Class-Action Lawsuit Filed Against Amazon/Starbucks Shops for Collecting Biometric Data Without Notifying Customers

By B.N. Frank

Last month it was announced that Amazon must pay $30.8 M to settle with the Federal Trade Commission (FTC) for privacy violations associated with the company’s Ring and Alexa devices. More recently another class-action lawsuit was filed against the company and also Starbucks for additional privacy violations through their use of contactless checkout technology.

From Gov Tech:

Amazon, Starbucks Face Class-Action Lawsuit Over Customer Data

Two Seattle giants — Amazon and Starbucks — have been accused of collecting customers’ personal information without first notifying them, in a lawsuit filed Wednesday in Seattle.

Lauren Rosenblatt, The Seattle Times

(TNS) — Two Seattle giants — Amazon and Starbucks — have been accused of collecting customers’ personal information without first notifying them, in a lawsuit filed Wednesday in Seattle.

The proposed class-action lawsuit alleges Amazon and Starbucks have violated a New York City law that requires companies to post signage near store entrances if the businesses are collecting customers’ biometric data, like fingerprints, handprints or the shape of a person’s body.

Amazon and Starbucks teamed up to open two contactless checkout coffee shops in the city during the past three years. The stores feature Amazon’s Just Walk Out technology, which uses machine learning paired with a network of sensors and cameras to track what customers pick up and charge them when they walk out, skipping the checkout line.

In January 2022, New York City enacted the Biometric Identifier Information Law, which requires businesses to tell customers if they are collecting personally identifiable information. Now, three New York residents are accusing Amazon and Starbucks of violating that law in a legal action they hope will grow to include most of the stores’ customers.

The lawsuit focuses on Amazon and Starbucks because the partnership is one of the most prominent cases of Amazon’s contactless checkout technology in the city, said Peter Romer-Friedman, an attorney based in Washington, D.C., and representing the plaintiffs in this case. Amazon is promoting the use of this technology throughout the country.

Become Bulletproof Online Today With ZERO RISK!

“At a minimum, we think Amazon owes its customers an explanation about how it’s operating these systems before people enter — so that people can decide for themselves whether they want to provide measurements of the size and shape of their body as a condition of getting a sandwich,” he said.

Amazon said its technology does not collect biometric data that can be used to identify a specific shopper. Instead, it relies on broad, distinguishing features to differentiate between shoppers in the store at one time, the company said.

Amazon added that customers who use an app to enter the store agree to a privacy policy that allows Amazon to use cameras, sensors and other technology to gather information about their activity in the store.

The same parties sued Amazon and Starbucks in the Southern District of New York earlier this year. The proposed class-action lawsuit filed Wednesday is a consolidation of those cases. The parties filed in the Western District of Washington because both companies are headquartered in Seattle.

In May, Amazon filed a motion to dismiss the lawsuit brought in New York. “Put simply, the [Just Walk Out] Technology does not even implicate the law under which Plaintiff has filed suit,” Amazon wrote in its motion.

Starbucks declined to comment for this story.

Amazon’s Just Walk Out technology is often used in the company’s own Amazon Go convenience stores, Amazon Fresh grocery stores and Whole Foods stores. Amazon acquired the grocery chain in 2017. Amazon also leases its contactless checkout technology to third parties, including Climate Pledge Arena and T-Mobile Park in Seattle, as well as other stadiums and venues around the country.

The technology is meant to create a “frictionless shopping experience,” according to a company blog post from 2022.

In most cases, consumers can enter a store equipped with Just Walk Out tech using either a credit or debit card, an app from the retailer or Amazon One, a contactless identity service that scans a user’s palm to connect to their account. Once inside, the technology tracks the items a customer picks up, as well as the ones they put back. It charges only for the items they walk out with.

In New York, Amazon started opening Amazon Go convenience stores in 2019. It partnered with Starbucks to open its first coffee shop and convenience store in November 2021, and opened a second in July 2022.

When New York City’s biometric information law went into effect in January 2022, both companies failed to post signs at the entrances of the combined Amazon Go-Starbucks stores notifying customers that those locations would collect and store customers’ information, according to the lawsuit.

In March, after media reports, Amazon and Starbucks did post some signs but, the lawsuit alleges, the signage “woefully fails” to comply with the law. In one case, Amazon placed a single sign at one end of a store that had six customer entrance doors, the lawsuit claims.

Furthermore, the signs say Amazon will only collect users’ biometric information if customers use the Amazon One palm scanner. But the plaintiffs allege the Amazon Go-Starbucks stores will collect personal data with or without the palm scanner because of the other technology used to track items throughout the stores.

Amazon and Starbucks have “gone from bad to worse,” the attorneys said in the lawsuit. “Instead of leaving customers in the dark about its collection of biometric information,” the companies are now offering “false assurances” to customers.

Amazon has said that only shoppers who opt to enroll in and then use the Amazon One device will have data about their palms collected.

Though not related to biometric data like fingerprints and palm scans, Amazon came under fire over protecting customers’ privacy last month, as well. Amazon agreed to pay $30.8 million to resolve two cases brought by the Federal Trade Commission related to privacy lapses on its smart devices.

In one case, the FTC alleged Amazon didn’t take steps to protect the privacy of users of its Ring video doorbell. In the second, the Justice Department, on behalf of the FTC, said Amazon’s Alexa-powered speakers collected information about children under the age of 13 without parental consent.

Amazon said it disagreed with the FTC’s claims and denies violating the law in either case.

Concerns around protecting individuals’ biometric data have grown in recent years as consumers worry about which companies are collecting their personal information and how that data is being used. Tech giants like Google, Meta, Microsoft, Snap and Amazon have all faced allegations, as have some retailers like CVS.

Biometric data is “uniquely powerful,” said Albert Fox Cahn, executive director of the Surveillance Technology Oversight Project, one of the groups that filed the lawsuit.

If an individual’s credit card number is compromised, they can always get a new card, Cahn said. But “you can’t change your biometrics,” he said. “If they are compromised, if they are shared, that is going to potentially impact your privacy for the rest of your life.”

Amazon pushes back on that idea. In a blog published earlier this month, Gerard Medioni, a vice president and scientist with Amazon Web Services, wrote that Amazon creates a “palm signature,” that is separate from the palm surface and vein patterns unique to each individual. Amazon can then delete and create new palm signatures at any time, Medioni wrote.