The Federal Trade Commission (FTC) and the Department of Justice (DOJ) have charged Amazon with violating children’s privacy laws by keeping Alexa voice recordings of kids indefinitely and undermining parents’ deletion requests. The FTC alleges that Amazon prevented parents from exercising their deletion rights, kept sensitive voice and geolocation data for years, and used it for its own purposes. The proposed court order requires Amazon to pay $25 million, delete children’s data and geolocation information, and implement privacy safeguards.
The FTC stated that Amazon failed to establish an effective system to honor users’ data deletion requests and provide parents with adequate notice about deletion. Even when Amazon discovered its failures to delete geolocation data, the company repeatedly neglected to address the issues. In addition to the data deletion requirement, Amazon will be required to pay a $25 million civil penalty and adhere to various provisions outlined in the proposed order.
These provisions include prohibiting Amazon from using geolocation, voice, and children’s voice information for data product creation or improvement, deleting inactive Alexa accounts of children, notifying users about the FTC-DOJ action, disclosing retention and deletion practices, and preventing misrepresentation of privacy policies. Furthermore, Amazon must establish and implement a privacy program related to its use of geolocation information.
The complaint has been referred to the Department of Justice for filing, and the stipulated order has been filed in the U.S. District Court for the Western District of Washington.