back to article Amazon sues US state on customers' privacy

Amazon has filed suit against a US state agency that is demanding the online retailer turn over not only the sales records of nearly 50 million transactions since 2003, but also the names and addresses of the purchasers, along with details of exactly what they bought. The North Carolina Department of Revenue (DOR) is …


This topic is closed for new posts.
  1. Anonymous Coward
    Anonymous Coward


    I admit clicking the link for "Girls Gone Wild" - I never even knew they sold pr0n on Amazon before - and was quite amused by one of the reviews complaining about a "short running time" of 58 minutes. My thought was, how long does they guy need to crank one out?!?

  2. Anonymous Coward
    Anonymous Coward

    In these trying times....

    I think that the NC state is just trying to get a few extra bucks on out of state purchases and unpaid sales tax. Like most states, they have a line item on the state income tax form asking you to pay for out of state purchases that were not taxed. I can't imagine that they would get a truthful number (if any) on the income tax return. Being cash strapped, going back 6/7 years and checking purchases based on addresses/name against the state revenue data could yield a hundreds of millions if not more. They may need a classification of what the goods are since some may not be taxable.

    Surprised most states haven't asked this of most major online retailers who don't have operations in their state.

    1. James O'Brien


      Longer then 58 minutes apparently :)

      say 69 minutes?

    2. Anonymous Coward

      True, but...

      ... they don't kneed to know the specific titles.

      If books are taxed at one rate, CD/DVDs at another, and electronic goods at another, then they might need to know that Fred bought 6 DVDs and two books. But they DO NOT need to know the specific books and DVDs he bought. Which is what Amazon's stance is.

    3. Fred Flintstone Gold badge

      Artificial limit

      It's kept that short to avoid getting sued for causing Repetitive Stain Injury ..

      The one with the tissues, thanks.

    4. Anonymous Coward
      Anonymous Coward


      The preview does it for most.

    5. MinionZero
      Big Brother

      @AC: (Tuesday 20th April 2010 22:18 GMT)

      @"I think that the NC state is just trying to get a few extra bucks on out of state purchases"

      The more they spy on people the more ways they will have to find ever more ways to control, fine and ultimately monetize and so profit from controlling what people do, both online and in real life.

      So its not just about a few extra bucks. Its once again about control and profiting from that ability to control others.

      Of course as their control grows they will need bigger departments to manage it all and these departments will need more high paying top jobs. Which in turn will require more tax money to pay for it all. Which in turn will require more ways to control and tax people needing to be found. Which in turn needs bigger departments to manage it all etc.. etc.. etc.. just keep looping this paragraph until we get a bureaucratic totalitarian police state.

      The millions of people who got books from Amazon better hope they are not politically active or they will now end up on more government lists, for buying books like "A Beginners guide to spotting you now live in a Fascist police state for Dummies"(Special offer this year due to increasing demand giving Amazon a bulk discount on the book ... oh hang on that special offer is just on ;).

      I'm joking of course, but sadly just about every day these days we get more examples of the dangers of so much private information being handed over to businesses and the state power hungry control freaks. Its like watching a slow motion massive nightmare growing out of control.

  3. Barrie Shepherd

    Government snoop[ing

    Simplest thing would be for companies to delete details in sales records once the sale is complete just leaving a sales reference number and value.

    Won't happen as the companies are building their own datasets around the details for their own potentially privacy invading and targeted advertising.

    What annoys me is that some distant government and it's questionable agencies is able to find out what I have bought on line - without any protection from my own government. It's scary when you realise how many servers associated with on line transactions (sales/banking etc) are located in a country where apparent privacies mean nothing.

    1. Ammaross Danan


      The problem over The Pirate Bay being court-ordered to disclose IP addresses of people accessing their website comes to mind here. They argued that they could not due to not logging the information requested in the first place. Of course, the IP was, at some point, in their system and they chose to destroy, rather than log, that information, at which point it was argued they violated Discoverability laws. But hey, all in the name of privacy.

      1. heyrick Silver badge

        Choosing to destroy?

        I find it interesting that you suggest that not logging the IP address is choosing to destroy it. Parts of my website run script to log who is visiting, but it does that by matching the IP address to a rough location (well, a country) along with, if available, the referrer. The IP address itself is not "destroyed", it is simply not logged. I don't give a damn who visits, I'm just interested in the general demographic of "oooh, I'm popular in <xyzzy> this week!". Yeah, lame, I know...

        Perhaps The Pirate Bay's omitting of IP addresses was for similar reasons? The IP address is vitally important to the functioning of the Internet, but actually logging said IP address is not ... my site server offers *hundreds* of megabytes of gzipped apache log, I could trace every single visit and who did what right back to... God, 2005? something like that? But to be honest I'd just as happily switch that off and erase the old data. It serves no useful value to me, information overload. There's a gold mine of data of how people move around the site, what's the most/least popular, blah blah, but I'm not Amazon. The effort of ascertaining such information isn't worth the end result. Hence, I don't really actually *need* a log. I certainly don't *need* to be recording IP addresses (which I consider mostly meaningless anyway, as mine changes every 3-4 days). [you might ask why I wrote script to duplicate the apache log - easy, what I want runs to around 50K/month; apache's log runs to around 120Mb/month...need I say more?]

        So, in short, there is a third option: simply not bothering.

    2. Anonymous Coward
      Anonymous Coward


      That's why my company has all its servers in Switzerland (Luxembourg was too much out of the way). As we're not a bank and we have heavy grade employee screening in place we don't need to worry that much about data theft, but any idiot wanting to abuse the UK RIPA act to get some competitive intelligence finds it may very well be easy to get a UK warrant, but they'll be leaving a very wide paper trail before it gets anywhere near our systems..

      It means we're still fully compliant with the law (because I naturally don't want to support real criminals), but you'll have to do some heavy duty convincing before the Swiss go along, and even if they do, access is limited to the investigative judge and assisting lawyers, and they have a heavy duty of care to worry about (unlike the UK)..

      It helps having worked with police and intelligence :-)

      1. I didn't do IT.
        Black Helicopters

        The Swiss and NATO

        Does this duty of care still exist if they claim terrorism or "National Socialist (German) Historic Asset" freezes and investigations?, or would it fold under like the financial (and other) records they turned over to the US when their NATO application was threatened?

        I thought that incident (and the resulting law changes in Switzerland) was the reason why many financial institutions were transferring operations to Luxembourg...

  4. Anonymous Bosch

    US States and Privacy

    North Carolina, as with other states, believes deeply in privacy, as long as the state is solvent. Once the trough is empty, politicians, like hogs of all ilk, will stop at nothing to fill their insatiable hunger.

    1. Eddy Ito Silver badge


      No state is interested in privacy. How many states have laws restricting sex between consenting adults or even restaurant salt? Yeah, they respect privacy as long as the sheeple do exactly what they're allowed. That said, I'm sure this driven by money but I'll wager it's more than just collecting sales tax. Most likely it's a fishing expedition looking for sales of high dollar luxury items to compare against income tax returns. They are going to hope to bag people working under the table or making moonshine, etc. Just making work for the state's anal worms.

      1. Anonymous Coward

        Good lord

        Sex between restaurant salt?

  5. Anonymous Coward
    Anonymous Coward

    Amazon Purchase Records have a record of all my purchases going back 10 years! I raised this issue with them a couple of years ago but they gave me a stock answer- basically they didn't need to delete it as long as I was a customer. I took this to the Information Commissioner, but again they weren't interested. As it was inconvenient to end my account (as I sell stuff via Amazon as well & would lose all my positive feedback) I decided to leave it. eBay on the other hand doesn't seem to keep a record of what you sell (at least visible to me) for longer than 60 days.

    1. Dave Mundt

      About Ebay's data retention...

      Annoyingly enough, I could not find the video about this, but, I recall an interview with "Meg" Whitman, ex-president of Ebay, where she was cheerfully saying that Ebay has a copy of every transaction ever run through the site, from day one. This was, as I recall, as part of a presentation to a bunch of marketing guys, and, I believe she was pushing how profitable renting the demographic information Ebay keeps would be.

      So...the bottom line is that these companies all keep as much data as they can...

      Pleasant dreams

      Dave Mundt

    2. Aristotles slow and dimwitted horse Silver badge

      @ Amazon Purchase Records

      So... you were concerned enough to inform the ICO, but when you realised that it would actually involve some work on your part to try to change something, you figured it easier to carry on feeding the monster with your own greed?

      Words spring to mind. These are... hypocrite, moron and calligraphy.

      The final word listed above obviously has nothing to do with you, it just popped into my head - so don't read it.

    3. Andrew Harvey
      Big Brother

      It reminds me of the fortune I've spent...

      I LIKE being able to track back through the things I've bought over the years. If only to remind myself of just how much money I've spent on all manner of things (unfortunately no "Girls gone wild..." etc.) I absolutely prefer to have the information there - but then again I've got no particular bit of it to hide (not that I'm suggesting AC has either) (probably).

    4. MyHeadIsSpinning

      ...and there's more

      Because your data will be shared with Amazon US, which means it is kept in the US indefinitely regardless of whether or not you're a customer.

  6. Dodgy Geezer Silver badge
    Paris Hilton

    Oblig. Star Wars quote - Obi Wan fills in his tax return...

    "These are not the breasts you are looking for...."

  7. Dave Bell

    US confusion

    The trouble is that the USA has 50 states, all with their own local tax systems. There have long been "loopholes" for mail order, nothing new, but the internet makes it easier to avoid local taxes.

    In the UK, you can avoid dealing with the VAT system if you're a small enough business, no hassles over stuffing eBay with the contents of your garage.

    Last I heard, in California you have to do local sales tax paperwork if you have a garage sale.

  8. Anonymous Coward
    Thumb Up

    Amazon to North Carolina: we're going to drop you in it

    "This privacy concern is even greater for public figures who have purchased items from Amazon, because their purchase histories may generate significant political or press interest or otherwise be made public."

    Ooo, nasty.

  9. TrinityX
    Black Helicopters

    Amazon's Data Retention

    I don't mind Amazon keeping a record of what I've bought from them - it's fun (and occasionally useful) to go through it myself sometimes. I'd object a hell of a lot to some government bod helping themself to it, though. What possible LEGAL reason could they have for wanting that information?

    Good luck to Amazon in telling them to get stuffed.

    1. Tom 13

      Having a gargage sale has little to do with paying sales tax.

      Generally speaking if a state collects sales tax its residents are presumed to owe sales taxes on anything they purchase. Since the state imposes sales tax collection on businesses that operate in its jurisdiction, those are presumed to be covered (one of the few logical presumptions any politician has ever made). After that the resident is responsible for declaring sales taxes owed for things purchased, including mail order and internet. Most people simply don't declare those purchases. They are therefore subject to prosecution for tax evasion. The catch is, it has generally been more expensive to find, pursue, and prosecute such cases. The advent of computers and in particular online purchasing makes this somewhat easier. If the state can demand the purchase history for a resident it can now pursue the resident for tax evasion. The other exception is that if you purchase an item while you are physically in another state, it is presumed to be an interference of interstate commerce to tax the item when you cross the border back into your home state, and therefore the home state is not permitted to collect sales tax on those items.

      Yeah it makes my head hurt too.

      Not saying Cali doesn't have some absurd law that makes someone who has a garage sale responsible for collecting sales taxes, but that is completely unrelated to the question of whether or not residents of a state owe sales taxes.

  10. Annakan

    Maybe the problem is simply about how come these information to be retained in the first place ...

    How come they store so much private information in the first place ?

    Yes the state as no business knowing that but he would not be able to ask for it if those datas were not stored "forever" in the first place.

    I don't trust the people at Amazon to respect my privacy any more than the people working at any state agency or anywhere else.

    Because it is not a question of trust, it is a question of right. These data have NO USE for the transaction they were disclosed for now and should be deleted after a few weeks or months.

    And it should be the law.

    In a democracy you don't track your citizens by defaults. Only if a criminal investigation is needed not beforehand.

    Die Panopticon.

  11. The Fuzzy Wotnot

    Balls to privacy!

    This has nothing to do with customer privacy per se, if customers find out Amazon handed over the fact that they bought Pervy NIghts in Bangkok, they will never shop at Amazon again or at least think twice in future!

    All about Amazon's bottom line, which is fair enough, but don't come over all Guardians of Privacy, tell it like it is!

    1. Pablo


      It's not like you would expect better from any other company. They're looking out for their customers. Sure they only do it because they want our continued business, but that's about as ethical as corporations get, so I'm not complaining.

  12. Simon B
    Thumb Up

    Nice 1 Amazon!

    Nice 1 Amazon for protecting us :)

  13. The Unexpected Bill
    Black Helicopters

    Good on them!

    That is, if it's for the right reasons.

    In a sort of utopian way, I'd like to think that Amazon was doing this out of some deep-seated concern for their customers' privacy. Still, there's this chiding little voice coming from somewhere that says the opposite--they're only doing it for attention or maybe just because it might stress some of their corporate neurons to prepare all that information and turn it over...and later, when it's convenient, they'll toss it out to whatever marketer is willing to pay for it.

    If it comes to pass, though, I'm sure they will not get as accurate of a picture as they had hoped to. I have purchased stuff for my brothers, work, dogs, cats, etc through my Amazon account, and I'm sure that serves to broaden my profile considerably. Some of those things (video games in particular) are things that I wouldn't normally buy. I suspect many others have done the same...

This topic is closed for new posts.

Biting the hand that feeds IT © 1998–2019