Amazon is an ideal example of what’s been labeled “surveillance capitalism“, an economic system built around the commodification of personal data for fun and profit.
NOTE: This article isn’t about bashing Amazon specifically. Since pretty much everyone has an Amazon account these days, they make a very relatable example. Besides, we love Amazon. An Amazon van (a.k.a The Ice Cream Man) stops buy our house at least once or twice a week. But, they are watching you and taking careful notes. Even if you don’t find their level of surveillance problematic, you should at least be aware of what you are giving up by allowing it.
Let’s consider what information they might be storing. We know that Amazon tracks what we buy and even what we search for. That’s clear from the widgets on each page showing us items we’ve recently looked at, what people like us (or who search for the same things) bought, etc. So it’s a safe bet they keep a fair bit of data.
But how much data is that? Sure, we can add purchase history, payment methods, shipping address(es), wish lists, etc. To find out about the “etc.” part, we can exercise our rights as a CA resident which, thanks to the Internet, is all of us.
The California Consumer Protection Act (CCPA) of 2018 gives California consumers the following rights:
- The right to know about the personal information a business collects about them and how it is used and shared;
- The right to delete personal information collected from them (with some exceptions);
- The right to opt-out of the sale of their personal information; and
- The right to non-discrimination for exercising their CCPA rights.
Good for them, why should you care? I am not in California, you are not in California. Probably no one reading these words is either. We care because the Internet is everywhere and obeys no state lines. Rather than trying to determine if you are a CA resident or not, Amazon has just made the method to comply with this law available to all customers.
Go to this URL and follow the instructions:
https://www.amazon.com/gp/help/customer/display.html?nodeId=G5NBVNN2RHXD5BUW
You’ll be asked to verify your email address and then told you’ll get your data in about a week.
When your data is ready, you’ll get an email with a special link. If you click that, you’ll have to enter a code that they will text you via SMS, then you can access your data. Sort of.
You’ll be presented with a page that lists all the database tables in their system that contains information about you. There are 136 such tables. Each table has a nice, descriptive name, the size of the (compressed) extract and a link to download a zipped CSV file of your records.
I love the passive aggressive design of this page, they make you download each and every table separately. There is no “download them all” button. Rookies. They assume I don’t have the browser extension that clicks all the links on a page and saves all the results to a folder…but I do. And if you don’t, this one page makes it worth seeking out the appropriate one for your browser and installing it.
Once you do, you have these tables locally (your files sizes will vary, this is my list as of 1 Aug 2021):
| App Usage Data Setting.1.zip | 5.28 KB |
| Advertising.1.zip | 2.76 KB |
| Advertising.2.zip | 1.95 KB |
| Advertising.3.zip | 1.04 KB |
| Alexa.zip | 12.49 KB |
| Amazon-Drive.zip | 5.19 KB |
| Amazon-Music.zip | 72.17 KB |
| Amazon.Lists.Giftlist.1.1.zip | 824.00 B |
| Amazon.Lists.Wishlist.1.1.zip | 4.42 KB |
| Amazon.Lists.Wishlist.2.1.zip | 448.00 B |
| AmazonGames.zip | 733.00 B |
| AmazonSmile.CustomerData.1.zip | 3.71 KB |
| App Engagement.1.zip | 66.12 KB |
| Apps.AmazonAssistant.zip | 625.00 B |
| Appstore-GameCircle.zip | 5.22 KB |
| Appstore.Entitlements.zip | 1007.00 B |
| Appstore.FireTVClient.zip | 891.00 B |
| Appstore.InAppPurchases.zip | 459.00 B |
| Appstore.zip | 6.89 KB |
| Audible.CartHistory.zip | 3.14 KB |
| Audible.Credits.zip | 2.31 KB |
| Audible.DevicesActivations.zip | 851.00 B |
| Audible.EventReasons.zip | 548.00 B |
| Audible.KindleRedemption.zip | 335.00 B |
| Audible.Library.zip | 42.34 KB |
| Audible.Listening.zip | 15.90 KB |
| Audible.MembershipBillings.zip | 2.69 KB |
| Audible.Promotions.zip | 613.00 B |
| Audible.PurchaseHistory.zip | 8.98 KB |
| Audible.SearchHistory.zip | 10.60 KB |
| Audible.SendABook.zip | 520.00 B |
| Audible.Wishlist.zip | 1.44 KB |
| CustomerCommunicationExperience.Preferences.zip | 2.58 KB |
| Device Engagement.1.zip | 36.17 KB |
| Device Usage Data Setting.1.zip | 312.00 B |
| Devices.Kindle.UnlimitedMembership.1.zip | 4.54 KB |
| Devices.Registration.zip | 2.94 KB |
| Digital-Ordering.1.zip | 70.77 KB |
| Digital-Subscriptions.1.zip | 17.49 KB |
| Digital.ActionBenefit.1.zip | 562.00 B |
| Digital.Borrows.1.zip | 4.07 KB |
| Digital.Content.Ownership.zip | 339.83 KB |
| Digital.Content.Whispersync.zip | 17.20 KB |
| Digital.CustomerAttributes.1.zip | 338.00 B |
| Digital.CustomerAttributes.2.zip | 338.00 B |
| Digital.CustomerAttributes.3.zip | 338.00 B |
| Digital.Orders.Returns.1.zip | 1.65 KB |
| Digital.PrimeVideo.CustomerTitleRelevanceRecommendations.zip | 98.43 KB |
| Digital.PrimeVideo.LocationData.zip | 71.24 KB |
| Digital.PrimeVideo.ViewCounts.1.zip | 98.87 KB |
| Digital.PrimeVideo.ViewCounts.2.zip | 98.86 KB |
| Digital.PrimeVideo.ViewCounts.3.zip | 98.86 KB |
| Digital.PrimeVideo.Viewinghistory.zip | 106.51 KB |
| Digital.PrimeVideo.Watchlist.zip | 82.83 KB |
| Digital.Redemption.1.zip | 1.79 KB |
| Digital.SeriesContent.Relation_1.zip | 1.98 KB |
| Digital.SeriesContent.Relation_2.zip | 1.89 KB |
| FireTV.DeviceControl.1.zip | 2.24 KB |
| Kindle.AuthorFollows.zip | 2.26 KB |
| Kindle.BooksPromotions.zip | 729.00 B |
| Kindle.BooksSettlers.zip | 1.00 KB |
| Kindle.Devices.ApplicationSession.zip | 25.97 KB |
| Kindle.Devices.EreaderDeviceActiveUsageTime.zip | 7.20 KB |
| Kindle.Devices.EreaderFrameworkConnectivity.zip | 12.97 KB |
| Kindle.Devices.EreaderFrameworkSettingsIntegers.zip | 892.00 B |
| Kindle.Devices.EreaderFrameworkSettingsString.zip | 502.00 B |
| Kindle.Devices.EreaderPowerManagementStateChange.zip | 43.77 KB |
| Kindle.Devices.HomeCardClicks.zip | 380.00 B |
| Kindle.Devices.HomeCardImpressions.zip | 1.98 KB |
| Kindle.Devices.HomeImpressions.zip | 3.69 KB |
| Kindle.Devices.InbookToolbarInteractions.zip | 908.00 B |
| Kindle.Devices.KindleAppSearchAttempt.zip | 668.00 B |
| Kindle.Devices.ReaderInBookNavigation.zip | 682.00 B |
| Kindle.Devices.ReadingActionsContainers.zip | 428.00 B |
| Kindle.Devices.ReadingActionsWidgets.zip | 549.00 B |
| Kindle.Devices.ReadingSession.zip | 46.93 KB |
| Kindle.Devices.ReadingSessionVersion2.zip | 27.10 KB |
| Kindle.Devices.adClickMetric.zip | 335.00 B |
| Kindle.Devices.adsInfo.zip | 15.66 KB |
| Kindle.Devices.autoMarkAsRead.zip | 370.00 B |
| Kindle.Devices.kindleHighlightActions.zip | 624.00 B |
| Kindle.Devices.readerLibrarySeriesGroupingMetrics.zip | 490.00 B |
| Kindle.Devices.screensaverInfo.zip | 24.93 KB |
| Kindle.Ereader.Toolbar.Menu.Options.zip | 359.00 B |
| Kindle.Ereader.Toolbar.zip | 1.99 KB |
| Kindle.KindleDocs.zip | 1.27 KB |
| Kindle.KindleHome.CardClicksOnKindleForiOS.zip | 418.00 B |
| Kindle.KindleHome.CardViewsOnKindleForiOS.zip | 523.00 B |
| Kindle.Reach.zip | 11.10 KB |
| Kindle.ReadingInsights.zip | 30.38 KB |
| Kindle.SagaSeriesInfra.zip | 4.08 KB |
| Kindle.WebReader.zip | 1.62 KB |
| OutboundNotifications.AmazonApplicationUpdateHistory.zip | 2.00 KB |
| OutboundNotifications.EmailDeliveryStatusFeedback.zip | 25.91 KB |
| OutboundNotifications.NotificationEngagementEvents.zip | 86.97 KB |
| OutboundNotifications.PushSentData.zip | 1.86 KB |
| OutboundNotifications.SentNotifications.zip | 77.89 KB |
| PaymentOptions.1.AmazonPayBrowserBehaviorData.zip | 592.00 B |
| PaymentOptions.PaymentInstruments.zip | 1.38 KB |
| Payments.PaymentProducts.zip | 477.00 B |
| ProductCompatibilityProgram.DataSet.zip | 377.00 B |
| Retail.Addresses.zip | 7.35 KB |
| Retail.AmazonTeens.zip | 377.00 B |
| Retail.Authentication.zip | 341.00 B |
| Retail.AutomotiveNA.Garage.zip | 647.00 B |
| Retail.CartItems.1.zip | 444.00 B |
| Retail.ChatTranscripts.zip | 1.83 KB |
| Retail.CommunityShopping.SocialGamification.zip | 46.00 B |
| Retail.CommunityTrust.zip | 484.00 B |
| Retail.CustomerAttributes.zip | 3.14 KB |
| Retail.CustomerContacts.zip | 3.66 KB |
| Retail.CustomerProfile.zip | 1009.00 B |
| Retail.CustomerReturns.1.zip | 966.00 B |
| Retail.CustomerReviews.zip | 9.93 KB |
| Retail.Follow.zip | 217.00 B |
| Retail.GiftCertificates.1.zip | 7.03 KB |
| Retail.GiftCertificates.2.zip | 1.14 KB |
| Retail.GiftCertificates.3.zip | 1000.00 B |
| Retail.Household.zip | 24.13 KB |
| Retail.LightWeightInteractions.zip | 4.72 KB |
| Retail.OrderHistory.1.zip | 82.59 KB |
| Retail.OrderHistory.2.zip | 764.00 B |
| Retail.OrdersReturned.1.zip | 924.00 B |
| Retail.OrdersReturned.Payments.1.zip | 869.00 B |
| Retail.OutboundNotifications.zip | 6.62 MB |
| Retail.ProblemWithOrder.1.zip | 362.00 B |
| Retail.Promotions.1.zip | 1.98 KB |
| Retail.RegionAuthority.1.zip | 2.33 KB |
| Retail.Reorder.1.zip | 3.49 KB |
| Retail.Seller-Feedback.1.zip | 905.00 B |
| Retail.ShoppingProfile.1.zip | 448.00 B |
| RetailWebsite.AuthenticationTokens.zip | 4.85 KB |
| Search-Data.zip | 62.15 KB |
| Subscriptions.Digital-Billing-And-Refunds.1.zip | 7.39 KB |
| Subscriptions.RecurringDeliveries.zip | 4.78 KB |
| TreasureTruck.DataSet.1.zip | 288.00 B |
I know, that’s a long, boring list, but that’s sort of the point. Amazon collects an astonishing amount of data. Scan through those titles for a few minutes and reflect. Yeah, that’s a LOT of details. To be fair, any file that’s less than 1KB is probably empty. So there’s that.
Now, let’s crack one of these open and see what they contain. We’ll start with the search data, this one should have the fewest surprises, right? Unzipping Search-Data.zip gives us 2 CSV files:
Search-Data.Customer-Engagement.csv
Search-Data.Product-Metrics.csv
CSV files are spreadsheet files in pure text form and therefore you can read them in almost any spreadsheet or text editing program (Notepad, if you have nothing else). Each file represents a database table in their system and the file will contain the rows that pertain to your information only. The first row of each file contains the name of the field for the subsequent data.
The first table contains the data about your actual searches. Opening that in Excel shows me 751 rows. Which, considering my use of Amazon during the pandemic, is surprisingly small. What is more shocking is the width of the table. There are 64 columns. That’s a lot of data about each search. The columns names will help us understand what they are tracking:
Â
| First Search Time (GMT) All Department (APS) or Category Site Variant Application / Browser Name Device Model Search Type (Keyword, Visual, Browse) Session ID Query ID Prime Customer (Y/N) Is From External Link (Y/N) Search From External Site (Y/N) First Search Query String Application Name App Version Operating System Name Operating System Version Device Type ID Device Category Customer IP Search Method Keywords Amazon Business Customer (Y/N) Language Server Amazon Fresh Customer (Y/N) Music Subscriber (Y/N) First Browse Node Last search Time (GMT) Last Department Last Browse Node First Added Item First Purchased Item | First Consumed Item (Subscription) Number of Clicked Items Number of Items Added to Cart Number of Items Ordered Number of Paid Items Ordered Number of Free Items Ordered Units Ordered Paid Units Ordered Free Units Ordered Maximum Purchase Price Clicked Any Item (Y/N) Added Any Item (Y/N) Purchased Any Item (Y/N) Department Count Shopping Refinement Number of Shopping Refinements Highest Number of Shopping Refinements Items Consumed (Subscription) Shopping Refinement Pickers Paid Purchase (Y/N) Item Borrowed (Y/N) Items Borrowed Next Query Group via Click Query Abandoned (Y/N) Query Reformulated (Y/N) Amazon Fresh (Y/N) Store Visited Department Browse Node First Search Domain Is First Search From External Ad User Agent Info Family |
Scroll through that for a few minutes. Who knew you could keep such extensive information about one simple activity?
Amazon knew and that’s how they have been able to come out of nowhere and become the dominant player in online retail sales. Wal-Mart invented just-in-time delivery and a vast network of warehouses to feed that system. Then they used that system to crush less efficient competitors.
Amazon took that concept one step further and figured out what you are likely to buy and stocked that in an even larger network of warehouses such that about 80% of Americans can get 75% of the things they are likely to buy the very next day. If you live in a big coastal city they can provide popular items in 4 hours or less. Madness.
Data mining is how they do it.
I love my Kindle, I’ve been a fan of the device since the first very clunky version. I use it nearly every day. And, Amazon knows that very well. Unzipping
Kindle.Devices.ApplicationSession.zip
Reveals a table that has 2169 records in it. This is the session data for each and every time I have turned the device on. Each row contains:
start_timestamp, end_timestamp, session_status, Country, os_version, app_version, DSN, device_family, device_model, time_zone
Of particular interest to me is DSN. This seems to stand for “Device Serial Number”. Sure, no problem, we absolutely expect that each Kindle has a serial number. But, some of these numbers are not like the others. My old (long gone) Kindle has a serial number:B01309075175016G
But there are larger entries like this:
DE662AF1DD34404BB7FD553767BFXXXX
Those aren’t Amazon serial numbers. That appears to be the serial number of an old iPad. It must have been captured by Amazon when I loaded Kindle for iOS on it at some point. Looking at the data, I didn’t read on it much at all. Great, who cares? Well, another Apple serial number in that table is my current iPhone. You know that tracking device you carry around all day in your pocket?
Amazon could combine your shopping habits with your location by asking Google where you are. And that’s just the most obvious connection they could make. I know we are straying into that tin foil hat area, but…
Aside from how Amazon and its affiliates might abuse your data, imagine what a treasure trove this will be when Amazon gets hacked and this stuff makes it out onto a torrent somewhere…
OK, now that we are suitably impressed (or appalled), we have a choice to make: shrug and move on or fix it.
Almost all of you will choose the former and I can respect that, it’s my choice as well. Amazon’s huge, inexpensive and very convenient. They’re impact on me personally has been pretty positive, so them tracking the crap out of me is just part of the price I pay and one of the reasons that dollar figure is lower than it might otherwise be.
Those that choose the latter and want to stop the surveillance and remove their data have some work ahead of them. Amazon allows you (see below) to close your account and have all of your data permanently deleted.
OK, but what if I want to continue to use Amazon, but I just want them to stop watching me like that? Tough, that’s not on offer. What you can do is close your current account and create a new Amazon account, that has as little of your personally identifiable details as possible and start using that one.
First, you need to preserve you existing “investment”. Do you own any revokable digital assets? Kindle books, movies with DRM, Audible audiobooks? All of these things will become unusable once your account is closed. There are straightforward ways to preserve these assets with minimal effort, a simple web search will show you the way. You did pay for them after all.
Once you are sure you have preserved everything you want, delete your old account (Item #2 under CCPA) by going here:
https://www.amazon.com/gp/help/customer/display.html?nodeId=GDK92DNLSGWTV6MP
And following the instructions.
Normally I would be quite skeptical that a company would actually delete your data, but given the litigious nature of things in CA, I think we can believe they will in fact delete the data. You will certainly lose access to the account regardless of what they do with your data, so be SURE you’re ready before clicking that button.
Now, setup a new Amazon account. It will still surveille the crap out of you, but you’ll care less because they won’t know it’s you (probably).
To protect your privacy, the new account’s details need work, but not tie back to you. This is tricky because at the same time Amazon must protect itself against fraud. Therefore, they scrutinize new accounts fairly carefully to make sure they are legit. So we have some hoops to jump through to avoid having the account suspended right from the start.
To open a new account, you will need 3 things:
- An alias name (using a fake name is totally legal in most cases (exc. dealing with the government))
- A way to pay for your purchases that Amazon won’t object to
- A shipping address that you are comfortable with
- (optionally) a cell phone # that’s not tied directly to you (think VOIP)
Alias Name – this one is easy, pick one but not an obvious one (e.g., John/Jane Doe). Privacy conscious people creating aliases generally use their real first name (unless it’s unusual) and make up a last name.
Payment – Probably the easiest way to go here is to setup a Privacy.com account. They provide a service that masks your true card number and details from (other) online merchants. Simple to setup, but you will be giving them your real name and access to your real account. That’s required to comply with federal anti-money laundering rules.
A step further down the tinfoil hat path is to use Amazon gift cards (purchased with cash, of course) to fund the account. Obviously, if you are a big Amazon user, this can quickly become a pain in the ass. Even the $500 ones will get used up quick. On the other hand, if you have an Amazon Problem (I’m looking at you BK), this could be a way to set limits for yourself that helps control those impulse purchases. Who wants to run to the grocery store at 10pm to buy a gift card? Yeah, no one.
A note of warning if you choose this route. If Amazon decides to suspend your account because they don’t think you’re real, you will lose whatever gift card balance remains. So, start with a $10 card, not a $500 card. I’ll refer you to this podcast for the process of “aging” a new Amazon account to bypass the fraud detection protocols currently in place:
Episode 208 – Amazon Privacy & VOIP Updates
Shipping – Here we also have some choices. Since you did delete your old account, having stuff shipped to your real address is probably fine. They shouldn’t be able to tie these accounts together. But, like with payment, you have options if you want to be sure they don’t.
If you live in suburbia, you can have your purchases sent to an Amazon Locker somewhere convenient. The truly paranoid will pick one that’s not the closest to their home.
Another choice is to use a commercial mail receiving agency (CRMA) such as The UPS Store or some local version. A USPS PO Box is not an option for packages since you’ll need to deal with a counter agent to get them and they’ll typically expect some ID. So, unless you have an ID in your alias name (certainly possible), that’s a problem.
Cell Phone – more and more sites want a cell phone # for verification and you will probably need to give them one for the lame version of 2FA anyway. Your cell phone # is more unique than your name and given all the spam calls we get, something you should probably give out less and less. Masking your true cell phone number is totally doable, but a lengthy article on its own. And, since it’s further than I am willing to go (at least for now), I can refer you to this source and let you decide on your own how you want to play that angle:
Episode 221 – Anonymous Mobile Devices
Alright, after all that, you should be set with your new, anonymized Amazon account.
Oh, by the way, do you have an account on GoodReads? Yeah, they are owned by Amazon and if you read books on a Kindle, they have your information too. Read my GoodReads article. Speaking of your Kindle, a factory reset might be in order.
My hat’s off to Michael Bazzell of IntelTechniques.com and his podcast for reawaking my desire to leave a little less obvious digital trail so at a minimum I get less spam.
From <https://inteltechniques.com/blog/2020/04/10/the-privacy-security-osint-show-episode-165/>