Three Enerbase convenience stores in Minot, North Dakota, are piloting Amazon One palm scanners for faster payment at checkouts.
Amazon.com Inc.’s palm-print recognition and payment system called Amazon One uses a kiosk where consumers have their palms scanned and input the credit or debit cards they want tied to the biometric data. Once the system processes the palm images and payment card information, consumers can purchase goods by placing their palm over a detector, said Joni Corbin, store manager at the Minot Travel Plaza. They won’t have to pull out their credit or debit card, swipe it and wait for the transaction to process.
But so far, customers have been reluctant to turn their personal biometric information into a payment form, she said. While Amazon One was launched in September 2020, it has been slow to gain traction nationally, in part because lawmakers also are resisting the company’s expansion efforts and raising questions about the risk of privacy violations. In its first-quarter financial report, released Thursday, Amazon said Panera is the first restaurant chain to use Amazon One’s loyalty linking capability, allowing consumers to redeem rewards and pay by hovering their palm over a detector.
In Minot, most people aren’t aware of Amazon One, Corbin told CSP Daily News. “In North Dakota, people are more willing to try something if they’ve heard about it from a surrounding state. We’re usually one of the last ones. We’re one of the first ones for this. We haven’t heard of it.”
Besides at the Minot Travel Plaza where Corbin works, the technology is being tried at Corner Express and North Broadway convenience in Minot. The locations are part of Enerbase, a convenience-store cooperative previously called Cenex of Minot.
Enerbase Chief Executive Tony Bernhardt saw the biometric scanner in use at a store while traveling in Texas, Corbin said. He agreed to try the Amazon One palm scanning program for 90 days, she said. Bernhardt didn’t return CSP’s requests for comment.
How It Works
Users sign up for Amazon One just once and their biometric data is saved in Amazon’s system and can be used repeatedly for payment, the Seattle-based retail technology company said on its website.
Palm images can be used for identification and for entry into certain locations. As Amazon explains on its website, each person has a unique palm signature. Detecting the palm signature doesn’t require the user to touch the reader. Amazon One’s technology uses palm imaging and computer-vision algorithms to capture and encrypt the individual’s palm signature. The retail-tech company declined to provide other information about the pilot.
While some consumers might be delighted at the new way to speed their transactions at convenience stores, others don’t want their biometric data used.
Corbin said only one person at the Travel Plaza she manages has used the kiosk to scan their palm image so they don’t have to pull out their card when they make a purchase. For those willing to try it, the palm scanner is presented as “faster and more convenient if they accidentally left their wallet at home or in the car,” Corbin said.
But most customers are reluctant to try it, she said. “We had to have my employees write down the comments people were making, and they were all negative,” Corbin said. “They don’t want it.”
Senators' Reaction
Lawmakers also have concerns. In a 2021 letter to Amazon’s Chief Executive Andy Jassy, three U.S. senators said Amazon One’s biometric data collection practices raise questions about how the personal information could be used for advertising and tracking purposes. The letter referred to reports that Amazon offered consumers a $10 promotional credit for Amazon.com products for sharing their biometric information with Amazon One.
“Amazon One users may experience harms if their data is not kept secure. Data security is particularly important when it comes to immutable customer data, like palm prints,” wrote U.S. Sens. Bill Cassidy (R-Louisiana), Amy Klobuchar (D-Minnesota) and Jon Ossoff (D-Georgia). Cassidy also is a medical doctor.
Others oppose the use of biometrics because of privacy considerations. Illinois lawmakers expressed concern it could lead to more problems with identity theft that would be more difficult to resolve. Biometrics "are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions," according to the Illinois’ Biometric Information Privacy Act.
The act also said, "An overwhelming majority of members of the public are weary of the use of biometrics when such information is tied to finances and other personal information."
Illinois is one of several states to stipulate companies must inform individuals in writing and obtain a release before collecting and storing biometric information. It also bars companies from selling, renting or profiting from an individual's biometric information. Biometrics can include retina and iris scans, fingerprints, voiceprints and scans of hand or face geometry.
Risk of Litigation
The use of biometrics comes with more risk than traditional transaction methods in part because the stakes are higher, according to legal experts and lawmakers. The damages for misusing biometric information can quickly add up, said attorney Greg Szewczyk of Ballard Spahr’s Denver and Boulder offices, who was a presenter on privacy law at Winsight Media’s Risk Management Forum April 13.
In a class-action case involving workers at White Castle System Inc. restaurants in Illinois, the employees accused White Castle of unlawfully scanning their fingers when they accessed their pay stubs and computers. The company also disclosed the information to a third-party vendor, according to the legal complaint.
Illinois’ law stipulates each intentional violation of the law may be subject to damages of $5,000, while unintentional violations may be subject to $1,000 in damages. The Illinois Supreme Court upheld the law and found, in favor of the employees, “that a separate claim accrues under the Act each time a private entity scans or transmits an individual’s biometric identifier or information.” The company estimated damages in the case involving 9,500 employees could reach $17 billion, Reuters reported.
How companies manage information on customers is particularly important because typically privacy laws are enforceable according to the individual addresses of the consumers not according to the company’s location, Szewczyk said.
New York Case
A New York case filed in March against Amazon Go stores accused the retailer of failing to notify customers at the entrance of the “Just Walk Out” cashierless store that their biometric information was being collected from Jan. 15, 2022, when New York’s Biometric Identifier Information Law took effect, to March 13, 2023. The store uses Amazon One’s palm imaging technology, according to CBSNews. Amazon announced in March it was closing eight Go stores, including two in New York.
Customer Alfredo Rodriguez Perez, who filed the New York lawsuit against Amazon and asked the court to certify it as a class-action case, is seeking monetary damages. New York’s biometric privacy act, which took effect in July 2021, establishes damages of $500 to $5,000 per violation, with the higher amount for violations determined to be intentional or reckless.
While the outcome of the case can’t be predicted, many companies prefer to avoid litigation that can take months or years to resolve.
Besides the privacy-related issues, lawmakers in New Jersey and the City of the Philadelphia have passed regulations banning cashless stores because they discriminate against people who don’t have access to credit card and debit cards, The New York Times reported.
In Minot, Corbin said she tried to use the Amazon One kiosk, but it wouldn’t accept her payment card.