The new legislation is intended specifically to control and regulate the use of biometric data, which is yet another example of the tension between the growing use of AI/technology on the one hand, and privacy laws on the other. One interesting feature of the Statute, designed to provide potential defendants with a way of avoiding expensive litigation, is that the damages provision in the law is subject to a notice and cure period. If a commercial establishment cures a potential infringement with appropriate signage within 30 days of receiving notice of a purported violation, no claim can be filed against the establishment.

Amazon Go stores allow shoppers to purchase items without having to queue, scan items or interact with cashiers. The Complaint alleges that Amazon scans customers' palms and unlawfully leverages technology such as “computer vision, deep learning algorithms and sensor fusion” to measure customers’ bodies in order to identify and track where they walked in the store and determine what they have purchased. The Plaintiffs claimed that Amazon captures biometric data without first providing their customers with "clear and conspicuous signs" and notify "in plain language", as required under the Statute.

On 15 May 2023, Amazon filed its response seeking to have the class action dismissed. Amazon claimed that its NYC Go stores are not subject to the Statute as they only capture "broad, distinguishing features” enabling them to distinguish between customers, and not unique physical and biological data. Amazon also submits that this "limited" collection was disclosed via its phone app used by customers to enter the Go stores. The lawsuit sought $500 for each violation of the Statute, which allows statutory damages of $500 for negligent violations and $5,000 for reckless violation.

A spokesperson for Amazon at the time denied all accusations: "We do not use facial recognition technology in any of our stores, and claims made otherwise are false.. the customer is always in control of when they choose to be identified using their palm".

On 6 June 2023, the Counsel for the Plaintiff filed his voluntary dismissal, without prejudice, concluding the class action. The reasons are unknown, but it ends one of the first tests of NYC's year-old biometric law.

The FTC's crack down on Amazon

This follows a number of data privacy lawsuits brought by the Federal Trade Commission ("FTC") against Amazon this year.

On 31 May 2023, Amazon agreed to pay a $25million civil penalty in relation to violations of the Children’s Online Privacy Protection Act Rule ("COPPA") arising from claims that its Alexa voice assistant service retained children's geolocation information, voice recordings and transcripts, longer than needed and failed to fully adhere to parents’ requests to delete it. Amazon has been ordered to delete inactive child accounts, voice recordings and geolocation information and is prohibited from using such data to train its algorithms.[2]

Amazon also agreed to pay $5.8million settlement for privacy violations in relation to its video surveillance, doorbell device, Ring. The FTC alleged that Ring employees and contractors had broad and unrestricted access to customers’ videos for years.

Finally, and most recently, on 21 June 2023 the FTC filed one of its most aggressive lawsuits against Amazon to date. The Complaint alleges breaches of the FTC Act in relation to Amazon's "years-long effort to enrol consumers into its Prime program without their consent while knowingly making it difficult for consumers to cancel their subscriptions to Prime". 

The FTC claim that Amazon uses “manipulative, coercive or deceptive user-interface designs known as ‘dark patterns’ to trick consumers into enrolling in automatically renewing Prime subscriptions”. During Amazon’s online checkout process, consumers are faced with numerous opportunities to subscribe to Amazon Prime and the Complaint alleges that in many cases, the option to purchase items without subscribing is more difficult to locate. In the first three months of 2023, Amazon reported it made $9.6billion from subscription, a 17% jump from the same period last year.

Amazon said in a statement that the FTC’s “claims are false on the facts and the law” and that “by design we make it clear and simple for customers to both sign up for or cancel their Prime membership.”

As the tech and e-commerce leader expands its trade markets to groceries and healthcare, its technology and data privacy practices will inevitably continue to face global scrutiny. In particular, the increasing legislation in this area will act as encouragement for the plaintiff bar to look to bring claims against the global tech giants such as Amazon.

[1]https://files.lbr.cloud/public/2023-03/FILED%2BCOMPLAINT%2BRodriguez%2BPerez%2Bv.%2BAmazon.pdf?VersionId=8hFYVMbat4yAk1IT5bdAydOL9hbO.6St

[2]https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-doj-charge-amazon-violating-childrens-privacy-law-keeping-kids-alexa-voice-recordings-forever