Amazon’s Fire TV Is A Secret Surveillance Machine

What Was Actually Taken From You

You saved up. Maybe it was a few hundred dollars, maybe over a thousand. You brought a television home. You set it on the stand, plugged it in, and sat down to watch something in the privacy of your own living room. Nobody else was supposed to be in that room with you.

But there was someone else in the room. Amazon was there. From the moment you powered up that screen, software invisible to you was recording everything: the documentary you watched about a health condition you haven’t told your family about yet, the late-night scrolling through a streaming service’s LGBTQ+ section, the news channel you keep on in the background because it reflects your politics, the church service you streamed on Sunday morning. All of it. Every frame. Every word spoken through the speakers.

Congress understood this kind of violation when it passed the Video Privacy Protection Act in 1988. Legislators described books and films as “the intellectual vitamins that fuel the growth of individual thought” and recognized that “the whole process of intellectual growth is one of privacy — of quiet, and reflection.” They called for protection from “the disruptive intrusion of a roving eye.” They called these records “a window into our loves, lives, and dislikes.”

What Amazon built is exactly that roving eye, embedded in a device you paid for, sitting inside your home, running continuously. The complaint documents that ACR data can reveal your race, your religion, your sexual orientation, your political beliefs, your health interests, your marital status, your family composition, and the ages of your children. Amazon used this to build profiles it then sold access to. Not just to show you ads. To let corporations pay for the right to target you based on the most private dimensions of who you are.

The people named in this lawsuit, Nancy Manypenny of Elgin, Illinois and Kenneth Enser of Springville, New York, are two ordinary people who bought televisions and expected them to work as televisions. Neither of them consented to becoming a data product. Neither of them was told they were being watched. The tens of millions of Americans who own Fire TV devices were in the same position. They paid for the screen. Amazon collected the rent on everything they watched through it.

What the Complaint Actually Says

“Fire TVs do not simply track what apps you use and how long you use them. Every Fire TV runs Amazon’s ACR technology, which tracks the content displayed on the screen and the audio output through the speakers of the televisions in consumers’ living rooms. Through use of this ACR technology, Amazon knows every video you watch, which parts of those videos you watch, which parts you pause or rewind, and every word you hear. This surveillance is not just limited to apps on the Fire TV app store, either. If you connect a game system, DVD or Blu-Ray Player, a computer, or third-party streaming device to your Fire TV, Amazon is still watching and recording everything you see and hear.”

• This quote establishes that ACR surveillance is not limited to Amazon’s own services. Any device connected to a Fire TV via HDMI falls within Amazon’s recording scope, meaning your gaming activity, your personal computer screen, and your physical media are all captured.
• The words “every word you hear” confirm that audio surveillance is continuous, not triggered by a wake word or command, distinguishing this from Alexa’s documented activation model.
• The phrase “every video you watch, which parts you watch, which parts you pause or rewind” establishes granular behavioral tracking, not just a log of titles watched.

“Amazon builds profiles on consumers based on what genre, when, how often, and what content consumers see. These yield ‘household-level content viewership’ that is used for advertising. Amazon’s consumer profiles include cross-device or cross-screen linkage, meaning that data collected from Fire TVs is correlated with other online activity—including Amazon.com shopping behavior—and smart devices to facilitate cross-device ad targeting and tracking.”

• This passage proves the data does not sit in a silo. Viewing data is fused with shopping data from Amazon.com to create a unified behavioral profile, which is then sold to advertisers as a targeting product.
• “Household-level content viewership” confirms Amazon identifies and tracks individual members of a household separately, even when they share the same device.

“ACR captures or infers highly personal attributes pertaining to consumers’ race, sex, or religious and political beliefs, all of which fall under sensitive personal data categories under virtually every privacy regime both nationally and internationally.”

• This is the complaint establishing that the harm is not abstract. Race, religion, political belief, and sexual identity are the most legally and socially sensitive categories of personal data, and Amazon’s system ingests them automatically.
• The word “infers” is legally significant: Amazon does not need you to declare your religion. The algorithm derives it from what you watch, then packages that inference as a marketable audience segment.

“When consumers’ Fire TV OS updates, these updates reset many default settings in the OS including these privacy settings. Therefore, a consumer who has affirmatively opted out of every setting necessary to disable ACR may still be subject to Amazon’s ACR surveillance.”

• This is the complaint documenting that even the opt-out mechanism is sabotaged. Consumers who successfully navigate the buried menus and turn off surveillance can be silently re-enrolled by an automatic software update.
• This pattern, described in consumer protection law as a “dark pattern,” means there is no permanent opt-out available to the average consumer; ongoing vigilance is required indefinitely.

What Amazon Told You vs. What Amazon Did

The complaint documents a consistent gap between Amazon’s public representations about privacy and the actual functioning of its ACR surveillance system.

• Amazon publicly states: “Amazon never sells or rents customers’ personal data.” The documented reality: Amazon operates a $68.63 billion advertising business that sells advertisers targeted access to specific consumers, segmented by their personal viewing data, shopping behavior, religion, political affiliation, and sexual orientation. The complaint calls this representation “misleading because it obscures the fact that Amazon monetizes consumer data by providing ACR-derived targeting capabilities to advertisers.”
• The Fire TV setup screen tells users: “Amazon processes and retains audio, interactions, viewing, and other data in the cloud to provide and improve our services.” The documented reality: this disclosure does not mention that a continuous screen-capture and audio-recording tool is running, that it covers HDMI-connected external devices, that the data is correlated with shopping behavior, or that it is used to allow third-party advertisers to target consumers by sensitive personal attributes.
• The “Device Usage Data” privacy toggle describes itself as: “Use personal data collected by the operating system of this device for marketing and product improvement purposes.” The documented reality: this description does not mention that “personal data” includes constant visual and audio recording of everything on the screen, that it captures content from externally connected devices, or that it feeds into a $68.63 billion advertising business.
• The “Collect App and Over-the-Air Usage Data” toggle describes itself as collecting “information relating to your use of over-the-air TV content and the frequency and duration of your use of third-party apps.” The documented reality: the underlying ACR technology captures every frame and word from all content displayed, including non-app content from connected devices, not just frequency and duration metadata.

The Business Model Is the Crime

The complaint documents a deliberate corporate strategy in which the Fire TV hardware is a vehicle for extracting consumer data that powers a far more profitable advertising business, at the direct expense of user privacy and legal compliance.

• Amazon’s advertising segment generated $56 billion in 2024 and grew to $68.63 billion in 2025, a 22% year-over-year increase. In 2025, advertising represented 9.36% of Amazon’s total revenue, the highest share ever recorded.
• Amazon is the third-largest digital advertising company in the world, behind only Google and Meta. Fire TV ACR data is a primary driver of its competitive advantage in that market.
• The complaint explains the structural incentive directly: average margins on TV hardware are now less than 1%, while margins in connected TV advertising are 50% or more. Amazon, like the rest of the industry, offsets hardware losses by monetizing the consumer as the product.
• Amazon’s unique advantage over Google and Meta is its ability to fuse television viewing data from Fire TV with first-party e-commerce shopping data from Amazon.com, producing targeting capabilities no other platform can match. This fusion is the direct output of the ACR surveillance system.
• Amazon requires that third-party apps on Fire TV with over 50,000 hours of monthly usage in the United States integrate with Amazon Publisher Services and surrender 30% of their in-country advertising impressions to Amazon. This means Amazon extracts a surveillance tax not only from its own users but from every major third-party app that reaches those users.
• The ACR data feeds into Amazon’s demand-side platform (DSP), which sells corporate advertisers the ability to target specific Fire TV users by religion, political affiliation, ethnicity, sexual orientation, health interests, marital status, family composition, and age.

How Amazon Hid Inside the Law’s Blind Spots

The complaint documents conduct that exploited the gap between what privacy laws were designed to prevent and the specific technical mechanisms Amazon used to accomplish the same harm through newer technology.

• The Video Privacy Protection Act was written in 1988 to regulate video rental stores. Amazon exploited the lag between that statutory language and modern streaming technology by operating a surveillance platform that functions precisely as the VPPA intended to prohibit. The complaint cites Congressional reaffirmation that the VPPA applies to “‘on-demand’ cable services and Internet streaming services” to argue this gap was already closed by Congress, making Amazon’s conduct a direct violation rather than a loophole.
• Amazon’s public statement that it “never sells or rents customers’ personal data” is technically constructed to avoid the precise language of privacy laws prohibiting data sales, while Amazon’s DSP platform sells advertisers direct, profile-based access to consumers. The complaint frames this as a deliberate semantic construction designed to deflect legal liability while achieving the commercially identical outcome.
• By describing its surveillance settings in vague language like “Device Usage Data” and “Collect App and Over-the-Air Usage Data,” Amazon created disclosures that are technically present in the UI but fail the VPPA’s requirement for “informed, written consent in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer.” The complaint argues these disclosures are designed to appear compliant while ensuring the average consumer cannot understand what they are consenting to.
• The ACR system captures data from devices connected via HDMI that are entirely outside Amazon’s contractual relationship with the consumer. There is no disclosed legal basis for Amazon to record and analyze content from a user’s personal laptop or game console simply because it is plugged into an HDMI port on a Fire TV.

Technically Present, Functionally Invisible

The complaint documents a privacy disclosure architecture that satisfies the minimum formal requirements of notice while being engineered to prevent consumers from acting on that notice.

• The VPPA requires informed, written consent that is “distinct and separate” from other legal obligations. Amazon presents its data collection disclosure as fine print at the bottom of the initial setup screen, embedded in a click-through “Conditions of Use” agreement. This is technically a form of disclosure; it is not functionally distinct or informed consent as the statute requires.
• Consumer fraud statutes in multiple states prohibit deceptive practices in the conduct of commerce. Amazon’s opt-out design nominally provides a mechanism for consumers to disable ACR. The complaint documents that this mechanism requires navigating Settings, then Preferences, then Privacy Settings, then individually toggling multiple separate controls, none of which are labeled in language that communicates continuous screen surveillance. The existence of the opt-out satisfies the formal requirement; the design of the opt-out ensures it will not be used.
• Amazon’s OS update policy resets privacy opt-out settings to surveillance-on defaults. No law directly specifies that updates cannot reset user preferences. The result is that a consumer who has successfully opted out can be silently re-enrolled, defeating the purpose of the opt-out right entirely while preserving its formal existence.

Your Toshiba Is Amazon’s Surveillance Device

The complaint documents how Amazon extended its surveillance infrastructure through third-party TV manufacturers while retaining full control of the data collection system, using the brand separation to obscure consumer awareness without surrendering any commercial benefit.

• Amazon licenses its Fire TV OS to third-party manufacturers including Toshiba, Insignia, TCL, and Hisense. Consumers who purchase these brands may not understand they are buying a device running Amazon’s operating system. Insignia is Best Buy’s house brand, manufactured by Hisense and TCL in Chinese factories. The Toshiba television brand has been licensed to Hisense since 2017. Both brands run Amazon’s ACR technology identically.
• The complaint states explicitly: “Amazon controls the ACR technology, data collection settings, privacy policies, and advertising infrastructure on all Fire TVs, regardless of the hardware manufacturer.” The hardware manufacturer is the face of the product at retail; Amazon is the entity collecting the data and generating the advertising revenue.
• Plaintiff Kenneth Enser purchased a Toshiba 55C350LU from Best Buy, believing he was buying a Toshiba television. He was buying a Fire TV OS device. The ACR Tool intercepted and disclosed his Sensitive Information under exactly the same technical infrastructure as an Amazon-branded Fire TV.
• Because third-party manufacturers are separate legal entities, a consumer investigating privacy practices might research the manufacturer’s privacy policy rather than Amazon’s. Amazon retains all commercial benefit from the ACR data while the corporate structure obscures its role as the surveillance operator.