Why does Amazon use palm scanners at Whole Foods and doctors’ offices?

An Amazon-branded palm scanner greeted me at my last doctor’s office visit a few weeks ago. I’m not sure what I’d call the experience. Unnerving? Orwellian?

Amazon One is a relatively new service from Amazon that lets businesses verify your identity after you wave your hand over a sensor. The technology first rolled out in the short-lived Amazon Go convenience stores in 2020 and is now a way to pay for groceries at Whole Foods. It’s also used for payment and age verification at a few sports and entertainment venues, including at Coors Field in Denver. And as of March, you can also scan your palm with Amazon One to check in at NYU Langone Health locations, which is where I encountered it. So far, you won’t be forced to scan your palm to get a beer at a Rockies game or see an NYU doctor, but it’s an option.

In addition to its experiments in public venues, Amazon One is marketing its scanners as an alternative to the fobs and codes that let employees into their office buildings. Amazon is also working with hotel companies and manufacturers that make security doors and safety deposit boxes to incorporate its palm scanner.

Biometric scanning refers to the process of capturing your unique physical characteristics in order to confirm your identity. Whether it’s your palm, your fingerprint, your eyeball, or your face, the concept can feel creepy or invasive to some. Biometric scanning can happen without your consent, as was the case with Clearview AI, the company that built a massive facial recognition database from billions of publicly available photos online. There’s also a permanence to the collection of biometric data. Once a company has the details of your face, you don’t have much control over how that data is used. After all, you can’t easily go out and get a new face.

Millions of people volunteer their faces or fingerprints, nevertheless, as a quick and convenient way to verify their identities and make life a little easier. With Apple’s Face ID or Google’s Face Unlock, you can keep the contents of your phone from prying eyes but avoid typing out an annoying passcode every time you want to check your texts. With Clear, you can skip the line at airport security. And with Amazon One, you can save a couple minutes of waiting at the doctor’s office by scanning your palm instead of talking to a human.

Nevertheless, something seems fundamentally threatening about a future in which big tech companies use biometrics to serve as the gatekeepers of our digital identities.

What’s especially disconcerting to me about Amazon One is that your biometric data is just another source of data that the company has about you. The tech giant, after all, is a massive enterprise whose businesses span from its eponymous marketplace to a health care company to a multibillion-dollar advertising network. It’s not always clear how engaging with one Amazon-owned entity affects your experience with others.

AWS, the Amazon division that operates Amazon One, specifies in a supplemental privacy notice that it will not share your palm data — effectively, the image of your hand — with third parties, although it also collects other data, including your phone number and your PIN, when you sign up. AWS, meanwhile, is clear in its broader privacy policy that it can share data about you with third parties, including advertisers. Then there is Amazon.com, which is governed by its own separate privacy policies.

When I asked Amazon about all this, spokesperson Alison Milligan said that your Amazon One profile is separate from your Amazon.com profile, and that Amazon One profile data is not used for marketing or shared with advertisers. “​​Amazon One palm data is not accessible to Amazon business units outside of Amazon One,” Milligan said.

Meanwhile, NYU Langone Health spokesperson Arielle Sklar told me, “We do not share personal information with Amazon One, and Amazon One does not store any protected health information.”

Still, privacy watchdogs caution that when it comes to massive tech companies, it’s best to proceed with caution — the capabilities are enormous, and privacy policies can change. “Amazon likely can infer unbelievably sensitive health care data about people, partly because they have so many different programs and so many different services,” said Calli Schroeder, senior counsel at the Electronic Privacy Information Center, or EPIC. “All of this stuff gets tied together and can be incredibly revealing.”

Amazon calls its biometric offering a “palm-based identity service.” You might call it the Everything Scanner.

The key of the future is your body

The concept of a digital key isn’t all that different from physical locks that have been around since ancient Egypt. A password, in theory, is a key that lets you into a website or an account. Credit cards are a type of key too, since they unlock access to a bank account to make a purchase. The big change with biometrics, however, is that you no longer carry a key around. You are the key.

The core argument in favor of biometric scanners is that they’re more convenient and more secure than the old carry-the-key method. An Amazon One scanner works in less than a second, while tapping your credit card and entering a PIN can take several seconds. Those seconds add up, not just for you, the customer, but also for the business. Both parties also have to consider that credit cards and numbers get stolen with startling regularity.

“It’s a lot harder to steal somebody’s fingerprint or face print or palm print than it is to steal their cards out of their wallet or their pocket,” said Ash Johnson, senior policy manager at the Information Technology and Innovation Foundation, or ITIF.

But it’s not impossible, and when biometric data is stolen, it’s incredibly valuable to hackers, because unlike a password, it cannot be changed. There was a major breach of biometric data in 2019, for example, when security researchers obtained the fingerprint and facial recognition data of over a million people. Had they been bad actors, they could have used the data — the code that represents real fingerprints and faces — to break into office buildings.

Amazon also says it chose palm-scanning over other biometric approaches because palms don’t reveal as much about a person’s identity as a face scan would, and because a palm scan “requires someone to make an intentional gesture,” which protects against unauthorized scans.

I actually believe biometric scans are largely secure and the convenience is worth it for certain uses. I’m an outspoken fan of Apple’s Face ID technology, and I’ve allowed Clear to scan my eyes in order to get through the airport security line faster. It’s possible that my biometric data will one day end up on the dark web, but I was willing to take that risk when I was about to miss my flight. At the time, I hadn’t considered whether I’d make the same trade-off in order to save a couple minutes at the grocery store or in a waiting room.

It’s not the idea of palm-scanning at my doctor’s office that bothers me. The new system gives me pause because it’s powered by Amazon.

Like the vast majority of Americans, I like Amazon. I’m an Amazon Prime member, and a regular Amazon Fresh shopper. I visit my local Whole Foods at least once a week, and just as often, I watch movies on Amazon Prime Video. Thanks to all of these touch points, Amazon knows a lot about me, and I continue to be surprised by the ways Amazon combines my data in different ways — like the time Amazon recommended prescription medication based on my grocery order.

It wasn’t immediately clear to me what would happen when I put my palm on an Amazon One scanner at my doctor’s office. Would basic details of my visit, like the time and location, get logged somewhere in my main Amazon account? Would I get ads for Ace bandages after visiting a sports medicine doctor? Would I get deals on heart-healthy options at Whole Foods after an appointment at a cardiologist? And what if Amazon changes its mind about protecting my biometric data or goes bankrupt, like 23andMe? Amazon denies that it’s sharing data across its businesses this way, but it’s hard not to feel wary.

After winding through the labyrinths of Amazon’s various privacy policies and even talking to the company, I’m still not entirely confident that I know exactly how it all works. I definitely don’t believe that Amazon has access to my health records, and it’s very clear that the image of my palm — my “palm data” — is well protected. But the uncertainty surrounding any other metadata is enough to steer me toward a human receptionist for my next doctor’s appointment.

I also can’t escape the implications of all this. Tech giants, like Amazon, only know growth, and so they continue to reach into new industries. That’s business, sure, but it starts to feel overwhelming when a website I signed up for 30 years ago to buy cheap books now wants details about my body in order to verify my identity.

Time is long, and once Amazon has my biometric data, it’s out of my hands.