Sharing with Business Partners and Affiliated Entities

What it is

Amazon may share your personal data with its many subsidiaries, affiliated companies, and business partners who offer joint services with Amazon, and states that these parties must follow Amazon's privacy standards.

Why it matters (compliance & governance perspective)

Amazon's corporate family is vast, including Amazon Web Services, Whole Foods, Twitch, Ring, IMDb, and many others, meaning data shared under this provision can flow to entities operating in very different contexts from your original Amazon interaction.

Clause Stability Stable

Consumer impact (what this means for users)

This provision means personal data you provide when shopping on Amazon may be shared across a wide network of Amazon subsidiaries and business partners operating in areas including cloud computing, streaming, smart home devices, and grocery retail, potentially in ways not immediately apparent at the time of collection.

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision engages GDPR's requirements for transparency about recipients of personal data and the purposes of onward transfers; data shared with affiliates for new purposes may require a fresh lawful basis. Under CCPA and CPRA, sharing with affiliates for cross-context behavioral advertising purposes requires opt-out disclosures. The FTC Act requires that affiliate data sharing be consistent with disclosures made at the time of collection. GOVERNANCE EXPOSURE: Medium. The breadth of Amazon's affiliate and partner network means the scope of this provision is extensive in practice. The contractual requirement that affiliates adhere to this Privacy Notice provides some governance structure, but audit and enforcement mechanisms are not detailed, creating uncertainty about practical compliance across the network. JURISDICTION FLAGS: EU users are protected by GDPR restrictions on purpose limitation for onward transfers to affiliates; sharing data with AWS or Twitch for purposes other than the original purpose of collection would require separate legal basis. California users have rights to know the categories of affiliates receiving their data. Transfers to affiliates in countries without adequate data protection may require additional safeguards under GDPR Chapter V. CONTRACT AND VENDOR IMPLICATIONS: B2B customers using Amazon services should assess whether data they process through Amazon's ecosystem is subject to sharing with affiliated entities and whether this creates compliance obligations in their own supply chains. Marketers and advertisers using Amazon's advertising infrastructure should review whether affiliate data flows affect the consent chain for targeted advertising. COMPLIANCE CONSIDERATIONS: Compliance teams should map the specific Amazon affiliates and partners likely to receive personal data relevant to their use case; assess whether disclosures about affiliate sharing are sufficiently specific to satisfy GDPR and CPRA transparency requirements; and verify whether Amazon's data processing agreements with affiliates provide adequate contractual protections required by applicable law.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Voice and Device Data Collection via Alexa high
• Third-Party Seller Data Sharing medium
• Cross-Context Behavioral Advertising medium
• Data Retention for Legal and Operational Purposes medium
• Jurisdiction-Specific Consumer Data Rights medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.