Travel & Transit Apps · Biometric Payment · Data breach
Amazon One
Headline
Amazon One is palm-recognition biometric payment, and palm vein geometry is permanent in a way no credential should be - you cannot reissue a hand.
Not independently verified. Verification status: Pending - severity 4/5, no source yet. Publish state: blocked needs source.
Amazon One is palm-recognition biometric payment, and palm vein geometry is permanent in a way no credential should be - you cannot reissue a hand. Amazon One readers were deployed at Whole Foods, Panera, a Denver concert venue and some healthcare sites, where enrolment was offered as a convenience at a moment when the queue is long — but Amazon wound the service down in 2026 (healthcare palm authentication ended March 31, 2026; retail June 3, 2026), with user palm data reportedly deleted afterward. Illinois BIPA has produced settlements in the hundreds of millions over facial and fingerprint data, and Texas CUBI produced $1.4 billion from Meta and $1.375 billion from Google - so this is a category with demonstrated legal exposure and, for the consumer, no recovery mechanism if the template is ever compromised.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Pending - severity 4/5, no source yet.
Terms
Arbitration
Same as Amazon overall (see Amazon row, Consumer Apps tab).
Data sharing
Amazon One uses PALM-RECOGNITION BIOMETRIC scanning for payment/identity verification, deployed across Whole Foods (see that row, Consumer Apps tab) and other retail/venue partners — a genuinely novel biometric-payment category distinct from facial recognition. Amazon's OWN privacy materials state palm data is encrypted and stored separately from other Amazon account data, though privacy advocates have raised general concerns about biometric payment systems' long-term data-retention and third-party-venue-sharing practices (Amazon One was also offered at some third-party venues and retailers, e.g., Red Rocks Amphitheatre in 2021 and Panera; the service was discontinued in 2026 — retail palm authentication ended June 3, 2026 — with user palm data reportedly deleted).
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not verified this pass — Amazon routes privacy requests through its in-account privacy portal
Legal notice. PUBLIC COMPANY (AMZN). Service route: c/o General Counsel / Corporate Secretary, Seattle, Washington — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Amazon.com, Inc., 410 Terry Avenue North, Seattle, WA 98109-5210, USA
Evidence
No claims have been itemized for this row yet.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| company_filing · 2024-08-06 www.courtlistener.com/docket/67483468/67/mallouk-v-amazoncom-inc/ | whole row | Unassigned | confirmed | ““understand and consent to the collection, use, and storage of your data, including your palm signature, for the purpose of verifying your identity” Quote basis: not recorded. |
| none | whole row | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
| company_filing · 2024-08-06 www.courtlistener.com/docket/67483468/67/mallouk-v-amazoncom-inc/ | whole row | Unassigned | corrected | “Amazon One palm scanners are located in various stores throughout New York City, including Whole Foods Market locations and in certain third-party locations.” Quote basis: not recorded. |
| none | whole row | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
| none | whole row | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
| none | whole row | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy one.amazon.com/privacy | Not fetched yet | NO (HTML only) |
| Terms of service one.amazon.com/terms | Not fetched yet | NO (HTML only) |
| Website amazon.com | Not fetched yet | — |
| Primary source No URL recorded Verification: Pending - severity 4/5, no source yet | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No comprehensive state privacy statute on file for Washington