Amazon Agrees to $25M Civil Penalty to Resolve Alexa COPPA Violations
Amazon violated the FTC Act and the Children’s Online Privacy Protection Act (COPPA) rule by “misrepresenting” that it would delete voice transcripts and geolocation information of Alexa users on request and would limit employees’ access to Alexa users’ voice information, said a stipulated order Wednesday (docket 2:23-cv-00811) in U.S. District Court for Western Washington in Seattle. Amazon also failed to delete children’s personal information at their parents’ request, and it kept children’s personal information “longer than reasonably necessary to fulfill the purpose for which the information was collected,” it said.
Sign up for a free preview to unlock the rest of this article
Export Compliance Daily combines U.S. export control news, foreign border import regulation and policy developments into a single daily information service that reliably informs its trade professional readers about important current issues affecting their operations.
Amazon agrees to pay a $25 million civil penalty within seven days to resolve the allegations, said the stipulated order. The company neither admits nor denies any of the allegations in the accompanying complaint, but admits the facts necessary to establish jurisdiction, it said.
The order gives Amazon six months to implement a process for identifying “inactive alexa child profiles.” It gives Amazon 90 days to delete any personal information collected from a child associated with that profile within 90 days, unless the parent of that child requests that the information be kept or the profile becomes active again before it’s deleted.
Amazon’s privacy disclosures “assert that it designed Alexa with privacy in mind,” said the complaint. Those disclosures said Amazon would delete users’ voice and geolocation data, plus children’s voice data, on upon request, and that Amazon “carefully limits access to voice data,” it said. But until September 2019, “Amazon retained children’s voice recordings and transcripts indefinitely unless a parent actively deleted them,” it said.
Alexa’s default settings still save voice recordings and transcripts “forever,” even when a child no longer uses his or her Alexa profile and the profile “has been inactive for years,” said the complaint: “As a result, Amazon has retained the personal information of thousands of children who are not even using their Alexa accounts, in violation of COPPA’s prohibition on retaining children’s personal information longer than is reasonably necessary to fulfill the purposes for which the information is collected.”
Amazon also failed “for a significant period of time” to honor parents’ requests to delete their children’s voice recordings, said the complaint. It continued to keep transcripts of those recordings, failed to disclose it was doing so, also in violation of COPPA, it said. Amazon also failed to delete users’ voice information and geolocation information on request, and instead kept that data “for its own potential use,” it said. “Such unfair and deceptive practices violate Section 5 of the FTC Act.”