Amazon

This update represents a substantial expansion and reorganization of the AWS Privacy Notice, with the effective date moving from October 16, 2025 to May 18, 2026, and the document restructured into clearly labeled sections. The policy now adds new topics, expands jurisdiction-specific disclosures, and clarifies or broadens certain data uses and sharing practices.

• New top-level sections added: The notice now includes dedicated sections for “Location of Personal Information,” “How We Secure Information,” “Children’s Personal Information,” “Third Party Sites and Services,” and an “EU-US Data Privacy Framework, UK Extension, and Swiss-US Data Privacy Framework” section.
• Expanded “How We Use Personal Information”: The purposes now explicitly include “Measure, Support, and Improve AWS Offerings,” “Recommendations and Personalization,” “Comply with Legal Obligations,” “Communicate with You,” “Marketing and Advertising,” and “Fraud and Abuse Prevention and Credit Risks.” Example: “We may also use scoring methods to assess and manage credit risks.”
• Broader sharing with Amazon affiliates: The sharing section now states we share with “Amazon.com, Inc. and the affiliates that Amazon.com, Inc. controls that are either subject to this Privacy Notice or follow practices at least as protective as those described in this Privacy Notice.”
• New “Business Transfers” and “Protection of Us and Others” sharing categories: These describe personal information as a transferred business asset and release of information to comply with law or protect rights.
• Advertising section rewritten: It now clarifies that AWS does not share name or directly identifying information, instead using “an identifier like a cookie or a unique code derived from your contact information (such as a hashed email address).” Similar language appears in the EEA/UK/Switzerland and US sections.
• New “Children’s Personal Information” section: States AWS does not provide offerings for purchase by children and that persons under 18 may use services only with parental/guardian involvement.
• New “Location of Personal Information” section: Notes that personal information may be stored in or accessed from multiple countries, including the United States, and transfers will comply with the Privacy Notice and applicable law.
• New “How We Secure Information” section: Describes encryption, PCI DSS compliance, and physical/electronic safeguards.
• Retention of Personal Information section expanded: Now states AWS “will delete your personal information in accordance with applicable law.”
• New jurisdiction sections added: Canada, Costa Rica, India, Malaysia, Nigeria, Peru, Philippines, South Africa, South Korea, and Turkey now have specific disclosures, rights, and contact details. This includes new controllers, data protection officers, and rights listings (e.g., for Canada and Nigeria).
• EU/EEA/UK/Switzerland section expanded: Now includes “Information We Retain After Your Account is Closed,” listing examples such as contact information and invoices retained for tax/accounting purposes and dispute resolution.
• US state privacy disclosures expanded: Now includes a more detailed “Categories of personal information collected” and “Categories of personal information disclosed for a business purpose,” plus a “California Privacy Rights Act and Minnesota Consumer Data Privacy Act” retention statement, a non-discrimination statement, and a profiling disclosure. The “Your Privacy Choices” opt-out now also references the Global Privacy Control signal.
• South Korea section now includes a table of delegate companies and overseas transfers with retention periods, and adds detailed procedures for deletion of personal information.
• Japan section now includes joint use with affiliates and transfer safeguards with third parties outside Japan.
• Controller and contact details updated/added: New addresses and DPO contacts for Brazil, Canada, Costa Rica, India, Nigeria, Peru, Philippines, South Africa, South Korea, and Turkey are provided.

Substantive changes include new obligations, explicit data uses, broader sharing with Amazon affiliates, new jurisdiction-specific rights and retention promises, and a changed effective date.