How Amazon’s Acquisitions of iRobot and One Medical Could Affect Your Privacy

Over the past two months, Amazon has made high-profile bids to buy iRobot, a robot-vacuum brand, and One Medical, a health-care tech company. It was announced last week that both acquisitions are being reviewed by the Federal Trade Commission, which will draw the process out. If the deals go through, these two companies will join the likes of Ring, Whole Foods, MGM Studios, Eero, and countless others under the Amazon umbrella.

Beyond the immediate questions (uh, does this mean Bezos now has access to my room layouts and medical history?), you may be wondering about the privacy implications. These types of acquisitions tend to highlight a certain type of dread: You might have been okay with a company that provides one specific type of product or service having some data about you, but you might be less okay with the idea of one gigantic company (that makes nearly every device imaginable) having that same data.

The unfortunate truth in these cases is that nearly every privacy policy stipulates that when one company acquires another, they also get any data collected prior to the acquisition, and as a product owner you can’t do much about that. What you can do is learn about what kind of data Amazon now has access to. Let’s break down both of these acquisitions to take a closer look.

What this means for iRobot

Several of our favorite robot vacuums are made by iRobot, though only one, the i3 EVO (and i3+ EVO) is smart enough to capture data about your floor plan, which is likely valuable to Amazon. Amazon already has a robot that can scan floor plans, but it’s expensive and doesn’t even do any household chores.

Historically, it has been mostly meaningless for a company to collect a low-resolution floor plan of your house from a robot vacuum. It seems invasive as a concept, but one can’t do a whole heck of a lot with that data on its own, either. Combine a home’s floor plan with all the various data that different Alexa-enabled devices collect, plus everything you shop for, and you don’t need to sport a tinfoil hat to see the privacy implication: A company whose main purpose is to sell you more stuff is sitting on vast amounts of data.

In an interview with Reuters back in 2017, iRobot’s CEO Colin Angle talked about how mapping technology was a valuable way to improve other connected devices. “There’s an entire ecosystem of things and services that the smart home can deliver once you have a rich map of the home that the user has allowed to be shared,” he said. (Read: Mapping your home helps us sell more stuff.) For now, those “things and services” are unclear, but we can try to play out what might happen to iRobot by looking back on Amazon’s acquisitions of the controversy-soaked Ring and the mesh router company, Eero.

Ring’s journey is a tumultuous one, starting with Amazon’s acquisition in early 2018. The company launched its neighborhood watch app, aptly titled Neighbors, just a couple months later. A year later, we learned the company was working with law enforcement to share video footage in a story that seems to never end. If you have a Ring camera, you can (and should) enable end-to-end encryption on the device so only you have access to the camera feeds. It’s hard to imagine this level of controversy with something like a Roomba, but as Amazon gets more eyes in more houses (most of the Roombas use lasers to map homes, and just one, the Roomba J7, contains a camera), it’s difficult to predict what surprising use-cases might arise.

Eero has had a more predictable journey. After the acquisition in 2019, Amazon has mostly just updated the routers, and we weren’t able to find any significant changes to its privacy policy regarding data collection after the Amazon purchase. According to Eero’s privacy policy, the company doesn’t track the websites you visit or any of your web traffic, nor does it sell customer data for ads. But it does collect all sorts of network data about performance, which is likely a useful asset for Amazon’s smart-home aspirations, and unlike some other companies, Eero doesn’t offer a way to opt out. As with iRobot, this data collection isn’t strange, but combined with everything else Amazon knows, it starts to feel more intrusive.

What you can do about it

If you already own an iRobot vacuum and don’t like the idea of Amazon collecting all that data, you can opt out of sending mapping data to the cloud, opt out of the camera upload feature, or delete your account entirely (you’ll still be able to use your vacuum for its intended purpose of cleaning your home, but it’ll be a little dumber). When it comes time to replace that vacuum, you can choose from a selection of other good robot vacuums, many of which don’t do room-mapping at all.

What this means for One Medical

One Medical is a subscription-based service that allows patients to book appointments with a network of providers (both in person and virtually), track health records, and renew prescriptions. It’s the sort of modern version of a health-care experience you’d think we’d already have in the US, wrapped inside a $200 annual subscription. Yep, basically Amazon Prime for health care.

Amazon has been moving into health care for a while, including the failed attempt to spin up a small health-care company called Haven in 2018. But leaked audio from an all-hands meeting (subscription required) suggests it’s still a primary focus in years to come. In 2019, Amazon bought PillPack, an online pharmacy that was eventually spun out into Amazon Pharmacy. It also purchased Health Navigator in 2019, which was used to launch Amazon Care in 2021. That’s not to mention its attempts at wearable devices. As with Amazon’s acquisition of Whole Foods, buying One Medical helps it gain a physical presence.

What you can do about it

If you’re a current One Medical subscriber and the idea of Amazon owning this data makes you want to set your hair on fire, you can’t do much to manage the data One Medical already has on you. Any patient data acquired by One Medical should be safe, as it’s covered (for once) by HIPAA (the Health Insurance Portability and Accountability Act). But that doesn’t ease privacy experts’ fears that the online bookseller, e-commerce site, delivery network, smart-home-device business, cloud-computing service, grocery store, movie studio, and now health-tech company won’t find some novel way to monetize and use this data. Amazon also doesn’t have a good track record of protecting customer data from misuse by its own employees, something that’s even more important with medical data.

When Amazon wants to track you, it will. Acquisitions like iRobot and One Medical augment that, but the company is already well on its way to having an abundance of data about what’s in (and directly outside of) your home and what’s inside your body. If you’re concerned about the implications of Amazon having access to your data in the future, you should terminate your membership, though the company may still retain all the data it’s previously collected. Only California residents can request that the company delete their data.

One privacy tip: How to see what Amazon has on you

I’m a hands-on learner, and it’s always easier for me to wrap my head around something by doing it myself. In the case of comprehending just how much information Amazon knows about me, it offers a handy tool to see just that.

1. Head to this link (or scroll over to the top-right corner of the Amazon homepage to Accounts and Lists, click Account, then scroll down to Data and Privacy and click the Request Your Information link).
2. Use the drop-down menu to pick a data category you’d like, or select Request All Your Data to get it all. This might be several GB of data.
3. You’ll get a confirmation link sent to your email. Click it to confirm.

Amazon will email you once it’s ready to download. You’ll have to unzip the file then load up a spreadsheet program to read the enclosed CSV (comma-separated values) file. You can do so with free software like Google Sheets or LibreOffice if you don’t have Excel.

Other privacy news we’re watching

🤫 1Password 8 is out now for both Android and iOS. The new version of the app overhauls the appearance and makes the Watchtower feature, which helps improve your online security practices, more accessible in the app. 1Password 8 isn’t an automatic update to the existing app, so you need to seek out the new version and install it.

📱 TechCrunch launched a search tool that you can use to see if spyware has compromised your Android device. This type of spyware is sometimes a component in cases of domestic abuse.

⚖️ The Federal Trade Commission has started in on the rulemaking process for privacy regulations that would seek to tamp down commercial data collection. This is especially notable since the US doesn’t seem to be able to kick-start any legit approach to a privacy law.

This article was edited by Jason Chen.