advertisement
advertisement

This is page 2 of:

Amazon Patent’s Privacy Pratfall

July 8th, 2010

Unless Amazon stitches in some safeguards and limits, a nosy neighbor or burglar could spend plenty of time nudging out nuggets of private information that Amazon never planned to reveal. In the wrong hands, that fact could make playing “20 Questions” really worth the trouble. There’s gold in them thar gift suggestions.

And while the Patent application mentions privacy, it’s not in the context of keeping a customer’s purchases or other information secret. For this gift recommendation engine, it’s all about keeping the gift a secret. As the Patent Pending says: “The AGR system will attempt to provide only the minimal amount of information necessary about purchases made by users in order to protect the privacy of those users and to maintain surprise about gifts to be received.” (Yep. Depending on how much information is revealed through gift suggestion hints, the customer recipient may get more of a surprise than Amazon counted on.)

On the other hand, the system also reflects some good thinking on age issues. For example, let’s say an Amazon customer has a 5-year-old niece. The system would remember that–nothing new–and recommend other 5-year-old girl gifts. But the system would also note the calendar and change its recommendations in a year to 6-year-old girl gifts. (This approach wouldn’t always be appropriate; for example, a kindergarten teacher may perpetually want to know what 5-year-olds like. But it’s a very good start.)

The system also wants to use the data about when a customer is about to get a gift from yet another person. In this case, Jane is having a birthday, you want to get her a gift and you ask Amazon if this particular Blu-Ray movie is a good choice. Amazon’s system would know that someone else has already purchased that disc for Jane and that it’s in transit. As a result, the system would say the gift was inappropriate.

In fairness, it should be pointed out that large companies will often have Patents–and certainly Patent Pendings–for things they never end up launching. Amazon itself has various Patents it has yet to turn into a product or a feature. Still, at some level of Amazon, this Patent Pending does reflect its executives’ thinking.

Such a step should clearly have safeguards built in, including customer opt-in (or at least an opt-out) and various privacy restrictions. The Patent Pending doesn’t mention these. But as a legal document, the absence of such limits does not necessarily mean Amazon isn’t considering them.

From a business standpoint, though, this move is wonderfully strategic. By growing from making recommendations to current customers to being a source of data for lots of other purchases, Amazon could be well-positioned for major growth. It’s also a deliciously non-vicious revenue cycle, as people go to Amazon to learn what gifts to buy and end up buying stuff for themselves while there.


advertisement

3 Comments | Read Amazon Patent’s Privacy Pratfall

  1. Glanglois Says:

    Nicely done, Erik. It’s scary stuff and you explained it well. Thanks!

    However … “Patent Pending(s)” ???

    Where do we find “patent pending” used as a thing rather than a simple, short statement that a patent is pending for the invention?

    When patents are pending, they’re simply pending patents, right?

    And why on earth do we find “patent” capitalized in this piece? Even the United States Patent and Trademark Office doesn’t capitalize the word except in headlines, document titles, etc.

    OK, so it’s a nit. You’re in a hurry and supported by an editor who has less time than you do to bang these things out. It’s just the Internet.

    I don’t have an editor so I’m sure I’ve used sloppy language somewhere in the above ….. Mea culpa.

  2. Bob LeMay Says:

    Okay, this begs the question: How does Amazon know who the “stranger” is? Certainly a name isn’t sufficient: I can’t just say I want to buy a gift for Jane Smith, as there must be hundreds or thousands in the database. Will the system prompt me for the correct address? Because this could allow someone to “look up” a person who may not be listed in other online directories.

    And the example of the 5-year-old: Do I have to provide the name and age? It is unlikely that the 5-year-old will be in Amazon’s database–who lets 5-year-olds shop online under their own name? So now I am ADDING the 5-year-old to Amazon’s database FOR THEM! Along with the address, etc.

    Now, you could claim that many gifts are purchased for 5-year-olds from Amazon, so they are already in the “ship-to” database. But those names are not specifically tied to the age of the recipient; even if the gift is age-specific, it may be shipped in the parent’s name.

    And, since many of us buy from multiple online sources, Amazon’s database on us is necessarily incomplete, so the example of indicating that a CD has already been purchased for someone would only occasionally be possible.

  3. Glanglois Says:

    Bob, you’re quite right but missed the point: of course Google will need access a great deal more data, specifically including that from the infamous third parties – perhaps public records of various sorts. Then they can cross-reference the data to uniquely identify all of us. All under the name of making it easy to purchase gifts for one another. How innocuous does that sound?

    This is one more strategem Google is using to amass the Database of Destiny (DoD) that will allow them to insinuate themselves into our lives at every point.

    Let’s all re-read George Orwell, shall we?

Newsletters

StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!
advertisement

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

StorefrontBacktalk
Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.