Roughly two weeks apart, on July 21, 2022 and August 5, 2022, respectively, Amazon made headlines for agreeing to acquire One Medical, “a human-centered and technology-powered primary care organization,” for approximately $3.9 billion and iRobot, a global consumer robot company, known for its creation of the Roomba vacuum, for approximately $1.7 billion. These proposed acquisitions have drawn the scrutiny of the Federal Trade Commission (FTC), which following President Biden’s 2021 Executive Order on antitrust and competition, has taken a more aggressive stance toward acquisitions by large technology companies in an effort to, in FTC Chair Lina Khan’s words, “prevent incumbents from unlawfully capturing control over emerging markets.”

Beyond antitrust issues, Amazon’s recent acquisition decisions bring the discussion of the collection of consumer information and its secondary uses, specifically location and health data (which we have previously written about), to the forefront, yet again. Such data has become quite valuable in the marketplace, aiding the rise of data brokers and analytics firms that collect, share, aggregate and analyze data for insights they can provide to businesses, investors or others. Although our previous blog post discussed location data relative to reproductive health services, as it was written soon after the Supreme Court’s decision in Dobbs, a likelihood of further scrutiny into the collection, sharing, and perceived misuse of location data, more generally, was hypothesized, and on August 11, 2022, the FTC announced its decision to “explor[e] a rulemaking process to ‘crack down on harmful commercial surveillance.’” This decision stems, in large part, from the reality that smartphones can reveal far more personal information about users than most people might realize and that app publishers, software developers, web data aggregators, and the like, are collecting large swaths of consumer data through methods that many consumers may not expect or fully comprehend. Since then, the FTC has hosted a virtual public forum with respect to its Advanced Notice of Proposed Rulemaking on commercial surveillance and data security to hear from panelists and the public.

As many know, Amazon already owns numerous high-profile companies, including Zappos, Whole Foods, Ring, and Eero, among others, and additionally offers a wide array of its own connected digital devices like Alexa, Echo, and Fire TV and Tablets, which each allow Amazon (subject to certain user privacy settings) to access and analyze different types of consumer data, such as online purchases, home entryway videos, and web browsing and streaming history, in all giving the company a rich snapshot into the home lives of individual users. Additionally, many of these digital devices are meant to interact with one another to help users build “smart homes.” As an example, with just their voices and the help of Amazon’s Alexa devices, users can turn their home’s lights or cameras on and off and thermostats up or down. This is made possible through Alexa’s cloud intelligence. Further, Amazon’s personalized recommendations engine and its consumer-targeted advertising initiatives are two examples of how Amazon uses the data it collects to provide users with custom experiences and increase overall sales.

The acquisition of One Medical would provide Amazon with a cross-industry opportunity to harness new, highly sensitive data: health data. Amazon has noted the inefficiencies in the healthcare system and even attempted to enter the market, with mixed results. For example, it started Amazon Pharmacy to offer home delivery of prescriptions and created the Halo, a wearable fitness band, in 2020; its venture into telehealth, Amazon Care, was less successful and will be shuttered at the end of 2022. Amazon’s acquisition of One Medical, a primary care organization, is the company’s latest foray into healthcare. Unlike e-commerce-related consumer data, One Medical’s businesses include health care providers that are considered covered entities under HIPAA and must comply with HIPAA, state health care privacy laws, and other regulations, and presumably, certain administrative, physical and technical safeguards with respect to the “protected health information” of patients would need to be implemented to separate it from Amazon’s consumer data trove. In a recent release, One Medical reiterated this point, stating: “Once the transaction closes, One Medical customers’ HIPAA Protected Health Information will be handled separately from other Amazon business, as required by law. As required by law, Amazon will never share One Medical patients’ personal health information outside of One Medical for advertising or marketing purposes without clear permission from the patient.” Still, it should be noted that other types of health-related consumer data, such as data from wearable fitness bands, health-related mobile apps or Amazon Prime purchases, would generally not be covered by HIPAA and can be valuable to platforms and marketers; there is also the possibility that many consumers, already enamored by the level of service from Amazon, will knowingly consent to sharing health data in exchange for a more seamless, portal-driven level of healthcare. Further, there is, perhaps, the potential for Amazon to de-identify, aggregate and anonymize the healthcare information it collects to train data sets for artificial intelligence systems and diagnostic tools, and if an Amazon-One Medical combination proves successful, it will likely spur future partnerships between healthcare networks and large technology companies to tackle other inefficiencies in the delivery of healthcare.

The acquisition of iRobot, on the other hand, would provide Amazon with new, very specific data: home mapping data. Over the years, Amazon has seen an increase in the number of consumers interested in “smart homes” or digital products to do mundane household things they do not feel like doing manually, and Amazon’s overall strategy seems to be to build a growing swath of digitally-comfortable customers that use its suite of smart home products and services. iRobot sells many different types of robot vacuums, which are “smart” enough to capture data on users’ home floor plans and create Imprint Smart Maps, including the Roomba J7 Series, which can also recognize over 80 common objects (like pet waste and charging cords), that are sent to and stored in the cloud (depending on the customers’ chosen device settings). That information could potentially then be analyzed and used to make assumptions about individual users or aid marketing efforts. As noted in coverage by Bloomberg, this might look like, for example, “The size of your house is a pretty good proxy for your wealth. A floor covered in toys means you likely have kids. A household without much furniture is a household to which you can try to sell more furniture.” All of this information could be an asset to Amazon, as the company is in the business of selling products and making its platform more attractive to both smart home enthusiasts and consumers who are just getting acquainted with using home-related digital devices. Amazon’s interest in acquiring iRobot is just one example of this. Both companies have already seen their consumers’ interests in their digital devices’ synchronization, as many users of both the Amazon Alexa and Roomba or Braava jet vacuums take advantage of the devices’ compatibilities using their voices to start or stop their vacuums or schedule future home cleanings.

With the acquisition still pending, it remains to be seen how, and if, Amazon will use Roomba and Braava jet data. It should be noted that back in 2017, the iRobot CEO, Colin Angle, stressed iRobot would not sell consumer data. However, a number of privacy advocates have expressed concern about Amazon’s acquisition of iRobot and the potential for the collection of additional consumer data. With each new acquisition or product offering, Amazon inches deeper into the evolving smart home and healthcare markets, increasing its potential to harness valuable consumer data, which it uses to improve its services and enhance its platform and profitability.

As companies, like Amazon, continue to acquire companies that collect consumer and health information, they will need to ensure there are adequate contractual restrictions in place to comply with the developing privacy laws and regulations that could alter the value and usefulness of such data. At a company level, privacy policies, terms of service, or even broad user agreements covering all company services, now and in the future, may need to be altered or restated, to clarify how, when, and in what types of situations companies can use personal consumer data. At the federal level, Congress continues to consider a comprehensive federal data privacy law (the so-called bipartisan ADPPA) and the FTC has moved forward with its recent commercial surveillance rulemaking, actions that could potentially provide consumers with, among other things, certain opt-out and deletion rights over their own data. Moreover, with the upcoming changes to and expected stricter enforcement of the California Consumer Privacy Act (CCPA) and the effective dates of other state data privacy laws coming in 2023, a significant group of consumers will have additional rights over their personal data and state attorneys general will have additional powers of enforcement over covered entities. Regardless of how the regulatory environment shakes out, the desirability of consumer personal information and data will only increase, particularly as technologies and AI-powered solutions offer additional methods to gain insights and value from such information.

Danielle Brooks and Jonathan Mollod also contributed to this article.