Amazon's Project Starfish caught scraping despite GDPR opt-out [evidence]

3 points

3 months ago

I officially opted out of Amazon’s AI “Project Starfish” and received written confirmation, since then I have caught their bots 50+ times bypassing my security (cloudflare) to hit my Shopify origin directly. This is intentional circumvention of security measures implemented to uphold my legal GDPR ‘right to object’

Image 1

[2026_02_22_1308_timestamp_1771765731_El_Rat_Designs_Canary_JS_Clone_REDACTED.png](https://postimg.cc/yDLnHtyM)

shows an internal server path: file:///data/analysis/xtract. This shows that they are not just visiting, they are cloning code into a private forensic sandbox to reverse engineer and catalogue its contents.

Image 2

[2026_02_23_0016_Amazon_Virginia_probe_image_size_KH_artwork_REDACTED.png](https://postimg.cc/75KXkdnR)

is using a targeted image theft tool. Probe-image-size/7.2.3. this is a specific developer library used to scan my product library. In this hit at 00:16 today they were targeting exclusive Kristin Hersh handwritten lyric artwork, proving a calculated commercial harvest of unique IP.

I filed an ICO complaint against Amazon yesterday for continuing abuses. I will be making more filings this week.

I will be publishing my code for free asap, so that any merchant on shopify will be able to track Amazon abuses, so that you can file complaints too.

Amazon are a trillion dollar company stealing from independent artists and merchants. They think they have the right to take everything, and they are hiding what they are doing… They are running an automated extraction triggered on opt-out, this is full scale espionage… And we can see them.