Amazon imagines a world where you pay with your hand. A critic calls it 'coercion by convenience’

SAN FRANCISCO — It sounds so easy. Buy groceries without a wallet, phone or smartwatch on you. Stroll into buildings and events without showing a ticket or a pass. All it requires is a quick flick of your wrist as you hold your chosen hand over a black circle, like magic.

Amazon announced a new palm-recognition system recently that lets people shop in two of its Amazon Go stores by scanning their palm at the entrance. The store automatically tracks what products they pick up and then charges the credit card associated with their hand.

It's the latest in a long line of product announcements from the company to raise privacy or security concerns while selling its vision of an automated, frictionless future.

Called Amazon One, the palm-scanning system is only in two Go stores in Seattle at the moment but with the massive online retailer behind it, has the potential to become a standard form of payment of even identification. Amazon’s plan is to start selling it as a service to other companies, such as retail stores, office buildings that use ID badges to get in and out, or stadiums that require tickets for events.

And last month, the company showed off a prototype of a personal indoor surveillance drone called the Ring Always Home Cam. In addition to using Echo speakers to normalize having an always-on microphone that saves recordings from inside people’s home to the cloud, Amazon has been busy pushing its other Ring products such as doorbell cameras and working on police partnerships that let law enforcement request access to the personal cameras. It’s even made its own facial recognition software, Rekognition, that was used by law enforcement until Amazon paused use of the program for a year.

But some privacy experts worry that the new biometric scanning device, which sends images of peoples' palms into the cloud, could be a security risk.

(Amazon chief executive and founder Jeff Bezos owns the Washington Post.)

"As with everything at Amazon, we take data security very seriously, and any sensitive data is treated in accordance with long-standing policies. We are confident that the cloud is highly secure," said Amazon spokeswoman Kerri Catallozzi.

The palm-scanning experiment is the latest sign that Amazon isn't shying away from products that push the boundaries of what customers are willing to accept, if it can make their lives easier or spark a little joy. Now, buoyed by the success of the Alexa and Ring product lines, Amazon is leaning into biometrics in a way that companies like Apple have previously decided are too risky.

Biometrics are biological measurements that can be used to identify someone, such as fingerprints, face and iris scans, the way a person walks or other behaviors that are unique. They're used by law enforcement to identify people, but have more recently been turned into a consumer tech offering as a way to access phones, skip the security line at an airport or board a plane.

Smartphones got here first. Fingerprints and face-detection are now standard options for securing newer smartphones and even confirming things such as digital purchases. Their biometric authentications work in conjunction with wearables, as well, turning a watch into a payment device. Smartphones are also already collecting more detailed data than Amazon could gather with just One, including a person’s location, where they shop, and possibly what they buy.

It's still not the same as letting a store scan your body part.

"There's always something about the physical that catches our attention," says Bryant Walker Smith, an associate law professor at the University of South Carolina specializing in law and technology. "The idea of an eye scan or a palm scan feels just so much more tangible than that all these companies have our phone numbers, and that these large platforms can track us by our behavior."

The differences between the approaches are in the technical details. Major technology companies like Apple and Samsung have already settled on what they see as the safest ways to use biometrics. Smartphone users unlock their devices with a fingerprint or scan of their face, but instead of uploading that information to servers, the companies do all the processing on the device itself.

The Amazon One system does what those other companies have purposefully avoided: It stores sensitive biometric data in the cloud. Privacy advocates regularly warn about the dangers of unchangeable (at least without drastic measures like surgery) biometric data being breached, or being made available to law enforcement.

"If your credit card number leaks, you can get a new credit card. If a biometric scan of your palm leaks, you can't get a new hand," said Evan Greer, deputy director of privacy group Fight for the Future.

Amazon's business has long been based on collecting data about what its customers buy, but it was an experimental gadget, the Echo, that charted its current path on privacy. It's used a spaghetti-against-the-wall approach with its products to see what sticks (not its effort to launch the Fire phone) and what traditional privacy precautions buyers are willing to give up for cool devices (a lot, it turns out). Launch a product, let the privacy concerns flare up and fade, then watch as people buy it anyway.

“You could call it coercion through convenience,” said Walker Smith. “That’s the story of every technology. We protest or we say, ‘I would never use that. Why would I use a smartphone?’ And then it turns out you can watch cute videos of cats on this thing or talk to grandparents. It just becomes what people do and then you will do it, too.”

The Echo speaker, released in 2014, uses always-on microphones to listen for a wake word, the name of its omnipresent assistant "Alexa," and start recording commands. But it also set timers when your hands were full, played music instantly or read stories to your children. The smart speaker launched the rare, new-product category. Soon Google and Apple were rushing out their own versions.

Amazon continues to take the concept further. How about an Echo in your kid's room? One on your nightstand? Another with a camera that can be turned on remotely if you enable the "Drop in" setting. How about a wearable that scans your body and listens to your voice to determine your "tone?"

There have been bursts of pushback as people learn more about how Amazon's systems work. The audio files from Alexa devices can contain sensitive information and are sometimes recorded by accident. The company, along with Google and Apple, came under fire last year for allowing third-party contractors to review the voice recordings. Alexa recordings have been used in criminal investigations and trials, including at least one murder trial.

In the first half of 2020, Amazon said it received more than 3,000 requests from law enforcement for user information across its products, and that it complied with almost 2,000 of them. The company says it complies with law enforcement requests for Amazon One the same way it does for its other products.