Clickability tracking pixel

As Amazon Expands Biometric Offerings, Some Sound the Alarm

Palm scanners in several Seattle-area stores is one more layer to the company’s convenience and data collection efforts, but civil rights and privacy experts say the tech comes with inherent concerns.

by Katherine Khashimova, Long The Seattle Times / November 11, 2020
With the Amazon One technology, customers have the option to enter the store by waving their hand over a palm scanner, after linking their handprint to a credit card. (Courtesy of Amazon) TNS

(TNS) — In its latest push to collect data on consumer purchases, Amazon is expanding a new palm recognition payment technology into three more Seattle-area stores, the company announced Tuesday.

Civil-liberties advocates, though, are concerned the company is storing immutable biometric information on its customers, which they say poses risks to consumer privacy.

The technology, called Amazon One, was piloted in two cashierless Amazon Go stores in South Lake Union earlier this fall. Customers who have linked their handprint to a credit card pay by waving their hand over a sleek palm scanner. Customers can also link their handprint to their Amazon account, though that's not required.

The company will roll out Amazon One devices at the Amazon Go Grocery in Redmond on Wednesday, followed by the Amazon Books in University Village and the Amazon 4-Star store in Southcenter in coming weeks, said Dilip Kumar, Amazon's vice president of physical retail and technology, in an interview.

Amazon dominates the e-commerce marketplace, in part because it collects massive amounts of data on customers' online shopping habits, enabling it to predict with uncanny accuracy which goods might appeal to specific customers.

Lately, the company has started to collect similar data on customers' purchases in physical stores — and plans to expand those efforts beyond the Amazon ecosystem.

Amazon is marketing the Amazon One service to "retailers, stadiums, and office buildings," Kumar wrote in a blog post announcing the product launch. (As to whether the company will expand Amazon One into the chain of Whole Foods grocery stores, which it purchased in 2017, customers should "stay tuned about that," Kumar said.) Once a customer registers, they can use the same handprint signature at every Amazon One terminal, no matter where the device is located.

The impetus behind the science-fiction-esque palm scanner is to "remove friction in the shopping process," Kumar said in the interview, by reducing how long it takes to pay.

That builds on the premise behind the company's 26 Amazon Go convenience stores, where cash registers have been replaced by sophisticated cameras tracking which items customers remove from shelves to bill their Amazon accounts later.

To civil-liberties advocates, though, it's not clear whether the purported convenience of using biometric technologies to pay for groceries outweighs the potential risks to consumers' privacy.

"The way the surveillance infrastructure is being built around us at increasing speed, it's very disturbing," said Jennifer Lee, who works on the intersection of technology and privacy for the American Civil Liberties Union of Washington.

The scanners use two sets of cameras to capture images of both the exterior and interior of a customer's palm, according to a patent application Amazon filed last year. The process, called vein matching, isn't new — it's been around since the 1980s, and has been used by Japanese banks to secure ATM transactions since the early 2000s. Amazon One, though, represents the first significant commercial rollout of the technology in the U.S.

The gradual encroachment of Amazon's data collection into ever-more-personal spheres, Lee said, may generate a sense of complacency among consumers. "First it's your online shopping patterns, then it's your palm prints, then it's facial recognition, then you've ceded all privacy," she said. "It's very concerning."

Amazon has previously come under scrutiny for its ties to law enforcement, raising concerns over whether police or federal agencies might be able to access the handprint data, Lee said. The company's home security division, Ring, supplies home surveillance footage to 1,300 law enforcement agencies around the country. The company has previously marketed its facial recognition software to police agencies; it placed a one-year moratorium on police use of the technology this summer amid protests over police violence.

There are also concerns about data breaches.

"This vein mapping data will be stored on servers that are hackable," said Jevin West, a professor at the University of Washington's Information School who studies data collection.

Amazon rebuffed those concerns. The palm-print data is anonymized and stored securely in the cloud, Kumar said, and the proprietary way Amazon scans customers' hands means the data is of virtually no use to any other organization.

The only people who have access to the palm data are a "small group of trained Amazon researchers" working "to improve the technology and service," said Amazon spokesperson Kerri Catallozzi in an email. Customers can ask Amazon to delete their handprint from its cloud storage.

Most worrisome, West said, is that the camera devices and cloud technologies powering Amazon Go and Amazon One record consumers' immutable physical characteristics.

"Some may argue that we essentially have this kind of personal identifying information in our phones or our wallets," West said. But if credit card or cellphone data is exposed, "I can throw away those phones and wallets. I can't throw away my hand."

©2020 The Seattle Times, Distributed by Tribune Content Agency, LLC

Looking for the latest gov tech news as it happens? Subscribe to GT newsletters.

E.REPUBLIC Platforms & Programs