with the US Federal Trade Commission to pay $25 million. The allegation: the company had kept children's voice recordings and location data for years, even though parents had asked for them to be deleted, and had continued to use the recordings to improve speech recognition[6]. The settlement obliges Amazon to actually carry out deletion requests and to stop using deleted voice and location data for product development.
On the same day, the Amazon subsidiary Ring paid $5.8 million[7]. That case concerned employees and contractors having unrestricted access to customer videos, and videos being used to train algorithms without consent.
These are US proceedings
The FTC applies American law. The sums and the type of proceedings cannot be transferred to Germany or the UK. What can be transferred is the finding itself: it describes what happened to the recordings, and these devices are the same everywhere.
05Alexa+ arrived in May 2026
On 7 May 2026, Amazon launched Alexa+ in Germany and Austria, initially as a free early-access programme[8]. After that, the service is included in the subscription for Prime members; without Prime it is to cost €22.99 a month.
Amazon describes Alexa+ like this: the assistant "remembers the context of conversations", "learns your preferences, understands your household's routines and adapts to your everyday life" (our translation)[8]. Connected services include OpenTable, Spotify, Apple Music, Prime Video, Audible and smart home devices from Philips, Ring, Bosch and Siemens.
That is the description of a memory. An assistant that understands routines has to store routines. And because the models behind it run in the cloud, the fallback of local processing is gone for good.
In June 2026, at the Cannes advertising festival, Amazon presented the matching business model: Alexa+ Agentic Ads[9]. It runs on Echo devices with a screen. An ad appears on the display, and you talk to Alexa about it: ask questions, go through options, order, all in the same conversation. Amazon describes it as the first ad format in which the entire path from seeing the ad to completing the purchase takes place within the conversation[27]. Launch partners are the pizza chain Papa Johns and ticket sales through Ticketmaster.
The format has not yet been announced for Germany. Amazon only names Echo devices with a screen and no country.
The door06Ring, the police and a cancelled contract
Ring has belonged to Amazon since 2018. The camera in the doorbell records as soon as it detects movement and stores the video in the cloud.
In 2022, US Senator Ed Markey published a letter from Amazon. In it, the company admits that in the first six months of the year it handed footage to police eleven times without the owners' consent and without a court order[10]. The basis was an emergency clause whose application Ring decides on itself. Neither a court nor the person affected checks whether there really was an emergency[11].
In October 2025, Ring announced a partnership with Flock Safety, a provider of surveillance technology for police forces. Through it, authorities would have been able to send video requests to Ring customers. After an advert during the Super Bowl in February 2026 and weeks of criticism, Amazon cancelled the contract[12]. Officially, implementation would have needed more time and resources than expected. According to both sides, no customer footage was ever passed to Flock.
This is the one point in this investigation that has shifted in users' favour: public objection worked here.
07German law sets tighter limits
For a camera at your own front door, German law is considerably stricter than American law. On 8 April 2011, Germany's Federal Court of Justice ruled that a camera in a door intercom can be permissible, but set narrow conditions: it may switch on only when someone rings, the picture goes only to the flat whose bell was rung, it covers only the area immediately in front of the door, and transmission ends after one minute at most[13].
A Ring camera in its default settings does none of this. It starts on movement, it records, it stores in the cloud, and depending on where it is mounted it sees the pavement. Anyone who uses it to film public ground or the neighbouring property leaves the scope of the purely household exemptionHousehold exemptionThe GDPR does not apply to purely personal activities. A camera that only covers your own property falls under this. As soon as it films public ground or neighbouring properties, the exemption ends. and falls within the GDPR, in extreme cases also within section 201a of the German Criminal Code.
The screen and the book08What Fire TV sees
Fire TV uses Automatic Content RecognitionACR — Automatic Content RecognitionThe TV creates a digital fingerprint of picture and sound and compares it with a database. This lets it recognise what is on, even when the signal comes from a connected device., ACR for short. Amazon explains the feature itself: the device creates a digital fingerprint of the picture and sound in order to recognise which programmes, films and adverts are playing on the television, even when they come from a connected set-top box[14].
ACR recognises not only what is playing in Prime Video, but everything on the screen, regardless of the source. Amazon names ad targeting as the purpose: anyone who has already seen an advert three times via cable should not get it again.
ACR can be switched off. The setting is in the device's privacy settings under the data usage options[15]. In the US, a class action has been running since 2026 accusing Amazon of marketing the viewing data obtained this way without consent. The allegations have not yet been proven and Amazon has not commented on them.
09What the book reports
Through Whispersync, a Kindle synchronises more than the current page: bookmarks, highlights, notes and reading progress[16]. This is the feature that makes switching between e-reader and phone convenient, and the same feature creates a record of your reading behaviour: which book, for how long, where you stopped, which sentences you highlighted.
Backing up annotations, last page read and collections to Amazon's servers can be switched off in the device settings. Anyone who switches it off loses syncing between devices.
The business10Advertising has long been a pillar of its own
Amazon's advertising business passed the $68 billion mark in 2025[17]. So-called retail mediaRetail mediaAdvertising shown where people shop. The retailer sells ad space in its own shop and uses what it knows about buying behaviour to do so., advertising around shopping, accounted for more than $60 billion of this alone[18].
This makes advertising Amazon's second major source of profit after the AWS cloud business, alongside retail. The raw material is knowledge of what people buy, watch, listen to and search for. That explains why features that limit this knowledge disappear, and why a voice assistant gets an ad format. How the same mechanism works at Meta is covered in the Meta Files.
11What courts and authorities have decided so far
Luxembourg, 12 March 2026. In 2021, the Luxembourg data protection authority CNPD fined Amazon €746 million, the highest GDPR fine ever at the time, for processing personal data for interest-based advertising. The court of appeal overturned this fine in March 2026. The reason is procedural: under more recent case law of the Court of Justice of the European Union, the authority had not sufficiently examined whether Amazon acted intentionally or negligently[19].
On the substance, the court upheld the authority. The CNPD writes in its own statement that the court found Amazon's reliance on "legitimate interest" as a legal basis was not justified and that the information obligations had been breached[19]. The authority must now set the amount of the fine again. In practice this means: advertising tracking of this kind cannot be based on legitimate interest.
Karlsruhe, 23 April 2024. Germany's Federal Court of Justice confirmed that Amazon has "paramount significance for competition across markets" within the meaning of section 19a of the German Competition ActSection 19a GWBPart of German competition law since 2021. If the Federal Cartel Office finds that a company has "paramount significance across markets", it can prohibit certain conduct without having to prove market dominance in each case.[20]. The Federal Cartel Office had established this in 2022[21]. In practice, it means Amazon is under stricter supervision in Germany, and the Cartel Office can prohibit certain conduct without first having to prove market dominance in each individual case.
Luxembourg, 19 November 2025. The General Court of the European Union dismissed Amazon's challenge to its designation as a "very large online platform" under the Digital Services Act[22]. The additional obligations therefore remain: a public ad repository, a recommendation view without profiling and data access for researchers.
Washington, 25 September 2025. The FTC and Amazon agreed on $2.5 billion, a $1 billion penalty and $1.5 billion in refunds[23]. The case concerned signing up for Prime and cancellations, which the court found Amazon had deliberately made difficult. It was not a privacy case. The mechanism resembles the cases above, though: an interface that pushes a decision in one direction.
12Sidewalk and Amazon One: one network expanded, one service discontinued
Two side notes: a wireless network that Amazon is expanding, and a payment service it has discontinued.
Amazon Sidewalk is a wireless network that Echo and Ring devices form among themselves. Each participating device gives up a small share of its internet connection so that devices in the neighbourhood remain reachable even when their own Wi-Fi is down[24]. The scheme is opt-outOpt-outA feature is active from the start and stays active until you object. The opposite is opt-in: nothing happens until you agree.: it runs until you object. Sidewalk is available so far in the US and, since February 2026, in Canada, but not in Germany.
Amazon One, payment by palm scan, has been discontinued. The devices were removed from all Whole Foods stores by 3 June 2026, citing too little uptake. The associated customer data is to be deleted after the service ends[25].
Amazon does discontinue services: Amazon One because it found too little uptake, and Ring's partnership with Flock after public criticism.
What helps13The settings that make a difference
The following steps reduce your data trail. None of them ends it.
For your account:
- Open your advertising preferences and choose "Do not show me interest-based ads provided by Amazon"[26]. On the same page you can delete existing advertising data.
- Turn off and clear your browsing history at Amazon. It drives recommendations and is separate from your order history.
- Check which third-party apps you have given access via "Login with Amazon", and remove those you don't use.
For Alexa:
- In the Alexa app, under "Alexa Privacy", select "Don't save recordings". This costs you voice recognition.
- Opt out of the use of recordings to improve services. This setting is on by default.
- Go through the history of your smart home devices and the permissions of installed skills.
- An Echo has a microphone mute button. It disconnects the microphones electrically, not via software.
For Fire TV and Kindle:
- Switch off ACR in the Fire TV privacy settings and reset the advertising ID.
- On the Kindle, switch off the backup of annotations and reading position if you don't need syncing between devices.
For Ring:
- Set the field of view so that neither the pavement nor the neighbouring property is in the picture.
- Keep motion zones tight, switch off continuous storage, enable two-factor sign-in.
If you want to go further: Kobo instead of Kindle, Apple TV or a simple television without its own operating system instead of Fire TV, Home Assistant instead of Alexa, Reolink or a camera with local storage instead of Ring, StoryGraph instead of Goodreads, Libby through your local library instead of Audible. Alternatives for browsers and search are here, for the connection behind them here.
Not all or nothing
You can order from Amazon without having an Echo in your bedroom, and decide room by room which devices you allow there.
14Conclusion
Every single device on this list is a bug. The Echo transmits, the camera records, the Kindle reports what syncing needs.
Together they produce a complete picture of you. One account that knows your shopping, hears your voice, matches your TV picture, stores your reading habits and films your front door.
Over the past year and a half, the movement has gone in one direction: local processing has disappeared, the assistant has gained a memory and is now getting ad slots. The courts in Luxembourg and Karlsruhe have repeatedly ruled against the company on the substance. Amazon cancelled Ring's partnership with Flock after weeks of criticism.