Home › Resources

Alexa Skill Certification Privacy Review: What Amazon Checks Before Your Skill Goes Live

Published October 31, 2026 · Checked against Amazon's Alexa developer documentation on that date

Alexa skill certification reviews privacy in four places. Reviewers open your Privacy Policy URL and apply Amazon's three privacy-URL tests. They check the Privacy requirements and Skills that use account linking sections of the Security Requirements. They compare your answers on the Privacy & Compliance page with what the skill actually does. And if the skill targets children, they apply section 2 of the Policy Requirements, Child-directed Alexa skills. A policy URL is mandatory when a skill uses account linking or collects personal information, whether through voice or through skill permissions.

This page covers the review itself. For the policy document, an example and hosting, see the Alexa skill privacy policy guide and example. This page is not legal advice.

What Alexa Certification Checks on Privacy

The privacy review draws on four Amazon documents, and each can trigger a rejection on its own.

Under Privacy requirements, item 4 says that before collecting personal information (name, address, email, date of birth, phone number) you must show a legally adequate privacy notice on the skill detail page, use the data only as users consented, keep collection in line with that notice and the law, and collect only what the skill's features need. Item 5 bars collecting or reciting passport, social security or national ID numbers and full bank or card numbers. Item 6 allows reading out a full date of birth, driver's license, vehicle registration or insurance policy number only behind a voice code set during account linking.

Why Skills Get Rejected on Privacy, and How to Pre-empt Each Reason

• No policy where one is required. A skill that uses account linking or collects user information without a valid policy "will not be published", according to Amazon's privacy-URL guidance. Pre-empt: if any permission or slot captures a name, email, address or phone number, or account linking is on, add a policy.
• An optional policy that fails anyway. A skill that collects nothing needs no policy, but one you add is still reviewed. Pre-empt: make sure it passes the URL tests below.
• Privacy & Compliance answers that contradict the skill. If you answer "No" to "Does this Alexa skill collect users' personal information?" while the skill asks for the email permission, the answers and the behavior disagree. Pre-empt: answer each question from what the skill does in testing, then make the policy say the same.
• An account linking login page that fails the ownership rules. On your own authorization server, you must own the login domain, it must reflect your brand, skill or developer name, the page must show that name, and it must use HTTPS. With another OAuth provider, you "cannot directly handle, store, or transmit credentials" for the user. Pre-empt: send users to the provider's HTTPS login page; never collect passwords in your own form.
• No statement of what account linking collects. With Login with Amazon, you "must clearly state the customer information that your skill collects and uses", either on the login page or in your privacy policy. Pre-empt: name each profile field you request and what you use it for.
• Sensitive identifiers by voice, or reading out data without a voice code. These break items 5 and 6. Pre-empt: remove any intent that asks for those numbers. If the skill must read back a date of birth or license number, add a voice code of at least four digits, requested every new session and never shown on cards or screens.
• Missing test access. Reviewers need valid test account credentials for each locale you submit. Pre-empt: enter them in Testing Instructions, with steps for account linking and permissions.

Where the Policy URL Goes in the Developer Console and What Makes It Fail

In the Alexa developer console, open the Distribution page, choose Skill Preview, select a language such as English (US), and fill in the Privacy Policy URL under Primary Details. The Terms of Use URL sits next to it. Both are set per language, so a skill published in three locales has three sets of fields to complete. Amazon's field note says the privacy policy URL is required when the skill "uses account linking, includes advertising, or collects user information."

The same Distribution page has Privacy & Compliance in its left menu. Amazon's documentation currently lists five questions there:

1. "Does this skill allow users to make purchases or spend real money?"
2. "Does this skill use Alexa Shopping Actions?"
3. "Does this Alexa skill collect users' personal information?"
4. "Is this skill directed to or does it target children under the age of 13?"
5. "Does this skill contain advertising?"

Amazon names the conditions that make a policy URL fail review:

• It does not open the privacy section. A link to your home page fails, even if the policy is one click away.
• It is in the wrong language. The policy must be in one of the skill's own languages. A skill submitted in en-GB and de-DE can use an English or German policy, but not a Spanish one, even though Alexa supports Spanish.
• It names another skill or company. A recycled policy from a different product is not valid.
• It does not load. For account-linked skills, the Security Requirements state that the privacy policy and terms of use links must each open to a valid web page, because Amazon shows them on the skill detail page and in the Alexa app.

For example URLs that pass and fail, and hosting options that stay stable, see what to paste into the Alexa Privacy Policy URL field. To compare Amazon with other stores, see which platforms require a privacy policy.

Child-Directed Skills and the Extra Gates

Section 2 of the Policy Requirements applies when a skill is directed to children under 13 in the US, India or Canada, under 16 in the UK, Germany, Japan, France, Italy, Spain, Mexico, the Netherlands or Australia, or under 18 in Saudi Arabia. Such a skill is rejected or suspended if any one of these is true:

1. It is a custom skill and you are not an Amazon-approved developer.
2. It promotes products, content or services, or sends users to content outside Alexa.
3. It sells physical products or services.
4. It sells digital products or services without using In-Skill Purchasing.
5. It collects personal information from users.
6. It uses account linking.
7. It recommends skills that are not directed to children.
8. It includes content not suitable for all ages.

The first gate comes before review: automated validation may block a custom kids skill from an unapproved developer. Request approval through the developer portal's contact form, or build with Alexa Blueprints, which is open to all developers. Declare the audience by answering "Yes" to the children question on Privacy & Compliance, which also covers the under-16 countries. If you answer "No" and reviewers find child-directed content, the skill can be rejected.

For the disclosures COPPA expects and how parental consent works, see the COPPA privacy policy guide for kids' apps.

Frequently Asked Questions

This page summarizes Amazon's Alexa developer documentation as of the date above; it is not legal advice. Sources: Certification requirements for privacy policy URLs, Security Requirements for Alexa Skills, Policy Requirements for Alexa Skills, Define Skill Store Details for Publication, How to Create a Child-Directed Skill.