Just reviewed a subject on Internet Movie Data Base (IMDB) from within a Brave search, over a VPN. With this site and others I have no desire to sign up to I have Brave set to aggressively block trackers and additionally have “Forget me when I leave this site” selected.
This time time however, as soon as I had closed IMDB and moved on I immediately received a “Welcome to IMDB” email to my private email account! I didn’t sign up for membership to the site and the only other place my email resides in in autofill cache in Brave.
Has IMDB (Amazon Web Services) figured out a way to pull email addresses out of the autofill cache without permission? Or am I missing something?
Please edit your Original Post (“OP”) above, in order to include:
- Brave Browser version numbers
- Operating System version numbers
@Mattches - OP:
“Has IMDB (Amazon Web Services) figured out a way to pull email addresses out of the autofill cache without permission?”
Yeah that’s not possible – there must be something else going on here. Can you please provide some more details about your setup and @289wk suggests and can you also share the exact steps you took to reproduce this so that I can test on my end?
This just happened to me. I looked up one movie on IMDB.com and I got an email “Welcome to IMDb, an Amazon company.”
My Brave Trackers & ads blocking is set to Standard. I assumed Brave blocks websites from querying cookies left by other domains. Somehow this is not always true.
Debian 6.12.101-1 (2026-08-05)
Brave 1.94.121 (Official Build) (x86_64)
Steps to reproduce:
- Log into your Amazon.com account
- Go to duckduckgo.com
- Search for backrooms movie.
- Click the search link “Backrooms (2026) - IMDb”
- In a couple of minutes your email associated with Amazon will receive a two emails. A “Someone signed-in to your account.” and “Welcome to IMDb” from IMDb.
- Go to your IMDb account. Click on Delete account. Here you can verify the date they signed you up.
IMPORTANT - According to ChatGPT:
IMDb now uses Amazon’s account system
IMDb’s own help documentation was updated August 25, 2026, and says something unusually explicit:
“Amazon customers will be automatically signed into IMDb.com with your Amazon account.”
It says this applies, currently, to U.S. Amazon account holders using IMDb.com in Chrome, Firefox, Safari, Edge, or Opera.
IMDb also says that it now uses Amazon’s account system for sign-in and new account creation.
I’m still not sure I understand what they’re doing that automatically sign you in if that is the case. I just tried this with a fresh profile, using @gsbuser’s steps to reproduce but I never got an email and was never signed into IMDb.
Can anyone else test and confirm that they see this in a new profile?
I assume that with other browsers that do not sandbox websites, if you go to an IMDb link, it will query the browser if there is an Amazon cookie left by an Amazon login, then use the email stored in the cookie to start the IMDb account.
From my above step 6, IMDb shows my IMDb account creation as Sept 9. That is the date I visited IMDb site. That is after the August 25 date that IMDb started doing this. My Amazon account is years old. IMDb got my Amazon account credentials through the Brave browser.
This is not just about Amazon and IMDb. This indicates a mechanism exists in Brave that allows a website to get cookie data from another website. As Trackers & ads blocking is set to Standard, this should block 3rd party cookies. Is it possible that this can be bypassed because “IMDb now uses Amazon’s account system”?
Going to look into this but in the meantime, can you please test this again in a fresh profile? I’d like to see if this can be reproduced consistently.
- Create fresh browser profile (
Menu > More tools > Add profile) - Sign into Amazon then close that tab
- Visit IMDb
- Confirm if you are now logged into IMDb
I also would like to confirm that IMDb created an account for you (whomever is encountering this) – that you didn’t have an IMDb account made already (even if not logged in or super old, etc.) before visiting the site.
I am not testing the OP’s issue; I do not have the OP’s issue.
I opened a link to IMDb and IMDb showed me the page but it did not log me in.
Regarding the IMDb account creation date, I have uploaded a screenshot.
I asked Claude.ai. For the benefit of everyone who looks at this thread I am including the whole reply.
What happened isn’t a cookie-blocking failure — it’s a real, documented Amazon feature, not stealth tracking. Amazon’s IMDb help center describes it directly: this explains how IMDb and IMDbPro customers are signed in with their existing Amazon account, to get recommendations tailored to their taste, track titles on their Watchlist, rate what they watch, and contribute to the database — offering the same sign-in and account across IMDb, IMDbPro and Amazon using the existing Amazon account. And critically: eligible Amazon customers will be automatically signed into IMDb .com with a newly created IMDb account, unless they already sign into IMDb with Amazon. imdbimdb
So IMDb didn’t sneak past Brave’s cookie blocking — Amazon (which owns IMDb) built a deliberate auto-login/auto-signup pipeline for its own logged-in customers.
Why third-party cookie blocking didn’t stop it
This is the part worth understanding clearly, because it’s a common misconception about what that setting actually does:
- Third-party cookie blocking stops Site A from silently reading a cookie belonging to Site B when Site B’s content is embedded inside Site A’s page (an iframe, a tracking pixel, a background script call) — the classic ad-tracker scenario.
- It does not stop Site A from sending your browser on a full top-level redirect (or popup) to Site B’s own domain. When your browser actually navigates to amazon. com, even briefly and invisibly, Amazon is the first party at that moment and can read its own first-party cookie just fine. Then Amazon hands a token/auth code back to IMDb via the redirect.
- This redirect handoff is exactly how every legitimate “Sign in with Google/Apple/Amazon” button works. Browsers have to allow it, or SSO would break entirely — Brave’s Shields don’t (and can’t, without breaking login flows generally) block that mechanism.
Since IMDb and Amazon are the same company, IMDb’s page apparently triggered that same-family SSO handshake automatically on load (not on a click), silently confirmed your Amazon session, and auto-created the IMDb account — no third-party cookie read required anywhere in that flow.
One more wrinkle: the “Chrome only” detail
The help article also says: currently only US customers using IMDb on a web or mobile Chrome browser will see this new experience. Brave is Chromium-based and by default identifies itself with a Chrome-style user agent (to avoid sites breaking), so IMDb’s server-side eligibility check likely saw “Chrome” and included you in the rollout even though you weren’t actually using Chrome. imdb
What to do about it
- The linked account can be undone: the same article notes that selecting “Sign out” on the prompt signs you out of the newly linked account and requests it be deleted.
- Go to IMDb, look for the “You are signed in as [name] from Amazon — Not you?” prompt (or your account settings if it’s already dismissed), and choose the sign-out/delete option.
- To prevent a repeat, log out of Amazon (or use a separate browser/profile for Amazon) before browsing IMDb or clicking IMDb links, since being actively logged into Amazon is what triggers the auto-signup.
This answers my main concern. What IMDb did was not get to 3rd party cookie data.