Amazon Fined $25 Million for Deceiving Parents, Violating Child Privacy Law

The Federal Trade Commission (FTC) fined Amazon $25 million for violating the Children’s Online Privacy Protection Act (COPPA(Opens in a new window)) and deceiving parents regarding data deletion practices.

The Department of Justice filed the complaint(Opens in a new window) on behalf of the FTC claiming Amazon is failing parents and children on several fronts with regards to data collected through Alexa voice assistant services and the company’s range of smart speakers.

According to Samuel Levine, Director of the FTC’s Bureau of Consumer Protection:

“Amazon’s history of misleading parents, keeping children’s recordings indefinitely, and flouting parents’ deletion requests violated COPPA and sacrificed privacy for profits … COPPA does not allow companies to keep children’s data forever for any reason, and certainly not to train their algorithms.”

The complaint details how Amazon “assured its users, including parents, that they could delete voice recordings collected from its Alexa voice assistant and geolocation information collected by the Alexa app.” However, parents were prevented from deleting data under the COPPA Rule and instead Amazon retained voice and geolocation data indefinitely.

Parents could request deletion of the data, but the FTC found Amazon continued to retain transcripts of what children said regardless of the request. Amazon explained it kept the voice recordings of children to “help it respond to voice commands, allow parents to review them, and to improve Alexa’s speech recognition and processing capabilities.” The FTC believes Amazon was simply “benefitting its bottom line at the expense of children’s privacy.”

As The Wall Street Journal(Opens in a new window) reports, Amazon agreed to settle the complaint and released the following statement:

“While we disagree with the FTC’s claims regarding both Alexa and Ring, and deny violating the law, these settlements put these matters behind us … As part of the settlement, we agreed to make a small modification to our already strong practices, and will remove child profiles that have been inactive for more than 18 months unless a parent or guardian chooses to keep them.”

The “small modification” Amazon mentions is part of a list of actions the FTC demands the company must take, which include:

• deleting the inactive Alexa accounts of children

• notifying users of the FTC-DOJ joint action

• notifying users of its data retention and deletion practices and controls

• creating and implementing a privacy program related to the company’s use of geolocation data

• prohibiting the use of geolocation, voice information, and children’s voice information for the creation or improvement of any data product (subject to consumers’ deletion requests)

The mention of Ring relates to another complaint regarding Ring cameras being used to spy on customers, which Amazon also decided to settle this week.

Hands On With the Amazon Astro