Amazon fined $25m over Alexa storage of children’s data

The FTC and Justice Department said that since May 2018, Amazon’s Alexa-related offerings have included voice-activated products and services directed toward children under 13 years of age.

When a user makes a verbal request of an Alexa-enabled device, according to the FTC and Justice Department, Amazon saved the voice recording of the request and created a written transcript of it.

The two US government bodies had argued this breached the Children’s Online Privacy Protection Act (COPPA), the Children’s Online Privacy Protection Rule (COPPA Rule) and the Federal Trade Commission Act (FTC Act).

Other alleged violations included stating that Alexa app users could delete their or their children’s voice recordings, including audio files and transcripts and their geolocation information, but that Amazon on some occasions failed to delete all such information at users’ request.

The complaint also alleged that Amazon engaged in unfair privacy practices with respect to Alexa users’ geolocation information and voice recordings, including by failing to honour some users’ deletion requests.

The federal district court said that Amazon should pay $25m in civil penalties, as well as identifying and deleting inactive child profiles unless a parent requests that they be retained.

The order also requires Amazon to make disclosures to consumers relating to its retention and deletion practices regarding Alexa App geolocation information and voice information.

Brian Boynton, principal deputy assistant attorney general and head of the Justice Department’s civil division, said: “The department and the FTC are committed to working together to ensure that companies do not misrepresent to parents how children’s personal information is handled, retained or deleted, and do not retain that information for longer than reasonably necessary.”

Samuel Levine, director at the FTC’s Bureau of Consumer Protection, said: “Amazon’s history of misleading parents, keeping children’s recordings indefinitely and flouting parents’ deletion requests violated COPPA and sacrificed privacy for profits.

“COPPA does not allow companies to keep children’s data forever for any reason, and certainly not to train their algorithms.”

Amazon said in a statement: “At Amazon, we take our responsibilities to our customers and their families very seriously. We built Alexa with strong privacy protections and customer controls, designed Amazon Kids to comply with COPPA, and collaborated with the FTC before expanding Amazon Kids to include Alexa.

“While we disagree with the FTC’s claims and deny violating the law, this settlement puts the matter behind us. As part of the settlement, we agreed to make a small modification to our already strong practices, and will remove child profiles that have been inactive for more than 18 months unless a parent or guardian chooses to keep them.”