Governance document

CA-D-000649

AWS Privacy Notice

AWS

Last change detected May 18, 2026 Privacy policy

SHA-256: 60c077cc945f7777afb… 2 versions captured 1 change documented

Get the research letter

Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.

View original document at AWS ↗

This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology

117 Total

11 High severity

87 Medium severity

19 Low severity

Key Facts

Does AWS engage in profiling of consumers in furtherance of automated decisions that produce legal or similarly significant effects?

AWS does not engage in profiling of consumers in furtherance of automated decisions that produce legal or similarly significant effects, as those terms are defined under the Colorado Privacy Act or the Oregon Privacy Act.

Does AWS knowingly share personal information about consumers who are under the age of 18?

AWS does not knowingly share personal information about consumers who are under the age of 18.

Is AWS in the business of selling its customers' personal information to others?

AWS states that it is not in the business of selling its customers' personal information to others.

Will AWS discriminate against any consumer for exercising their rights under the California Privacy Rights Act?

AWS will not discriminate against any consumer for exercising their rights under the California Privacy Rights Act.

How must users under 18 use AWS Offerings?

AWS requires users under 18 to use AWS Offerings only with the involvement of a parent or guardian.

Does AWS require users under 18 to use AWS Offerings only with the involvement of a parent or guardian?

AWS requires users under 18 to use AWS Offerings only with the involvement of a parent or guardian.

When is sending unsolicited electronic direct marketing communications prohibited in South Africa?

AWS prohibits sending unsolicited electronic direct marketing communications in South Africa unless the recipient has given consent.

What must the recipient have given for unsolicited electronic direct marketing communications in South Africa?

AWS prohibits sending unsolicited electronic direct marketing communications in South Africa unless the recipient has given consent.

What must users in South Korea who do not agree with overseas transfers of their data do?

AWS requires users in South Korea who do not agree with overseas transfers of their data to stop using AWS Services and close their AWS Account.

What does AWS automatically collect when users interact with AWS Offerings?

AWS automatically collects certain types of information when users interact with AWS Offerings.

Stay ahead of the changes

Track AWS and get the diff the day its terms change.

Monitor AWS + up to 20 platforms — $4.99/mo →

Summary

This document explains how AWS collects, uses, keeps, and shares your personal information when you use its services. AWS does not sell your personal information, but it does share limited identifiers with advertising partners and shares data with third-party service providers who are restricted in how they can use it. After you close your account, AWS may still hold some of your information for legal or business reasons, and users under 18 must have a parent or guardian involved in their use of AWS.

Analysis

The AWS Privacy Notice establishes AWS's data collection, retention, sharing, and rights framework for users of AWS Offerings. AWS automatically collects personal information upon interaction with its Offerings and retains it for the duration of use, to fulfill stated purposes, or as required by law, with continued retention discretion following account closure. Personal information is shared with third-party service providers under use restrictions aligned with the Notice, and limited identifiers are shared with advertising partners; AWS states it does not sell customer personal information. The Notice establishes age-based restrictions requiring parental or guardian involvement for users under 18, prohibits knowingly sharing personal information of consumers under 18, and commits to non-discrimination against consumers exercising California Privacy Rights Act rights. AWS further states it does not engage in profiling for automated decisions producing legal or similarly significant effects as defined under the Colorado Privacy Act or Oregon Privacy Act.

What this means for you

When you use AWS Offerings, AWS automatically collects personal information and may retain it even after you close your account for legal and legitimate business purposes. AWS does not sell your personal information, but limited identifiers are shared with advertising partners. AWS will not discriminate against you for exercising your California Privacy Rights Act rights. If you are in South Korea and do not agree with overseas transfers of your data, the Notice requires you to stop using AWS Services and close your AWS Account.

Institutional Analysis

Stay ahead of the changes

Institutional analysis available with Insight

Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.

Monitor AWS + up to 20 platforms — $4.99/mo → Get the research letter, free

1 important change detected

2 versions captured · Last updated: May 2026

May 18, 2026

low

What changed AWS updated its Privacy Notice on May 18, 2026, making four operational changes. The document added a new section titled 'Advertising' to the table of contents. AWS also updated the Japan office address for Amazon Web Services Japan G.K. from 3-1-1 Kamiosaki, Shinagawa-ku, Tokyo 141-0021 to 1-3-1 Azabudai, Minato-ku, Tokyo 106-0041 in both the data controller section and the data subject access request contact information. These changes affect where individuals in Japan should direct privacy requests and where AWS Japan processes personal information.

Why this matters The updated Privacy Notice now explicitly lists 'Advertising' as a section in the table of contents, indicating AWS will provide information about advertising-related data practices. This disclosure was reorganized rather than newly introduced. The Japan office address for submitting data subject access requests has been updated from 3-1-1 Kamiosaki to 1-3-1 Azabudai. Customers and individuals in Japan should use the new address when submitting privacy requests to Amazon Web Services Japan G.K.

View full change record →

Featured, High severity

AWS does not engage in legally significant automated profiling Compare →

This commitment, scoped to definitions under the Colorado Privacy Act and Oregon Privacy Act, means AWS does not subject consumers to a category of high-stakes automated decision-making those laws specifically regulate.

Added July 10, 2026 Standard Seen across 217 platforms
AWS does not knowingly share data about consumers under 18 Compare →

The qualifier 'knowingly' limits the scope of the commitment; it applies only to sharing AWS is aware of, not to inadvertent disclosures.

Added July 10, 2026 Common Seen across 148 platforms
AWS does not sell customer personal information Compare →

AWS's stated position is that customer personal information is not sold, which addresses a common data monetization concern.

Added July 10, 2026 Standard Seen across 288 platforms
AWS will not discriminate for exercising CPRA rights Compare →

This commitment ensures consumers can exercise their CPRA rights without fear of retaliatory or differential treatment by AWS.

Added July 10, 2026 Unique
Children under 18 require parental involvement Compare →

AWS conditions access to its Offerings for minors on parental or guardian involvement, establishing a gatekeeping requirement for underage users.

Added July 10, 2026 Unique
South Africa unsolicited electronic direct marketing prohibited without consent Compare →

Consent is a prerequisite for electronic direct marketing by AWS in South Africa, giving South African users control over whether they receive such communications.

Added July 10, 2026 Standard Seen across 245 platforms
South Korea opt-out requires account closure Compare →

Continued use of AWS Services in South Korea is conditioned on acceptance of overseas data transfers; the only way to opt out is to stop using the service and close the account.

Added July 10, 2026 Standard Seen across 290 platforms

Featured, Medium severity

AWS automatically collects interaction information Compare →

Collection is automatic and requires no affirmative act by the user, meaning interaction itself triggers data collection.

Added July 10, 2026 Standard Seen across 296 platforms
AWS shares limited data with advertising partners Compare →

Personal information does reach advertising partners, but AWS limits what is shared by substituting indirect identifiers for directly identifying details such as name.

Added July 10, 2026 Standard Seen across 288 platforms
EEA retention of information after account closure Compare →

Closing an account does not guarantee immediate deletion of personal information; AWS retains discretion to keep data for legal and legitimate business purposes.

Added July 10, 2026 Standard Seen across 275 platforms
Personal information retained as required for stated purposes Compare →

Retention is tied to ongoing use, stated purposes, and legal requirements, meaning AWS may hold personal information for the duration of a user's relationship with AWS Offerings and potentially beyond.

Added July 10, 2026 Standard Seen across 275 platforms
Third-party service providers access personal information Compare →

Personal information is shared with third-party service providers, but those providers are contractually restricted in how they may use and process it.

Added July 10, 2026 Standard Seen across 288 platforms