Amazon.com, Inc.
Headquartered in the United States, Amazon runs one of the world’s largest e-commerce platforms, with over 2.45 billion monthly visitors. In addition to online retail, the company offers cloud computing through Amazon Web Services (AWS), video streaming via Prime Video, facial recognition software, and the virtual assistant Alexa. Amazon’s revenue is primarily driven by its online retail business, cloud services, and advertising.
Amazon ranked last in the 2025 RDR Index, alongside Russia’s VK. It continued to face significant scrutiny over its data privacy and surveillance practices. In March 2024, the U.S. Federal Trade Commission fined Amazon USD 25 million for retaining children’s voice recordings on Alexa devices despite deletion requests. This underscored ongoing concerns about the company’s handling of sensitive data. Meanwhile, journalists from The Markup, an American nonprofit, revealed that Amazon’s Ring had been funneling private information from users to the police without their consent, raising alarms about privacy in its smart home ecosystem. Further, Amazon faced legal challenges, including a lawsuit related to the alleged collection of voice biometrics from AWS customers, also without their informed consent.
Despite small improvements, Amazon remained one of the least transparent companies in each category of the RDR Index. Although the company disclosed that it now has a Chief Security Officer overseeing data security, it has yet to comprehensively address key issues, such as how it handles user information, including data inference, user control, and data retention.
Amazon’s approach to content moderation and freedom of expression has also been questioned. A Citizen Lab study from 2024 revealed that the company restricted 17,050 products, with books on LGBTQ+ themes and religious topics being key targets in countries such as Saudi Arabia and the United Arab Emirates. Amazon’s content restriction practices, highlighted by the Citizen Lab study and compounded by a lack of detailed content restriction enforcement data, raised concerns about its commitment to free speech and transparency in content governance. The company’s repeated failure to disclose how it handles government content takedowns further highlighted gaps in its approach to content moderation and privacy.The 2025 RDR Index: Big Tech Edition covers policies that were active on August 1, 2024. Policies that came into effect after August 1, 2024, were not evaluated for this benchmark.
Scores reflect the average score across the services we evaluated, with each service weighted equally.
We rank companies on their governance, and on their policies and practices affecting freedom of expression and privacy.
Amazon continued to lag behind most of its peers in the governance category, despite notable improvements. In 2024, Amazon disclosed that it has a Chief Security Officer overseeing data security, marking a significant improvement in its transparency regarding executive-level oversight of privacy (G2). Additionally, Amazon revamped its grievance mechanism by publishing a Human Rights Complaints page and a corresponding FAQ with clear timeframes for handling complaints, significantly improving access to remedy (G6a). However, the company did not specifically address freedom of expression or privacy in its remedy processes.
Amazon made several improvements in this category, though its disclosures still lacked details in some areas. The company clarified its advertising content policies for Alexa, offering a more accessible and comprehensive set of guidelines (F1b). However, it no longer provided a change log for its advertising content policies, resulting in a lack of transparency on recent policy changes (F2b).
While Amazon disclosed some parameters for enforcing its advertising policies through the Advertising on Alexa Guidelines and Acceptance Policies, these details remained limited (F3b). Additionally, Amazon published a Brand Protection Report, providing some data on content and account restrictions, but the information lacked specifics regarding enforcement practices, such as how decisions are made, the criteria used, or the total volume of restricted content (F4a, F4b).
Finally, although Amazon introduced a process for responding to intellectual property rights (IPR) requests, the policy was not comprehensive and provided only limited details on how it handles such requests (F5b). Amazon still failed to disclose any information on government requests for content takedowns (F5a).
Amazon outperformed only VK in the privacy category. The company was, once again, vague about how it collects (P3a) and handles user information. While Amazon allowed users to request a copy of their personal data (P8), it still failed to disclose how long it retains this information (P6). The company also failed to provide clear instructions on how to opt out of targeted advertisements (P7) and did not address how it handles data breaches (P15).
Although the company introduced a page explaining how users can control geolocation data collection and deletion on Alexa, it made no further strides in overall privacy transparency. As a result, it remained the least transparent company among its peers regarding user information handling (P3-P9).