Motorola says affiliate hijacking of Amazon app was ‘unintended’

Motorola says that recently discovered behavior, which saw some of its phones sending users to an affiliate tracking website before opening the Amazon app, was “unintended” and has been “promptly corrected.” The company didn’t explain how the error was introduced in the first place.

“Recently, Motorola acted quickly to resolve an issue that was identified, which caused some users in the US launching the Amazon Shopping app to be routed through a web tracking link before opening the app. This behavior was unintended and resulted in an inconsistent user experience,” Allison Yi, Motorola’s executive director of product management, told The Verge in a statement. “Upon identifying the issue, we promptly corrected the routing configuration. Users can now expect all installed apps to launch directly as intended.”

The unusual situation was first reported by 9to5Google after it was spotted by a Reddit user. On opening the Amazon app the phone would first briefly open the phone’s browser before returning to Amazon. Strangest of all, users were sent to a website that appears to be linked to fashion influencer Kira Abboud, though isn’t actually referenced on any of her other pages. That split-second visit was enough to install a tracking cookie however, which in turn added an affiliate code to the user’s shopping session — though, again, not one that matches any of Abboud’s other content.

The code wouldn’t make any direct difference to the end user, but could theoretically allow whoever installed it to receive a small percentage of any purchase that was made. The Verge uses similar Amazon affiliate links for some of our shopping content, though always with a disclaimer, rather than installed covertly.

Yi blamed the redirect on “an app search and suggestion experience for the Moto App Launcher” co-developed with Device Native. It was Device Native’s website that Reddit user Trypocopris noticed was being queried by the phone behind the scenes before users were sent to kira-abboud.com. The company says on its website that it delivers “personalized, on-device mobile ad serving without sharing user data.” Amusingly, until yesterday Device Native had a public page listing the documentation for its Motorola integration. That page has now been taken offline, though not before the Internet Archive made a copy.

Motorola did not comment on how the “issue” was introduced, or whether Device Native was to blame, but did reiterate its commitment to user privacy. “Motorola takes user experience, privacy, and platform integrity seriously and will continue to closely monitor the system to ensure expected behavior across devices,” Yi said.