• by Wendy Davis  @wendyndavis, March 17, 2023

A New York City resident is suing Amazon for allegedly failing to comply with a city law requiring companies to post prominent notifications about their collection of biometric data.

“Since 2019, when Amazon first opened several Amazon Go stores in New York City, Amazon has collected, converted, retained, and stored the biometric identifier information of all customers who enter its Amazon Go stores,” Brooklyn resident Alfredo Rodriguez Perez alleges in a class-action complaint filed Thursday in U.S. District Court for the Southern District of New York.

He alleges that Amazon violated the city's Biometric Identifier Information Law, which went into effect on January 15, 2022 and requires companies that collect biometric data to notify consumers via a “clear and conspicuous sign” near the entrance. That law allows consumers to sue for up to $5,000 per violation.

The complaint alleges that Amazon failed to post any notification about its use of biometrics until March 14 of this year, shortly after The New York Timesreported that an Amazon Go store “awash in cameras, sensors and palm scanners” lacked signage about biometric identifiers.

What's more, according to the complaint, the signs posted after March 14 fall short of compliance, because “the color, style, and font size of the sign do not attract the attention of customers who enter the store,” and because the signs don't include all the information required by the city code.

In the complaint, Rodriguez Perez says Amazon's Go stores use biometrics -- including palm scans and camera images -- to identify consumers.

Amazon allegedly draws on the data as part of its cashless checkout procedure, which allows customers who have registered their palm prints with Amazon One to make purchases by scanning their palms.

If customers don't register their palm prints, they must either scan a credit card connected to their Amazon accounts, or provide other data about their accounts, in order to enter the store.

An Amazon spokesperson stated that customers are “always in control of when they choose to be identified using their palm.”

“Only shoppers who choose to enroll in Amazon One and choose to be identified by hovering their palm over the Amazon One device have their palm-biometric data securely collected, and these individuals are provided the appropriate privacy disclosures during the enrollment process,” the spokesperson stated.

But Rodriguez Perez claims that Amazon collects a broader range of biometric data than palm prints.

Amazon identifies every shopper “based on the size and shape of that person's body, and then continues to track that person and analyze the person's movements based on their size and shape until the person leaves the store,” the complaint alleges.

The city's statute defines biometric identifier information as physiological or biological characteristics used to identify individuals, including retina scans, fingerprints, voiceprints, scans of hand or face geometry, or “any other identifying characteristic.”

Rodriguez Perez specifically alleged that he entered an Amazon Go store in Manhattan on January 30, 2023, by scanning a code in his Amazon app.

“Upon entering the store, Amazon's computer vision identified Mr. Rodriguez Perez through the shape and size of his body and then tracked every single movement that Mr. Rodriguez Perez made in the store to identify where he went, what items he removed from the shelves, and what items he put back on the shelves,” his complaint alleges.

He left the store with some groceries, and subsequently received an Amazon receipt for $13.17, according to the complaint.

Several weeks later, he officially notified Amazon that he believed the store was collecting biometric information, including people's “bodily characteristics,” in order to identify customers. He said Amazon failed to respond.

He is seeking monetary damages as well as a court order requiring Amazon to comply with the city's biometric notification law.

His lawyers include Albert Fox Cahn, founder and director of the privacy advocacy organization Surveillance Technology Oversight Project.