How is this different than Amazon literally shipping packages to someone's home address and having their billing information?
- Annual Report on Compliance (ROC) by a Qualified Security Assessor (QSA)—also commonly known as a Level 1 onsite assessment—or internal auditor if signed by officer of the company - Quarterly network scan by Approved Scan Vendor (ASV) - Attestation of Compliance form
https://squareup.com/ca/guides/pci-compliance
Not sure how much "protection" that provides, but at least it's an area where Amazon itself is not the sole arbiter of what is considered OK and not OK when it comes to data collection.
The bigger issue is disclosure and informed consent. Amazon buyers know when they purchase a product that the vendor has their address and CC info, which they believe is protected. They may not know that the Alexa they bought as a holiday gift for their nephew is giving up location data to a team of "thousands of employees and contractors, spread across work sites from Boston to Romania and India."
If I'm asking a company to ship something to my home address, I've given explicit and active consent to them to have and use that information for that purpose.
Combining the knowledge of what you say inside with knowing where you live is different than the knowledge of a purchase you made and where you live.
Also, I would certainly assume Amazon to know my home address if I bought Alexa and shipped it there. But most people wouldn't assume that Amazon actual employees are listening to their conversations who also know where you live. HN might expect that, but Amazon makes a privacy promise that is violated here, as described in the article:
> In an April 10 statement acknowledging the Alexa auditing program, Amazon said “employees do not have direct access to information that can identify the person or account as part of this workflow.”
Bloomberg is saying that this statement by Amazon was false, because the location information from the Alexa devices can, in some cases, identify the individual or account "as part of this workflow".
The headline and your interpretation are leaning very heavily on the "ZOMG SPYING!" angle, where... I honestly don't see it. This seems like pretty heavy spinning.
Yes, they should probably have a policy of scrubbing data better before voices get presented to human ears.
> Combining the knowledge of what you say inside with knowing where you live is different than the knowledge of a purchase you made and where you live.
Technically true, but... is it actually worse? I can see convincing arguments made either way, frankly.
Well yes I know, I figure this data is likely years-old or whatever, I don't see how that matters? I didn't bring up real-time access and I'm well aware that Amazon doesn't (likely) even have that capability. Nobody here is asserting real-time access to microphones!
> Technically true, but... is it actually worse? I can see convincing arguments made either way, frankly.
Yes, it is much much worse, because it is a direct violation of their own statements about privacy. Amazon makes no statement about their box packers or labellers not knowing your address, because they obviously have to know that in order to put the label on or knock on your door.
But Amazon does make a privacy promise to not do what they are doing here. So they are totally different things and it matters due to customer expectation and their own written words.
Edit: I'm "posting too fast" and am not allowed to reply to the user below. I will state that I do care about privacy, I was simply taking the simplest debate stance to demonstrate that the two concepts are quite different (package delivery knowing your address and human reviewers of your voice commands knowing your address).
If you look at my comments on this article you will surely see that I care about privacy.
Yeah, you're spinning here. The headline and your hyperbole above quite clearly want to frame this as a "Amazon is spying on your family" thing. And when challenged, you're retreating to a bland critique of their process adherence.
Your response sounds crazy to me.
I absolutely care significantly about my ability to make informed decisions about my privacy. Such informed decisions are based upon having transparent and honest communication about the trade-offs.
It's like saying we shouldn't have a concept of informed consent when making a medical decision because I probably would consent anyway.
I should have the right to make an informed choice. I can do that if they are honest about their written policy. If they are lying about their written policy, then I no such choice is possible.
So, ultimately, yes, I'm absolutely concerned with Amazon's fidelity to their written policy. That's a huge issue!
So fine, Amazon didn't honor their agreement and they should fix it. They didn't spy on your kids.
If the don’t honor agreements about handling data it means means they can’t be trusted with that data.