Key points
- Malwarebytes Labs found Amazon tracks body and family details without explicit user opt-in.
- The research indicates no clear method exists for users to opt out of this data collection.
- Amazon maintains these detailed profiles despite users not signing up for such tracking.
Business leaders must assess how third-party data collection impacts customer trust and regulatory compliance. Malwarebytes Labs published findings in October 2026 showing Amazon builds extensive personal profiles. These profiles include sensitive details about users' bodies and family structures. The research highlights a significant gap between user expectations and actual data practices. Organizations should review their own data handling policies in light of these findings.
In plain English
Amazon collects more information than most users realize. The technology giant compiles data regarding physical attributes and family relationships. Users did not explicitly sign up for this level of surveillance. Malwarebytes Labs could not identify a way for consumers to stop this specific tracking. This lack of transparency creates privacy risks for individuals. Companies rely on such platforms, making this issue relevant for operational security. Understanding what data is collected helps leaders mitigate reputational risk.
The background
The report titled "Amazon has an uncomfortably personal profile on you" details these findings. Malwarebytes Labs conducted first-hand research to uncover the extent of data aggregation. The investigation revealed that Amazon assumes it knows intimate details about users. This assumption occurs without proper consent mechanisms. The absence of an opt-out feature is the core concern. This practice contrasts with growing global demand for data privacy controls. Businesses using Amazon services must understand these underlying data flows.
What changes now
This discovery forces a reevaluation of vendor risk management. Organizations must consider the implications of data brokers and platform providers. If a major vendor collects sensitive data without opt-out, customer trust may erode. Leaders should demand transparency from their technology partners. This incident serves as a case study in opaque data practices. It underscores the need for rigorous third-party audits. Companies must ensure their vendors align with their privacy standards.
What to do and how to stay safe: Amazon
- Audit current vendor contracts to check for clauses allowing extensive personal data collection without explicit consent.
- Review internal privacy policies to ensure they address third-party data aggregation practices like those found by Malwarebytes.
- Monitor vendor communications for updates on opt-out mechanisms or changes to data collection scopes.
- Educate staff on the importance of verifying what data is shared with major platform providers during business operations.
Step-by-step guide: Smartphone Security Updates for Small Business Operations
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific data is Amazon collecting without consent?
Malwarebytes Labs found Amazon collects data regarding users' bodies and family structures without explicit sign-up or opt-out options.
Can users stop Amazon from collecting this data?
According to the research, Malwarebytes Labs could not find a way for users to opt out of this specific data collection.
When was this research published?
The findings were published in October 2026 by Malwarebytes Labs in a report detailing Amazon's personal profiling practices.
