The Federal Trade Commission recently announced legal action against Amazon for violating children's privacy law by storing kids' Alexa voice recordings and disregarding parental deletion requests.
The FTC and the U.S. Department of Justice announced Amazon will be required to make significant changes to its data deletion practices and privacy safeguards, according to a May 31 news release. The settlement comes in response to charges of Amazon violating the Children's Online Privacy Protection Act Rule and misleading parents and users of its Alexa voice assistant service regarding data deletion practices.
“Amazon’s history of misleading parents, keeping children’s recordings indefinitely and flouting parents’ deletion requests violated COPPA and sacrificed privacy for profits,” Director of the FTC Bureau of Consumer Protection Samuel Levine said in the release.
The DOJ filed a complaint on behalf of the FTC, accusing Amazon of preventing parents from exercising deletion rights, retaining sensitive voice and geolocation data for prolonged periods and using the data for its own purposes, potentially compromising its security, the release reported.
Under the proposed federal court order filed by the DOJ, Amazon will have to delete inactive child accounts, specific voice recordings and geolocation information, according to the release. Additionally, Amazon will be prohibited from using such data to train its algorithms.
The proposed order is subject to approval from the federal court to take effect, the release said. The complaint alleges Amazon made repeated assurances to users, including parents, about the ability to delete voice recordings and geolocation data, but failed to honor those promises, unlawfully retaining the information to enhance its Alexa algorithm.
In addition to the data deletion requirement, Amazon will be liable for a $25 million civil penalty, according to the release.
The proposed order also includes provisions prohibiting Amazon from using deletion-requested data for product development, mandating the deletion of inactive child accounts, requiring notifications to users about the regulatory action, enforcing transparency in retention and deletion practices, preventing misrepresentation of privacy policies and mandating the establishment of a privacy program concerning geolocation information, the release said.
The FTC's action emphasizes its commitment to protecting the privacy of all consumers, including children. It is noteworthy the FTC also announced action against Amazon's subsidiary, Ring, for privacy breaches, the release reported.
The complaint and stipulated order were filed in the U.S. District Court for the Western District of Washington, according to the release.
