Amazon agrees to $25M settlement over Alexa unlawfully storing children's voice recordings, location data

Amazon has agreed to a $25 million settlement with the Justice Department and the Federal Trade Commission regarding allegations the company violated federal children's privacy laws through its Alexa personal assistant platform. 

In addition to the civil penalty, Amazon.com Inc. and its wholly-owned subsidiary Amazon.com Services LLC (collectively Amazon), have agreed to a permanent injunction as part of that settlement to resolve alleged violations of the Children’s Online Privacy Protection Act (COPPA), the Children’s Online Privacy Protection Rule (COPPA Rule) and the Federal Trade Commission Act (FTC Act) relating to Amazon’s voice assistant, the DOJ and FTC said Wednesday. 

The government had alleged that Amazon Alexa unlawfully stores children's voice recordings and information about children's locations – and sometimes even flouts requests from parents to have that data deleted. 

Alexa is a proprietary voice-activated service that Amazon provides through its Echo smart speakers, its "Alexa App" mobile application, and other devices and applications. 

AMAZON CEO SAYS NOT TO COUNT E-COMMERCE GIANT OUT OF AI RACE: GENERATIVE AI PART OF 'HYPE CYCLE'

Since May 2018, Amazon’s Alexa-related offerings have included voice-activated products and services directed toward children under 13 years of age, the Justice Department notes. 

When a user makes a verbal request of an Alexa-enabled device, Amazon saves the voice recording of the request and creates a written transcript of it.

Since at least May 2018, Amazon violated the FTC Act, COPPA and the COPPA Rule with respect to Alexa and Alexa’s child-directed offerings, according to the government's complaint filed in the U.S. District Court for the Western District of Washington. The complaint alleges that Amazon retained children’s voice recordings indefinitely by default, in violation of COPPA’s requirement that these recordings be retained only as long as reasonably necessary to fulfill the purposes for which they were collected. 

Other alleged violations include making deceptive representations that Alexa app users could delete their or their children’s voice recordings, including audio files and transcripts and their geolocation information, when in fact Amazon on some occasions failed to delete all such information at users’ request. The complaint also alleges that Amazon engaged in unfair privacy practices with respect to Alexa users’ geolocation information and voice recordings, including – in some instances – by failing to honor users’ deletion requests and failing to notify consumers that it had not done so.

FORMER AMAZON EMPLOYEE SENTENCED TO 16 YEARS IN PRISON IN $9.4 MILLION FRAUD CASE

"Today’s settlement reflects the department’s dedication to protecting children online," Principal Deputy Assistant Attorney General Brian M. Boynton, head of the DOJ's Civil Division, said. "The department and the FTC are committed to working together to ensure that companies do not misrepresent to parents how children’s personal information is handled, retained, or deleted, and do not retain that information for longer than reasonably necessary."    

"Amazon’s history of misleading parents, keeping children’s recordings indefinitely, and flouting parents’ deletion requests violated COPPA and sacrificed privacy for profits," Director Samuel Levine of the FTC’s Bureau of Consumer Protection, added in a statement. "COPPA does not allow companies to keep children’s data forever for any reason, and certainly not to train their algorithms."

"Parents want and deserve to have control over data related to their young children – this includes recordings of the child’s voice, the child’s location, and the questions the child asks an Alexa device," Acting U.S. Attorney Tessa M. Gorman for the Western District of Washington said. "Some may be delighted to have those recordings saved for sentimental reasons – but that needs to be the parent’s choice – not a decision made by Amazon. This settlement requires Amazon to provide notice to parents with ways they can select whether and how that data is retained."

GET FOX BUSINESS ON THE GO BY CLICKING HERE

The stipulated order entered Wednesday by the federal district court imposes injunctive relief that requires Amazon to identify and delete inactive child profiles – profiles that have not been used for 18 months – unless a parent requests that they be retained. Amazon has agreed to notify parents whose children have accounts of this change to its policies. 

The order further prohibits Amazon from making misrepresentations about Amazon’s retention, access to or deletion of geolocation information or voice information, including children’s voice information, and mandates deletion of geolocation information, voice information, and children’s personal information upon the request of the user or parent, respectively. 

It also requires Amazon to make disclosures to consumers relating to its retention and deletion practices regarding Alexa App geolocation information and voice information, the DOJ says. 

Reached by Fox News Digital, a spokesperson for Amazon referred to a May statement from the company when the agreement was first reached. The order wasn't entered into federal court until Wednesday. 

CLICK HERE TO READ MORE ON FOX BUSINESS

"Today, Amazon reached a settlement with the U.S. Department of Justice (DOJ) regarding allegations brought by the U.S. Federal Trade Commission (FTC) about how Amazon handles Alexa customer data—including children’s data," Amazon said in a statement May 31. "We take our responsibilities to our customers and their families very seriously. We have consistently taken steps to protect customer privacy by providing clear privacy disclosures and customer controls, conducting ongoing audits and process improvements, and maintaining strict internal controls to protect customer data."

"While we disagree with the FTC’s claims and deny violating the law, this settlement puts the matter behind us, and we believe it’s important to put the settlement in the right context," it said. "We work hard to protect children’s privacy, and we have built robust privacy protections into our children’s products and services."