Amazon Advertising is the ad-tech division of Amazon.com, Inc., operating under Amazon's global Privacy Notice and a set of ad-specific policy pages that describe collection of behavioral, purchase, and identifier data used to serve interest-based ads across Amazon-owned and third-party properties. Amazon's own disclosures describe sharing of information with third parties for cross-context and targeted advertising, use of remarketing/conversion pixels and attribution tags, and a named corporate structure that includes Amazon Advertising LLC and the EU entity Amazon Europe Core S.à r.l. Amazon's advertising-related data practices have drawn sustained regulatory scrutiny in the EU (a CNIL cookie-consent fine and a CNPD targeted-advertising fine, the latter later annulled on procedural grounds but with underlying GDPR findings largely upheld) alongside separate FTC actions concerning Alexa and Ring data practices.
TRACK RECORD
2 ENFORCEMENT ACTIONS
[2023-05-31]
In May 2023, the FTC and DOJ charged Amazon.com, Inc. and Amazon.com Services LLC with violating the Children's Online Privacy Protection Act Rule through its Alexa voice assistant, alleging the company retained children's voice and geolocation data and undermined parents' deletion requests; Amazon agreed to pay a $25 million civil penalty and overhaul its data deletion practices.
On December 7, 2020, France's CNIL fined Amazon Europe Core €35 million for placing advertising cookies on the computers of amazon.fr users without prior consent or adequate information; the French Council of State confirmed this sanction in a June 27, 2022 ruling.
Amazon's Additional State-Specific Privacy Disclosures state that in 2025 Amazon received approximately 1.5 million data-access requests from Amazon.com customers, indicating the scale of personal data held about customers that triggers such requests.
Amazon's Privacy Notice states that Amazon collects voice, image, camera, and other personal information to provide services, and uses personal information to recommend features, products, and services and personalize the customer experience.
Amazon's Oregon Consumer Privacy Act Controller Entity Disclosure names Amazon Advertising LLC, alongside Amazon.com Services LLC and Audible, Inc., as one of the controller entities subject to the Amazon Privacy Notice.
Coverage of the 2021 CNPD fine identifies Amazon Europe Core S.à r.l., headquartered in Luxembourg, as the Amazon entity responsible for the advertising-related data processing that was the subject of the fine, with the CNPD acting as Amazon's lead EU supervisory authority.
Amazon's Additional State-Specific Privacy Disclosures state that Amazon processes personal information for purposes of cross-context behavioral advertising and targeted advertising as those terms are defined under certain U.S. state privacy laws, and identifies the categories of third parties with which such information may be shared.
Amazon's Privacy Notice discloses that third-party advertising partners may collect information about customers when they interact with third-party advertising content and services included within Amazon Services.
On December 7, 2020, France's CNIL fined Amazon Europe Core €35 million for placing advertising cookies on the computers of amazon.fr users without prior consent or adequate information; the French Council of State confirmed this sanction in a June 27, 2022 ruling.
In May 2023, the FTC and DOJ charged Amazon.com, Inc. and Amazon.com Services LLC with violating the Children's Online Privacy Protection Act Rule through its Alexa voice assistant, alleging the company retained children's voice and geolocation data and undermined parents' deletion requests; Amazon agreed to pay a $25 million civil penalty and overhaul its data deletion practices.
In May 2023, the FTC alleged Amazon's Ring subsidiary engaged in unfair or deceptive practices including improper employee access to customer videos and facial data; Amazon agreed to pay $5.8 million in customer refunds and to delete certain facial-recognition data derived from videos collected before 2018.
In July 2021, Luxembourg's CNPD fined Amazon Europe Core S.à r.l. €746 million for GDPR violations related to processing personal data for targeted advertising without a valid legal basis; in March 2026 Luxembourg's Administrative Court annulled the fine on procedural grounds (finding the CNPD had not properly analyzed intent/negligence) while upholding the substantive findings that Amazon's data processing for behavioral advertising lacked a valid legal basis, and returned the case to the CNPD for a new penalty determination.
Amazon Attribution, an Amazon Ads measurement product, generates tags that advertisers implement across search, social, display, and video ads and email marketing to track off-Amazon customer engagement, with reports covering a 14-day attribution window.