Measuring risks inherent to our digital economies using Amazon purchase histories from US consumers

TL;DR

This study demonstrates that consumer purchase histories can reveal sensitive personal attributes like race and health, highlighting privacy risks in digital economies, using Amazon data from US customers.

Contribution

First open analysis quantifying inference risks from purchase data, showing how personal attributes can be predicted with high accuracy and analyzing the impact of data scale and product categories.

Findings

High accuracy in predicting gender and health status from purchase data

Inference risk increases with more data and specific product categories

Purchase histories can reveal sensitive personal attributes with minimal data.

Abstract

What do pickles and trampolines have in common? In this paper we show that while purchases for these products may seem innocuous, they risk revealing clues about customers' personal attributes - in this case, their race. As online retail and digital purchases become increasingly common, consumer data has become increasingly valuable, raising the risks of privacy violations and online discrimination. This work provides the first open analysis measuring these risks, using purchase histories crowdsourced from (N=4248) US Amazon.com customers and survey data on their personal attributes. With this limited sample and simple models, we demonstrate how easily consumers' personal attributes, such as health and lifestyle information, gender, age, and race, can be inferred from purchases. For example, our models achieve AUC values over 0.9 for predicting gender and over 0.8 for predicting diabetes status. To better understand the risks that highly resourced firms like Amazon, data brokers, and advertisers present to consumers, we measure how our models' predictive power scales with more data. Finally, we measure and highlight how different product categories contribute to inference risk in order to make our findings more interpretable and actionable for future researchers and privacy advocates.