Jeffrey Dastin and Chris Kirkham

(Reuters) – As a Virginia lawmaker, Ibraheem Samirah has studied internet privacy issues and debated how to regulate tech firms’ collection of personal data. He was still shocked to discover the details that Amazon.com Inc (NASDAQ) had on him.

More than 1000 contacts were made by the e-commerce titan from his mobile phone. It kept records about exactly which Quran portion Samirah had listened, as it was a Muslim-raised company. The company knew every search he had made on its platform, including one for books on “progressive community organizing” and other sensitive health-related inquiries he thought were private.

“Are they selling products, or are they spying on everyday people?” asked Samirah, a Democratic member of the Virginia House of Delegates.

Samirah was one of the few Virginia lawmakers who opposed an Amazon-friendly state privacy bill. It passed earlier in the year. At Reuters’ request, Samirah asked Amazon to disclose the data it collected on him as a consumer.

It collects vast amounts of data about its U.S. clients and made that information available to everyone upon request last year. This was after it failed to repeal a California law in 2018 requiring this disclosure. You can request the data from Amazon.com by filling in a form. https://www.amazon.com/gp/help/customer/display.html?nodeId=GXPU3YPMBZQRWZK2)

Seven Reuters reporters obtained the Amazon files as well. The data reveals the company’s ability to amass strikingly intimate portraits of individual consumers.

Amazon uses data collected on customers to improve its Alexa voice assistant and e-commerce platform. Alexa-enabled devices make recordings inside people’s homes, and Ring security cameras capture every visitor.

Such information can reveal a person’s height, weight and health; their ethnicity (via clues contained in voice data) and political leanings; their reading and buying habits; their whereabouts on any given day, and sometimes whom they have met.

One reporter’s dossier revealed that Amazon had collected more than 90,000 Alexa recordings of family members between December 2017 and June 2021 – averaging about 70 daily. The recordings included details such as the names of the reporter’s young children and their favorite songs.

Amazon captured the children asking how they could convince their parents to let them “play,” and getting detailed instructions from Alexa on how to convince their parents to buy them video games. Be fully prepared, Alexa advised the kids, to refute common parent arguments such as “too violent,” “too expensive” and “you’re not doing well enough in school.” The information came from a third-party program used by Alexa called “wikiHow” that provides how-to advice from more than 180,000 articles, according to Amazon’s website.

Amazon stated that they do not have wikiHow. However, Alexa may respond to inquiries with links from web sites.

Some recordings included conversations between relatives using Alexa devices for communication across the home. A number of recordings showed children saying sorry to their parents after they were disciplined. Others picked up the children, ages 7, 9 and 12, asking Alexa questions about terms like “pansexual.”

In one recording, a child asks: “Alexa, what is a vagina?” In another: “Alexa, what does bondage mean?”

Amazon stored recordings on the reporter’s computer before they disclosed their family records.

Amazon says its Alexa products are designed to record as little as possible, starting with the trigger word, “Alexa,” and stopping when the user’s command ends. The recordings of the reporter’s family, however, sometimes captured longer conversations.

Amazon stated that it had scientists and engineers who are working on improving the technology to avoid triggers which prompt recording. Customers are notified when Alexa accounts have been set up by Amazon that recordings will be kept.

Amazon stated that it uses personal data to enhance products and tailor them to customers. Asked about the records of Samirah listening to the Quran on Amazon’s audiobooks service, Amazon said such data allows customers to pick up where they left off from a prior session.

Amazon stated that customers can only delete large amounts of their personal data by closing their accounts. Amazon stated that it may retain some customer information such as purchases history after closing an account to meet legal requirements.

Amazon stated that customers can adjust the settings of voice assistants to reduce data collection. Alexa users have the option to stop Amazon recording and having them removed periodically. And they can disconnect their contacts or calendars from their smart-speaker devices if they don’t want to use Alexa’s calling or scheduling functions.

A customer can opt out of having their Alexa recordings examined, but they must navigate a series of menus and two warnings that say: “If you turn this off, voice recognition and new features may not work well for you.” Asked about the warnings, Amazon said consumers who limit data collection may not be able to personalize some features, such as music playback.

Samirah, 30, got an Amazon Alexa-enabled smart speaker during last year’s holiday season. After only three days of using it, he returned it to Amazon after discovering it had been recording recordings. “It really sketched me out,” he said.

It had already collected all his contacts from his phone, which is part of the feature that lets users make calls via their device. Amazon stated that Alexa users need to give their permission for them to view phone contacts. To delete records from Amazon, customers must not only delete Alexa but also disable phone contact access.

Samirah stated that he was unnerved by the fact Amazon kept detailed records about his audiobook reading and Kindle sessions. Samirah said that he was shocked to discover information in his Amazon file about how he listened to Quran. This made him think about U.S. intelligence agencies and police who had been monitoring Muslims suspected of terrorist activities after Sept. 11 2001 attacks.

“Why do they need to know that?” he asked. Samirah’s term ends in January, after he lost a bid for re-election earlier this year.

Sometimes, law enforcement agencies request data from tech companies about customers. Amazon discloses that it complies with search warrants and other lawful court orders seeking data the company keeps on an account, while objecting to “overbroad or otherwise inappropriate requests.”

Amazon data, for three years ended June 2020, shows that the company has at least partially fulfilled 75% subpoenas. Search warrants and other court orders requesting data regarding U.S. citizens. Only 38% of these requests were fully satisfied by the company.

Amazon has stopped disclosing the frequency it responds to these requests since last year. Asked why, Amazon said it expanded the scope of the U.S. report to make it global, and “streamlined” the information from each country on law enforcement inquiries.

The company said it is obligated to comply with “valid and binding orders,” but that its goal is to release “the minimum” required by law.

Amazon’s 3,500-word privacy policy, which links to more than 20 other pages related to privacy and user settings, gives the company wide latitude to collect data. Amazon said the policy describes its collection, use and sharing of data “in a way that is easy for consumers to understand.”

It can be quite private. Amazon’s Kindle e-readers, for instance, precisely track a user’s reading habits, another reporter’s Amazon data file showed. The disclosure included records of more than 3,700 reading sessions since 2017, including timestamped logs – to the millisecond – of books read. Amazon keeps track of words that have been highlighted or searched for, as well as pages and promotional offers.

It showed, for instance, that a family member read “The Mitchell Sisters: A Complete Romance Series” on Aug. 8, 2020, from 4:52 p.m. until 7:36 p.m., flipping 428 pages.

Florian Schaub, a privacy researcher at the University of Michigan, said businesses are not always transparent about what they’re doing with users’ data. “We have to rely on Amazon doing the right thing,” he said, “rather than being confident the data can’t be misused.”