Amazon has been fined $25 million by the Federal Trade Commission (FTC) and the Department of Justice (DOJ) for violating the Children’s Online Privacy Protection Act (COPPA) with its Alexa voice-activated assistant and Echo devices. The law states that companies that engage with children under 13 in the US must post clear privacy policies, provide direct notice to parents, and allow parents to delete the information and stop further collection. The FTC and DOJ claim that Amazon prevented parents from being able to exercise the COPPA Rule, kept sensitive voice and geolocation data for years for its own purposes, and put data at unnecessary risk.
As one of the leading global retailers, Amazon collects extensive user data, including geolocation, and voice recordings. It has claimed that it handles this data with users’ privacy in mind, offering parental controls for deleting voice and geolocation data. However, the complaint alleges that Amazon retained and used children’s data for improving its Alexa algorithm, contravening COPPA rules that companies must not store children’s data without just cause. Responding to these charges, Amazon faces a proposed federal court order that mandates the deletion of inactive child accounts, voice recordings and geolocation data, and prohibits the company from using such data to train its algorithms.
Samuel Levine, Director of the FTC’s Bureau of Consumer Protection said that Amazon’s conduct in retaining children’s voice recordings and disregarding parents’ requests for deletion prioritises profit over privacy. Commissioner Alvaro M. Bedoya tweeted: Today’s settlement on Amazon Alexa should set off alarms for parents across the country — and is a warning for every AI company sprinting to acquire more and more data.
Amazon has repeatedly assured users of its ability to delete user data. However, the complaint shows that even when parents requested deletion of their children’s voice recordings, Amazon failed to erase the transcripts entirely from its databases, contravening COPPA rules requiring parental consent for data collection from children. Meanwhile, the FTC has filed a separate complaint against Amazon’s home security subsidiary, Ring, over allegations it breached its customers’ privacy.
