Amazon to pay nearly $30Mn to settle FTC-DOJ lawsuit over Alexa, Ring privacy violations

As the digital landscape continues to evolve, it becomes increasingly crucial for companies to prioritize the privacy and protection of user data, specially minors. Amazon hasn’t really fared greatly on that front and has now agreed to pay a $25Mn penalty (£20 million) to resolve a Federal Trade Commission (FTC) lawsuit that accused the tech giant of violating children’s privacy rights through its voice assistant, Alexa.

Apart from the financial penalty, Amazon is tasked to “overhaul its deletion practices and implement stringent privacy safeguards” to ensure its compliance with the Children’s Online Privacy Protection Act (COPPA). This development earned Amazon the ire of the FTC and the Department of Justice (DOJ) alike, and the latter has already filed a proposed federal court order.

This is not a new development, unfortunately, and the FTC alleges that Amazon was aware about this development as early as 2018, but refrained from taking steps until as late as September 2019.

And if this is not enough, Amazon is also forced to settle over privacy concerns from its Ring doorbell divisions, according to a filing in federal court in the District of Columbia. Here, the e-commerce behemoth has agreed to pay a total of $5.8million to settle allegations that Amazon’s Ring allowed employees and third-party contractors full access to customer video content, including sensitive content. In fact, this was thoroughly abused by some employees and contractors and was used to violate the privacy of both Ring customers and other workers, ensuring that consumers were vulnerable to spying and harassment.

The FTC lawsuit against Amazon highlights a disturbing reality: the privacy of children’s data is increasingly under threat in the digital age. By unlawfully retaining voice recordings of children, Alexa’s privacy breach not only infringes upon legal regulations but also exposes young users to potential risks – after all, the unauthorized access to sensitive personal information raises concerns about potential misuse, identity theft, or even targeted marketing campaigns aimed at impressionable young minds.

Returning to the FTC complaint regarding Alexa, Amazon “prominently and repeatedly assured its users, including parents, that they could delete voice recordings collected” by the system. Instead of sticking to its assurances, however, Amazon deceived parents and user alike, and kept the sensitive voice and geolocation data for years and utilized it for its own purposes, such as to help improve its Alexa algorithm.

In a statement, Samuel Levine, Director of the FTC’s Bureau of Consumer Protection, informed in a statement that Amazon was accused of sacrificing “privacy for profits,” and of “misleading parents, keeping children’s recordings indefinitely, and flouting parents’ deletion requests.”

The settlement highlights the importance of safeguarding children’s privacy in an increasingly digital world. As voice assistants become more prevalent in households, the collection and storage of children’s data raise concerns about the potential misuse or unauthorized access to sensitive information. The development underscores the responsibility of companies like Amazon to implement robust privacy safeguards and obtain proper consent when collecting personal information from underage users.

If the federal court approves, then Amazon will be prohibited from using children’s voice information and geolocation data to train its algorithms, as well as delete inactive child accounts on Alexa, notify users about the government action against the company and of its retention and deletion practices. Furthermore, the company will have to implement a privacy program to govern its use of geolocation information, as well as cease the misrepresentation of its privacy policies related to geolocation, voice and children’s voice information.

Speaking of Amazon’s response to the matter, the company said that they disagreed with the FTC’s claims, denied that they had violated the law, and that it is settling to put the matter “behind us.” It added that it will “remove child profiles that have been inactive for more than 18 months.”

“We have a longstanding commitment to preserve the trust of our customers and their families. Today’s news does not change that,” the company said in an official statement, adding that Amazon Kids is compliant with COPPA and that it provide customers with transparency and control over their Alexa experience.