A class of consumers has filed a class action lawsuit against Amazon.com, Inc., alleging the technology giant surreptitiously tracked and sold their sensitive data without their consent. The lawsuit, led by plaintiff Felix Kolotinsky, was filed on January 29, 2025, at the US District Court for the Northern District of California, San Francisco Division. Kolotinsky and the other plaintiffs, representing California residents, claim Amazon’s practices violate state data collection laws.
The lawsuit claims Amazon collected “timestamped geolocation data” from consumers, providing insights about where they live and work. This data collection allegedly extends to sensitive personal information concerning consumers’ religious beliefs, sexual orientation, and medical history. The plaintiffs argue Amazon amassed this information surreptitiously, without obtaining consent or offering any mechanism for opt-out from such invasive data collection.
According to Kolotinsky, the provisions of California Penal Code §638.51 and §502 form the crux of the lawsuit. The first statute prohibits the use of “pen registers” without prior court approval, which are defined as devices or processes recording dialing, routing, or signaling information but not the contents of communication. Kolotinsky contends Amazon's software development kit (SDK) acts as such a device, collecting timestamped geographical information and device fingerprint data from consumers’ smartphones.
This aspect of the lawsuit sheds light on how seemingly innocuous smartphone applications could be conduits for extensive data tracking—a concern many consumers have voiced. Kolotinsky draws parallels between mobile devices and computers, asserting they qualify as “computer systems” protected under §502, known as the Comprehensive Computer Data Access and Fraud Act (CDAFA). The plaintiff claims Amazon unauthorizedly accessed class members’ devices to harvest data continuously.
Sketching the timeline, Kolotinsky states the SDK raised notable alarm, with growing concerns about how its integration with mobile platforms facilitates unsolicited surveillance of personal data. Earlier, similar legal actions against tech companies such as Twilio were spotlighted, where the latter faced accusations of having infringed upon privacy laws by collecting personal data, including names and email addresses, without user permission.
The rising tide of consumer protection lawsuits has underscored the urgency for companies to rethink their data collection practices. Victor Fonseca, legal analyst and tech consultant, remarked, "The increasing scrutiny on tech companies signals the consumers' demand for accountability. This case brings renewed focus to tech giants like Amazon, prompting reflections on ethical data practices."
Experts suggest the growing awareness of privacy rights among consumers is catalyzing litigation against tech powerhouses, with increasing public demand for transparency. Just last week, the European Consumer Organization stirred up similar concerns, urging EU authorities to examine whether Meta violated consumer rights by employing confusing interfaces to secure user consent for data collection.
Reflecting on the ramifications of this lawsuit, consumer rights advocates note the case may serve as a bellwether for evaluating how legislative measures can shape data protection frameworks. One such advocate voiced, "This case highlights the pressing need for stronger data privacy regulations. Consumers should expect stringent protections against unauthorized access to their data—it's high time the rules caught up with technology trends."
With technology corporations facing growing backlash over privacy scandals, the outcomes of lawsuits like Kolotinsky’s against Amazon could influence how future data governance evolves. Whether the court will side with the plaintiffs remains to be seen, but as data tracking practices receive increased scrutiny, the potential for reform is significantly growing.
This case joins the growing list of actions targeting big tech’s data practices and emphasizes the precarious balance between business interests and consumer privacy rights.