Amazon's new Dash ordering service is a recent development in bringing the Internet of Things to the home. It works by enabling consumers to press the Dash Button to automatically place an order with Amazon for a specific branded product, for example to replace dog food when it runs out. While a key selling point for Amazon Dash is its efficiency, there may be legal concerns, particularly in relation to privacy and consumer protection, as Kolvin Stone and Natasha Ahmed of Orrick LLP explain.
What is Amazon Dash?
Amazon Dash is an ordering service (currently available to Amazon Prime Members) that allows customers to purchase household consumer goods using a Wi-Fi-enabled device - the 'Amazon Dash Button.' The Dash Button is a physical device that is paired (on set-up by the customer) with a specific product manufactured by a particular brand/manufacturer (for example, washing tablets by Ariel or razor blades by Gillette). When pressed, the Dash Button automatically places an order with Amazon for the specific product via the customer's Amazon account. Customers can manage their account through their Amazon smartphone app. The settings can be adjusted so that the customer receives a notification each time an order is placed, giving them the opportunity to cancel an order before the item is dispatched. With the 'order protection' setting, customers can also ensure that their Dash Button does not place a new order until the previous order has been delivered, thereby protecting against numerous orders being placed accidentally.
This is the next evolution of the 'Internet of Things,' the phenomenon where our physical and virtual worlds are connected through a series of devices and computers. But the price of convenience comes arguably at the expense of privacy.
Privacy concerns
Amazon already holds a vast amount of personal data (i.e. information which can be used by itself or together with other information to identify a living individual) relating to its several hundred million consumers, including each consumer's name, address, date of birth, and payment details. And like many online retailers, Amazon tracks its users' shopping habits and uses historical purchasing data to personalise content, send targeted advertisements and recommend products to its customers. Amazon Dash offers the possibility to gain an even greater insight into its users, their lifestyle, habits, health, interests, family life and so on. Consumers generally purchase household consumable goods from a variety of sources - a combination of physical stores (such as department stores and supermarkets) and online stores (such as Amazon and eBay, as well as retail stores' e-commerce sites).
It is Amazon's hope that an easy-touse, conveniently-placed Amazon Dash Button will encourage consumers to forgo the alternative purchasing methods and rely on the Amazon Dash service as their go-to supplier for products offered by the Dash service. With their rivals out of the picture, Amazon believes that it will gain a much clearer insight into the purchasing and usage habits of its consumers in relation to Dash Button products. This data can then be used by Amazon - and its suppliers, with whom this information may be shared - to build a more detailed picture of not only their customers' purchasing habits, but also about their customers as individuals. Obvious examples include Amazon being able to ascertain whether or not a customer has pets (there are Dash Buttons for Whiskas, Pedigree, Dreamies, Sheba and Catsan) or children (there are Dash Buttons for Johnson's, Huggies, DryNites, and Play-Doh).
Using data to create rich customer profiles in this way could allow Amazon to highly personalise content and advertising to drive more sales. There are other potential ways to monetise data. Amazon developed its data hosting business AWS out of its experience of hosting its own sites. With its collection of such rich data and the development of its advertising platform, Amazon could look to build a 'big data' business or take on Google in the advertising space.
To do so, it will need to address the privacy issues at the outset. One of the fundamental building blocks of privacy law is transparency. Given the potentially sensitive nature of the information Amazon is collecting, how will it satisfy this requirement of transparency in the context of Amazon Dash? The Dash Button is all about convenience, and being able to give users sufficient notice may be a challenge technically without affecting the user experience. Moreover, under the General Data Protection Regulation ('GDPR'), businesses will need to be more transparent with users. And depending on the actual activity Amazon undertakes, explicit or 'unambiguous' consent may be required. Again, the challenge is in obtaining consent in a valid way without affecting the user experience.
Under UK and EU privacy law, users have strong rights. This is further enhanced under the GDPR where users have the right to 'port' their data to new service providers or access their data or even have it erased (known as the 'right to be forgotten'). These rights will need to be embedded into the design of Amazon Dash and be supported operationally.
Security risk
The Internet of Things has its own inherent security challenges, given the number of interconnected devices and parties involved and the sensitivity of this information. The Amazon Dash button may be the next stage in the interconnected home as regards grocery shopping but already there are numerous layers. It is the Button that talks to your computer that talks to AWS that talks to suppliers. Each point of contact represents an opportunity to exploit any vulnerability, and data is only as secure as the weakest link in the chain.
Potential issues: consumer rights
In addition to privacy concerns, Amazon Dash also potentially raises issues under EU and UK consumer rights legislation - including Directive 2011/83/EU of the European Parliament and of the Council of 25 October 2011 on consumer rights, the UK Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 (the 'Regulations'), and UK Consumer Rights Act 2015 - which provides certain rights and protections to consumers of goods and services.
The Regulations, for example, provide that certain information must be provided to a consumer who is purchasing goods or services under a distance contract (i.e. where the consumer is not in the physical presence of the supplier at the time of entering into the contract) before the consumer is bound by the contract. The information to be provided includes the main characteristics of the goods or services, the identity of the trader, the geographical address at which the trader is established, the total price of the goods or services, and the delivery arrangements. Since the Button itself is simply a small device showing no information other than the relevant brand, there are technical challenges in terms of how this information will be provided in an accessible manner.
Arguably, a greater challenge is the requirement under the Regulations for a trader to make the consumer aware 'in a clear and prominent manner' and 'directly before the consumer places the order' of the pre-contract information. The trader must also ensure that, when placing the order, the consumer 'explicitly acknowledges that the order implies an obligation to pay.' The Regulations go on to say that if placing an order entails activating a button, the button must be clearly labelled with wording (such as 'order with obligation to pay') which makes it explicit that placing the order entails an obligation to pay. The consequence of a trader's failure to meet these requirements is that the consumer is not bound by the contract or order. These requirements are hard to meet in the context of the current set-up of Amazon Dash.
Equally, there is a tension between the information requirements in the Consumer Rights Act 2015 and Amazon's right to change the details of the product associated with a Dash Button if it is not available or over time, including price, taxes, delivery charges and the identity of the seller. Users should proactively review the product details each time they press the Button by going onto the Amazon app, to check whether the item to be delivered complies with the pre-contract information given to the consumer at the time they set up their Dash Button or if it has changed. It is unlikely that consumers will do this, and it is equally unlikely that Amazon expects its consumers to do so as this would defeat the efficiency of the Dash Button service.
Some of these concerns have been raised by the Consumer Centre for North Rhine-Westphalia (a non-profit consumer advice and consumer representation centre), which issued a statement on its website claiming that the Amazon Dash Button violates various provisions of applicable consumer law. The Consumer Centre criticised the Button's failure to notify consumers that they would, on pressing the Button, immediately be placing an order for goods for which they would be charged. The Consumer Centre also noted that consumers do not receive confirmation of the price of the goods or information about their key characteristics until after the order has been placed. Whilst the Centre considers this to be a breach of Amazon's obligation to provide certain pre-contract information to consumers, Amazon will likely take the position that the provision of this information via the Amazon app combined with consumers' ability to cancel and amend orders prior to dispatch demonstrates compliance with the relevant applicable consumer law.
The efficiency of Amazon Dash is arguably the unique selling proposition but that creates some tension between privacy and consumer protection law where the emphasis is on data minimisation and increasing transparency, access and choice. We have already seen concerns raised by the Consumer Centre for North Rhine-Westphalia, but whether other stakeholders will follow suit, and whether consumers themselves will raise concerns, has yet to be seen - but convenience, at least for consumers, often trumps privacy and consumer rights.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
