The Federal Trade Commission (FTC) and the Department of Justice (DOJ) have reached a settlement with Amazon for a whopping $25 million following charges that the company violated the Children’s Online Privacy Protection Act Rules (COPPA Rule) and misled parents and users of its Alexa voice assistant service.
Amazon must revamp its deletion practices and implement stringent privacy safeguards as part of the settlement.
According to a complaint filed by the DOJ on behalf of FTC, Amazon prevented parents from exercising their deletion rights under the COPPA Rule and retained sensitive and geolocation data for extended periods, using it for its own purposes. This violated COPPA and exposed the data to unnecessary risks.
Samuel Levine, Director of the FTC’s Bureau of Consumer Protection, stated, “Amazon’s history of misleading parents, keeping children’s recordings indefinitely, and flouting parents’ deletion requests violated COPPA and sacrificed privacy for profits.”
The proposed federal court order, filed by the DOJ, mandates that Amazon delete inactive child accounts, specific voice recordings, and geolocation information. Furthermore, the company will be prohibited from using such data to train its algorithms. The court’s approval is required for the order to take effect.
The complaint alleges that Amazon repeatedly assured users, including parents, that they could delete voice recordings and geolocation information collected by Alexa. However, Amazon failed to fulfil these promises, retaining some data for extended periods and using it unlawfully to enhance its Alexa algorithm. Such practices violate the COPPA Rule, which requires obtaining parental consent for data collection from children under 13 and allowing deletion of such information at any time.
Amazon defended its retention of children’s voice recordings as necessary for improving Alexa’s speech recognition. However, the FTC argues that this violated children’s privacy rights, benefitting Amazon’s bottom line.
In addition to the data deletion requirement, Amazon will pay a $25 million civil penalty. The proposed order prohibits the company from using consumers’ deletion requests to create or enhance data products. It mandates the deletion of inactive child accounts, notifies users of the FTC-DOJ action, improves privacy policies and controls, and establishes a privacy program related to geolocation information.
In the News: Dark Pink hacker group shows no signs of slowing down
