Proposed order to require Amazon to pay $US25 million
The Federal Trade Commission (FTC) and the Department of Justice (DOJ) have reached a settlement with Amazon regarding charges that the company violated the Children’s Online Privacy Protection Act Rule (COPPA Rule) and deceived parents and users of the Alexa voice assistant service. Under the settlement, Amazon will be required to make changes to its data deletion practices and implement strict privacy safeguards.
The complaint filed by the DOJ on behalf of the FTC alleges that Amazon prevented parents from exercising their rights to delete their children’s data under the COPPA Rule. The company also retained sensitive voice and geolocation data for extended periods, using it for its own purposes and potentially exposing the data to unauthorized access.
The proposed settlement requires Amazon to delete inactive child accounts, certain voice recordings, and geolocation information. The company will also be prohibited from using this data to train its algorithms. The settlement must be approved by a federal court to take effect.
According to the complaint, Amazon made repeated assurances to its users, including parents, that they could delete voice recordings and geolocation information collected by Alexa. However, the company failed to follow through on these promises and retained some of the data for extended periods, using it to improve its Alexa algorithm.
Amazon collects a significant amount of consumer data through its Alexa voice assistant service and Echo devices. The company offers Alexa-enabled devices and services targeted to children, collecting personal data, including voice recordings, from children. The FTC alleges that Amazon retained children’s recordings indefinitely unless a parent requested their deletion, and even then, the company failed to delete all transcripts from its databases.
The COPPA Rule requires operators of websites or online services directed to children under 13 to notify parents about the information collected from their children, obtain parental consent, and allow parents to delete that information at any time. Amazon’s actions violated these requirements.
In addition to the data deletion requirement, the proposed settlement imposes a $US25 million civil penalty on Amazon. It also includes provisions prohibiting the use of data subject to deletion requests for product creation or improvement, the deletion of inactive Alexa accounts of children, and the implementation of a privacy program related to geolocation information.
The FTC voted 4-0 to refer the complaint to the DOJ for filing. The settlement was filed in the U.S. District Court for the Western District of Washington.
