Getting my personal data from Amazon was weeks of confusion and tedium

> Given Amazon’s obsession with speed and eliminating friction to foster faster consumerism, the dawdling data solicitation process seems like it just might be intentional, designed to dissuade requests. A far simpler explanation comes through an invocation of Hanlon’s razor, the old adage to “never attribute to malice that which is adequately explained by stupidity.” Amazon whistleblowers cited by Politico have said that the company “has a poor grasp of what data it has, where it is stored and who has access to it.” If that’s the case, then it stands to reason that it can take a month or more for Amazon to process a data request. As former Amazon chief information security officer Gary Gagnon succinctly put it in an interview with Reveal, “we have no fucking idea where our data is.”

However, there are many dark patterns here unrelated to how long it took:

- Repeatedly trying to direct users away from a data request to their "Your Account" page, which has a tiny fraction of your data

- 6+ different pages and many many clicks required to make a request

- Data divided into ~100 different downloads (how many more days would it have taken to make one zip?)

Also, Amazon is an ad company. They have well-designed APIs and and tools for managing all this data because it's how they make money. When an advertiser accesses your data, they don't have to manually download 74 different zips.

> We may automatically collect information such as: Device connectivity and configuration data, including the type of device you’re using (computer, mobile phone, tablet, etc.), the operating system running on that device, the type and version of browser software you’re using, the resolution of your computer monitor or other device display, and the screen colors available on your device;

> We may obtain information about you from other sources, and combine such information with information we have collected about you through the Services. To the extent we combine such third-party sourced information with information we have collected about you on the Services, we will treat the combined information in accordance with this Privacy Policy. These third-party sources vary over time, but have included third-party donor partners and publicly available sources.

> We and our Service Providers may collect and store your information in log files as well as through the use of cookies, web beacons (also known as “tracking pixels”), embedded scripts, and other tracking technologies now and hereafter developed (“Tracking Technologies”).

> Do Not Track. Your browser or device may include “Do Not Track” functionality. At this time, we do not respond to Do Not Track signals.

> Our agents, vendors, consultants, and other service providers (“Service Providers”) may receive or be given access to your information in connection with their work on our behalf. These Service Providers are prohibited from using your information for any purpose other than to provide this assistance, although we may permit them to use aggregate information which does not identify you or de-identified data for other purposes.

Never heard of it before?

In many countries in Europe, you can expect a response within 30-90 days acknowledging receipt, and an actual response that they'll look into it and request a statement from the company after a year or so.

Sometimes you get lucky, but then only hear back that the company has now changed that one specific bad behavior (after profiting from it for a year or two) and thus the case is closed.

Zero meaningful enforcement.

Until NGOs start suing at scale, nothing will change.