Amazon fined $25 mn for violating children's privacy law, deceiving parents

San Francisco, June 1

E-commerce giant Amazon will pay $25 million penalty to the US Federal Trade Commission (FTC) over violating the children's privacy law by keeping their Alexa voice recordings and deceiving parents and users of the Alexa voice assistant service about its data deletion practices.

The FTC and the Department of Justice said in a statement that they will require Amazon to "overhaul its deletion practices and implement stringent privacy safeguards" as the company violated the Children's Online Privacy Protection Act Rule (COPPA Rule).

According to the complaint, Amazon prevented parents from exercising their deletion rights under the COPPA Rule, kept sensitive voice and geolocation data for years, and used it for its own purposes, while putting data at risk of harm from unnecessary access.

"Amazon's history of misleading parents, keeping children's recordings indefinitely, and flouting parents' deletion requests violated COPPA and sacrificed privacy for profits," said Samuel Levine, Director of the FTC's Bureau of Consumer Protection.

"COPPA does not allow companies to keep children's data forever for any reason, and certainly not to train their algorithms."

Amazon will be required to delete inactive child accounts and certain voice recordings and geolocation information and will be prohibited from using such data to train its algorithms. The proposed order must be approved by the federal court to go into effect.

According to the complaint, the company "prominently and repeatedly" assured its users, including parents, that they could delete voice recordings collected from its Alexa voice assistant and geolocation information collected by the Alexa app.

The company, however, failed to follow through on these promises when it kept some of this information for years and used the data it unlawfully retained to help improve its Alexa algorithm, according to the complaint.

The company claims that its Alexa service and Echo devices are "designed to protect your privacy" and that parents and other users can delete geolocation data and voice recordings.

Amazon retained children's recordings indefinitely -- unless a parent requested that this information be deleted, according to the complaint.

And even when a parent sought to delete that information, the FTC said, Amazon failed to delete transcripts of what kids said from all its databases.

Amazon claimed it retained children's voice recordings in order to help it respond to voice commands, allow parents to review them, and to improve Alexa's speech recognition and processing capabilities, according to the complaint.

The FTC said the company failed to put in place an effective system to ensure that it honoured users' data deletion requests and to give parents meaningful notice about deletion.

Even when Amazon discovered its failures to delete geolocation data, the FTC said that Amazon repeatedly failed to fix the problems.