Overview

Amazon is tightening the confidentiality obligations for developers who use the Selling Partner API (SP‑API). Effective February 8 2025, Section 3 of the Data Protection Policy expands the definition of protected information beyond personal data to include a wide range of business‑sensitive details exchanged via API calls. Sellers and solution providers must adapt quickly, because continued API usage after the start date automatically signals acceptance of the new rules.

Key Points

• Expanded definition of confidential data — Non‑public business information such as pricing algorithms, inventory forecasts, and fulfillment workflows now falls under the policy’s protection, not just personally identifiable information (PII).
• Stricter handling requirements — Developers must adopt tighter controls for storing, processing, and even discussing Amazon‑derived data internally, with penalties for any unauthorized disclosure.
• Protection of technical assets — API specifications, integration guides, and internal support communications are explicitly treated as proprietary, requiring the same level of safeguarding as seller data.
• Broader compliance responsibility — Solution providers are required to ensure that every employee, contractor, and third‑party partner who touches SP‑API data understands and follows the updated confidentiality standards.
• Automatic agreement upon use — Any developer who keeps accessing SP‑API after February 8 2025 is deemed to have accepted the revised terms, eliminating the possibility of opting out without ceasing API usage.

How the Updated Confidentiality Rules Work

1. Identify all non‑public Amazon data — Review every API endpoint your application calls and list the types of information returned (e.g., sales velocity metrics, promotional pricing, or seller‑specific performance scores). For instance, a price‑optimization tool that pulls “Buy Box eligibility” data must now treat that metric as confidential.
2. Apply enhanced safeguards — Implement encryption at rest and in transit for the identified data, restrict access to only those roles that need it, and log every read or write operation. A concrete example: a data warehouse that stores daily inventory snapshots must encrypt each snapshot file and limit database credentials to a single service account used by the analytics pipeline.