Amazon’s Grocery Store “Innovation” Is Out of a Bad Sci-Fi Novel. Make It Stop. (2024)

I have fond memories of shopping at Whole Foods Market. Trips where I’d shell out at least $100 would yield a bag of overpriced, but mostly nutritious, joy. Nowadays, parting with my hard-earned dollars at the Amazon-owned grocery store leaves me feeling … uneasy.

This change of heart is mostly due to the rollout of Amazon One, a scanning device that collects biometric data, now located at Whole Foods checkout counters across the U.S. It works by capturing a photo of your palm print and underlying vein structure, then transforms your body parts into a payment method.

If you’re wondering why you have to overspend on groceries and give up your biometric data to do so, you’re not alone. Like me, you probably just wanted a little kombucha, as a treat. Instead, you were prompted to hand over your irrevocably personal data to a trillion-dollar company.

The public’s response to Amazon One has been mixed. “The first time I noticed the scanner, I’m pretty sure I audibly muttered something to myself about it, like, ‘Absolutely f*cking not,’ ” said one Prime member and frequent Whole Foods shopper who asked to be anonymous.

“A lot of it is based on a gut feeling. It’s interesting how I’ll mistrust Amazon, but I’m willing to accept some of their services because they cast a wide net,” said Doug Saribay, a Whole Foods shopper who does not use palm-to-pay.

What Amazon One actually solves for its customers remains to be understood. Between connected payment options (apps, digital gift cards) and offline ones (cards, regular old cash, checks), do we really need to swipe our palms?

In a fictionalized setting, advanced technologies are often controlled for the betterment of mankind. In the Dune series, author Frank Herbert invented a world in which artificial intelligence nearly won a war for control, leading to a ban on all thinking machines so “man may not be replaced.” Star Trek creator Gene Roddenberry’s hopeful optimism imagined a post-scarcity future where a diverse crew of space explorers pursued the furthest reaches of the galaxy for purely anthropological, never exploitative, purposes.

But our actual tech overlords have proven themselves incapable of self-policing for the greater good. We’ve generally come to accept that when a product is free to use, we are not simply the users: We become the product, monetized over and over.

Most people expect this when logging into social media or using a search engine. By normalizing biometric data as a means to pay for goods, Amazon has managed to sell a useful fiction, one that is much more dystopian than aspirational.

Amazon touts its palm-to-pay service as a “fast, free identity service” to “help you move seamlessly through your day.” Under its FAQs, the company claims that “Amazon One palm data is also not used by Amazon for marketing purposes, and will not be bought by or sold to other companies for advertising, marketing, or any other reason.”

Beyond the marketing blog excerpts and links they provided, I asked an Amazon spokesperson to dig deeper into this matter of data and privacy: How does Amazon One fit into the big picture of Amazon customer data? How is Amazon One data used? Is Amazon One customer data collected when inside Amazon-owned locations?

“When you use Amazon One, Amazon One doesn’t track what you do or buy after entering any location. That data is not associated with your biometric identity, and we built Amazon One that way intentionally,” said an Amazon spokesperson.

On the surface, this statement may be reassuring. But a basic read-through of Amazon’s privacy notice offers an entirely opposing take. The company reserves the right to use “cameras, computer vision, sensors, and other technology to gather information about your activity in the store, such as the products and services you interact with.” It’s a classic case of Big Tech doublespeak: There’s what’s advertised to customers—convenience, security, and privacy—and then there’s what the company claims for itself in its policies and terms of use.

Elsewhere, the company identifies a broad and vague list of scenarios in which your data may be shared. “Amazon may disclose personal information in connection with business transfers (for example, as part of a merger) or for the protection of Amazon or others.” And, Amazon “employ[s] other companies and individuals to perform functions on our behalf,” meaning external contractors may have access to your data.

It’s clear that Amazon does not want its grocery shoppers to think too hard about handing over their biometric data (or any type of data, for that matter) in exchange for a few moments of convenience. While using Amazon One isn’t mandatory, shoppers are encouraged to sign up for Amazon One at checkout, as a queue of customers await their turn—not exactly an ideal moment to review a 3,642-word privacy policy and consider its long-tail implications.

“Privacy policies are presented as something useful for individuals,” said Calli Schroeder, senior counsel and global privacy counsel at the Electronic Privacy Information Center, a privacy and civil rights research institution. “Even pretty well-written ones are not … really there to help the individual. They’re there to cover the company’s back.”

Passwords can be changed in the event of a hack; palms cannot. Naturally, Amazon’s terms of use do not identify available recourse or compensation if one’s handprint were to be stolen. There is no legal precedent on a comparable scale, and affected consumers would likely be facing lengthy, expensive battles to seek justice.

“It’s really simplistic to say that something is convenient, when there’s nothing convenient about having your biometric data hacked, shared with other entities you don’t know, or shared with law enforcement,” said Caitlin Seeley George, campaigns and managing director at Fight for the Future, a digital-rights advocacy group.

So who actually benefits from the convenience of Amazon One? Amazon, of course—and that’s pretty much it. Faster checkout lines allow more products to be sold. Adding a biometric identifier increases the value of a customer dataset, which already includes more personal information than a layperson could conceive of: demographics, address, contact information, education, ethnicity, purchase history, personal preferences, children, family members, recent behaviors, and so much more.

“What’s the big deal [about] a palm print at this point? They already have so much information about me,” Lloyd S., a Prime member and Whole Foods shopper, said. “They probably know more about me than my family does.”

As a business that has leveraged proprietary customer data to build an empire and continues to acquire ownership of essential services, such as pharmacies and urgent care centers, the stakes for individual privacy get even more personal. With Amazon One, the company may be most concerned with one-upping its competitors, Apple and Google, which already collect retina and fingerprint data from millions of device users. Each of these tech giants continues to amass war chests of consumer data and increase their respective market caps, especially in the absence of a national privacy law.

Consumers can request the data Amazon has on them, but the legal protections they have will depend on where they live. Illinois is the only state with a standalone biometric privacy law. Washington’s broadly scoped My Health My Data Act gives individuals more control over their biometric data. Seventeen states have adopted comprehensive data privacy laws, many of which include biometrics, that require businesses to respond to consumer requests for access to and deletion of personal data within a set period.

Still, transparency is not a guarantee, and corporate compliance with these relatively new laws is largely untested. Amazon “might claim they’re exempt from disclosing [the actual hand, palm, or vein pattern] because it would reveal their proprietary trade secret,” said Taylor Kay Lively, an attorney who specializes in data privacy cases.

Only some of these states establish the right to directly sue a company like Amazon for misuse or exploitation of personal data, as opposed to relying on action from the state attorney general’s office.

“Pushing for a federal law on biometrics is a completely reasonable ask … as is forcing companies to be much more transparent,” Schroeder said. “It would be much easier to have one global standard instead of having to adjust practices for every jurisdiction.”

If a sci-fi-esque technology presents itself as convenient, safe, and free, ask yourself: Would you write a blank check to Jeff Bezos, with no guarantee it wouldn’t overdraft today, tomorrow, or unspecified decades into the future? With few opportunities for recourse? In this economy, I’d think not.

“To participate in the modern world, you have to give up some of your information. But you don’t want to share more than is necessary,” said Matthew Neu, who prefers to shop at his local co-op. “I don’t want an algorithm-driven experience in the grocery store.”

Update, June 18, 2024: This article has been updated to clarify what personal data Amazon makes available to users.