When you order jeans online, it helps to see reviews. But what if those reviews are of your own …assets?
One shopper discovered that Amazon’s “About You” profile apparently described her as having “flat buttocks.” Other users reported observations such as “has a husband,” whose legs were apparently deemed skinny, and “uses phone in the shower to read Kindle books.”
Shopping recommendations have entered their brutally honest aunt era. But behind the laughs is a serious question: When a company turns your shopping activity into a profile of your body, habits, and relationships, what can you do about it?
Amazon Is Sizing You Up
Amazon introduced “About You” in May 2026 as part of its AI shopping push. The feature shows shoppers the preferences Amazon has inferred from their purchase histories, searches, saved lists, product reviews, and conversations with its Alexa for Shopping assistant.
Personalized recommendations are nothing new. What’s different is that you can see some of the assumptions behind them — and spot where Amazon has you wrong. One customer’s profile, for example, incorrectly identified their partner’s name while accurately recognizing an ongoing kitchen-appliance upgrade. An algorithm can know you need a toaster without knowing who shares your toast.
To check your own profile in Amazon’s Shopping app, follow this path: Account → Shopping preferences → About You. The feature is also available on mobile web and desktop. You can tap individual observations to edit or remove details that shape your recommendations. But removing an observation from your profile does not necessarily erase the purchase history behind it or other copies of the inference.
Privacy Rights Aren’t One-Size-Fits-All
Beyond the controls Amazon provides, what can you legally require a company to disclose, correct, or delete? The answer is less convenient than Prime shipping: It depends on which laws apply.
The United States has a patchwork of privacy laws, not a single comprehensive federal consumer privacy law. Several states give residents rights to access, correct, or delete personal information and opt out of certain uses, but their requirements, exceptions, and coverage differ. Check the business’s privacy policy for rights and designated request methods available in your state, which may differ from ordinary customer-service channels.
To see how these protections can work, consider two examples: California’s general consumer privacy law and Washington’s law protecting consumer health data. Neither represents the full national picture, and their protections do not apply to every reader.
California: You Can Ask What a Business Knows About You
California residents have several rights when dealing with businesses covered by the California Consumer Privacy Act, or CCPA:
- The right to know: You can request the categories or specific pieces of personal information collected about you, its sources, the purposes for which it is used, and categories of third parties receiving it. Requests to know are available free of charge up to twice a year.
- The right to correct: You can ask a covered business to correct inaccurate personal information it holds about you.
- The right to delete: You can request deletion of personal information collected from you, subject to exceptions, including circumstances in which the business must legally retain it.
A covered business generally must respond to a deletion request within 45 calendar days. When reasonably necessary, it can take another 45 days, but it must notify you and explain the extension within the initial period. Expect identity verification; if it denies the request, the business must explain why.
California also provides a right to opt out of selling or “sharing” personal information. Here, “sharing” specifically refers to sharing for cross-context behavioral advertising (such as targeting ads using information about activity across multiple websites), not every internal use of your information. So an opt-out is not automatically an “Amazon, stop having thoughts about me” button. The existence of an “About You” profile does not, by itself, establish that Amazon sells it or shares it for that kind of advertising.
Covered businesses generally cannot penalize you for exercising your CCPA rights. However, deleting information needed to complete a transaction may prevent the business from providing it, and exercising your rights may affect participation in permitted data-linked financial incentives.
Washington: Shopping Guesses Can Become Health Data
Washington’s My Health My Data Act protects covered personal health information outside HIPAA’s protections. That can include information inferred from purchases: for example, a retailer’s “pregnancy prediction score” derived from otherwise nonhealth shopping data.
Ordinary purchase information does not automatically qualify. Buying deodorant is different from using an app that tracks perspiration; the distinction is whether the information identifies or associates someone with a physical or mental health status. An observation about “flat buttocks” therefore is not automatically consumer health data merely because it concerns a body part.
For covered health data, Washington’s law provides consent protections for collection and sharing, requires valid authorization before sale, and gives consumers a right to request deletion from a regulated entity’s network — including archived and backup systems.
Regulated entities and small businesses covered by the law must prominently publish a separate, distinct link to their consumer health-data privacy policy on their homepage.
The Bottom Line
Creepy and illegal are not interchangeable. The reported “flat buttocks” observation alone is not enough to conclude that Amazon violated either California’s or Washington’s law.
If you suspect a violation of your privacy rights, however, there are places to report it. California consumers can submit complaints about suspected CCPA violations to the California Attorney General or the California Privacy Protection Agency. Washington consumers can submit data-privacy complaints to their attorney general’s office. Elsewhere, complaint options depend on the applicable state law and enforcement process. But of course, a complaint does not guarantee an investigation or compensation. Also keep in mind that California’s attorney general does not represent individual consumers in resolving complaints, and the CCPA generally allows consumers to sue only under certain qualifying data breaches.
Whether or not you have grounds for a complaint, you can still check the assumptions shaping your recommendations. So, make sure that Amazon has its facts straight the next time it tries to assess your bottom line.
