Amazon Cookie Rules 2026: Block Them and You Lose the Checkout

Most websites present cookies as a preference. Amazon.in's Privacy Notice is unusually direct about what declining actually costs:

"The Help feature on most browsers and devices will tell you how to prevent your browser or device from accepting new cookies or other identifiers, how to have the browser notify you when you receive a new cookie or how to block cookies altogether. Because cookies and identifiers allow you to take advantage of some essential features of Amazon Services, we recommend that you leave them turned on. For instance, if you block or otherwise reject our cookies, you will not be able to add items to your Shopping Cart, proceed to Checkout, or use any Services that require you to Sign in."

Cart, checkout and sign-in. That is not a degraded experience; that is the entire transaction. The notice is describing something technically ordinary — a logged-in session and a persistent basket genuinely require state to be stored somewhere — and it deserves credit for saying so plainly rather than implying that refusal is costless.

It is worth being precise about what this does and does not mean. It does not mean that every cookie Amazon sets is necessary to buy something. The same notice describes separate advertising and interest-based identifiers, with their own opt-out routes, that have nothing to do with holding a basket. The quoted sentence describes the consequence of blocking cookies altogether, which is the blunt instrument a browser offers. Nothing here suggests Amazon sets cookies unlawfully or beyond what it discloses, and no such allegation is made.

One sentence in the uses-of-information section does more than it first appears to. Under fraud and abuse prevention: "We use personal information to prevent and detect fraud and abuse in order to protect the security of our customers, Amazon, and others. We may also use scoring methods to assess and manage credit risks."

Scoring methods, credit risks. The service-provider section repeats it from the other direction, listing among the functions performed by third parties on Amazon's behalf: "scoring, assessing and managing credit risk". And the legal-disclosure clause mentions "exchanging information with other companies and organizations for fraud protection and credit risk reduction."

Credit assessment is unremarkable for a company that offers pay-later products, EMI options and co-branded cards, and running such checks is lawful and expected. What is worth knowing is that the notice places it in the general privacy notice that applies to ordinary shopping, not solely in the terms of a credit product you have applied for — and that the scoring may be done by third parties on Amazon's behalf.

No claim is made here that any shopper has been scored, that any score has affected anyone's prices, offers or access to any service, or that any credit decision has been taken about any individual. We created no account and applied for nothing. The notice reserves the practice; it does not describe its scope, and we are not in a position to.

The business-transfers clause is short, and it is the one most people would be surprised by: "As we continue to develop our business, we might sell or buy other businesses or services. In such transactions, customer information generally is one of the transferred business assets but remains subject to the promises made in any pre-existing Privacy Notice (unless, of course, the customer consents otherwise). Also, in the unlikely event that Amazon.com, Inc. or Amazon Seller Services Private Limited or any of its affiliates, or substantially all of their assets are acquired, customer information will of course be one of the transferred assets."

Customer information is described as an asset, and it moves with the business. The clause does carry a real protection — the data "remains subject to the promises made in any pre-existing Privacy Notice" — which is more than several retailers offer; Croma's notice, by comparison, says data "may be transferred as part of such transaction" without attaching that condition.

Set against it is a commitment worth quoting in full, because not every retailer makes one: "Information about our customers is an important part of our business and we are not in the business of selling our customers' personal information to others." Sharing is then described as limited to Amazon.com, Inc. and controlled subsidiaries subject to this notice or practices "at least as protective", third-party sellers and services involved in your actual transactions, service providers, and legal or fraud-protection disclosures.

Clause-for-clause, that is a more restrictive sharing position than some Indian retailers publish. It is reported here as such.

The advertising clauses are more nuanced than the usual blanket statement, and both halves deserve quoting. First the limit: "We provide ad companies with information that allows them to serve you with more useful and relevant Amazon ads and to measure their effectiveness. We never share your name or other information that directly identifies you when we do this. Instead, we use an advertising identifier like a cookie, a device identifier, or a code derived from applying irreversible cryptography to other information like an email address."

Then the qualified version: "While we do not share your specific shopping actions like purchases, product views, or searches with ad companies, we may share an advertising identifier and an estimate of the value of the ads they show you on our behalf so they can serve you with more effective Amazon ads. Some ad companies also use this information to serve you relevant ads from other advertisers."

Purchases, views and searches stay in; an identifier and a value estimate go out. That is a meaningfully narrower position than "we share your browsing with advertisers", and the hashed-email mechanism it describes is standard practice across the ad industry. The last sentence is the one to read twice: the identifier shared for Amazon's own ads may also be used by those companies to target you with other advertisers' ads.

The notice also covers "voice, image and camera services": "we use your voice input, images, videos, and other personal information to respond to your requests, provide the requested service to you, and improve our services" — which is the Alexa and visual-search clause, and the reason the device settings menu matters as much as the website's.

The notice points to real levers rather than only describing collection. "You will also be able to opt out of certain other types of data usage by updating your settings on the applicable Amazon website (e.g., in 'Manage Your Content and Devices'), device, or application." Advertising preferences have their own page, marketing e-mail carries an unsubscribe link, and in-app notifications are controlled in the app or device settings.

On devices, it notes that "Most non-Amazon devices also provide users with the ability to change device permissions (e.g., disable/access location services, contacts)" and directs users to the device settings menu — a useful reminder that location and contacts permissions are granted at the operating system, not at the website.

The consent framing is broad, as it is nearly everywhere: "By using Amazon Services you agree to our use of your personal information (including sensitive personal information) in accordance with this Privacy Notice, as may be amended from time to time by us at our discretion. You also agree and consent to us collecting, storing, processing, transferring, and sharing your personal information ... with third parties or service providers for the purposes set out in this Privacy Notice."

The collecting entity is named with an address: Amazon Seller Services Private Limited, registered office 8th floor, Brigade Gateway 26/1 Dr. Rajkumar Road, Bangalore, Karnataka 560055. Whatever rights apply to you under Indian data protection law, that is the entity any formal request would be addressed to.

Four practical points, none of them legal advice. One: do not expect to shop with cookies blocked. The notice says plainly that blocking them costs you the cart, the checkout and sign-in — so the useful control is the advertising preferences page and device permissions, not a blanket browser block. Two: the advertising opt-outs are separate from the cookie question and live on their own settings pages, which is where to go if targeted ads are the concern. Three: device permissions are set on the device — location, contacts, microphone and camera are granted in the operating system, and the notice says so. Four: note the named entity and Bangalore address if you ever need to make a formal data request. Everything above is Amazon's published notice as it stood on 8 October 2026, and it states in terms that it may be amended at Amazon's discretion. This page describes a published privacy notice and expresses no view on whether any part of it complies with any law; nothing here is legal advice.