• by Wendy Davis  @wendyndavis, August 13, 2021

Amazon's plan to enable consumers to use their palm prints to pay for merchandise in brick-and-mortar stores could pose new privacy and security risks, a trio of lawmakers suggest in a letter to the company.

“Amazon’s expansion of biometric data collection through Amazon One raises serious questions about Amazon’s plans for this data and its respect for user privacy, including about how Amazon may use the data for advertising and tracking purposes,” Senators Amy Klobuchar (D-Minnesota), Bill Cassidy (R-Louisiana) and Jon Ossoff (D-Georgia) write to Amazon CEO Andy Jassy.

Their letter comes around one week after reports surfaced that Amazon is offering customers a $10 credit in exchange for their palm prints, which will be incorporated into the Amazon One payment system -- currently in use in some of the company's retail stores.

“Our concerns about user privacy are heightened by evidence that Amazon shared voice data with third-party contractors and allegations that Amazon has violated biometric privacy laws,” the lawmakers write.

They are referring to a class-action complaint alleging that the Alexa device violates children's privacy by capturing and storing their voiceprints without permission from either them or their parents, and a separate class-action complaint alleging the company unlawfully obtained a database of faceprints.

The lawmakers add that storing biometric data in the cloud raises “unique security risks.”

"Data security is particularly important when it comes to immutable customer data, like palm prints," they add. 

Klobuchar and the others also say they are concerned that Amazon “may use data from Amazon One, including data from third-party customers that may purchase and use Amazon One devices, to further cement its competitive power and suppress competition across various markets.”

They are asking Amazon to answer numerous questions, including how it uses data collected through Amazon One, and whether it plans to use that data to personalize ads, offers or recommendations.

The lawmakers also want to know how many people have signed up for Amazon One, and how Amazon informed them about data collection and storage practices, among other questions.

Amazon declined to comment on the lawmakers' letter, but the company's website says Amazon One is "protected by multiple security controls," and that it will delete palm prints at customers' request.