Today the Federal Trade Commission and the Department of Justice announced that they will require Amazon to overhaul how it handles the deletion of voice recordings. According to the FTC and DOJ, Amazon is in violation of the Children’s Online Privacy Protection Act Rule (COPPA Rule).
At issue here is Amazon not fully removing recording when they say they are going so. “Amazon prevented parents from exercising their deletion rights under the COPPA Rule, kept sensitive voice and geolocation data for years, and used it for its own purposes while putting data at risk of harm from unnecessary access.” The FTC said in a statement on their website.
“Amazon’s history of misleading parents, keeping children’s recordings indefinitely, and flouting parents’ deletion requests violated COPPA and sacrificed privacy for profits,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “COPPA does not allow companies to keep children’s data forever for any reason, and certainly not to train their algorithms.”
According to the filing, Amazon prominently and repeatedly assured its users, including parents, that they could delete voice recordings collected from its Alexa voice assistant and geolocation information collected by the Alexa app. According to the FTC and DOJ, Amazon, however, failed to follow through on these promises when it kept some of this information for years and used the data it unlawfully retained to help improve its Alexa algorithm, according to the complaint.
The COPPA Rule requires Amazon and others to, among other things, that an operator of a commercial website or online service directed to children under 13 years of age notify parents about the information they collect from children, obtain parents’ consent for the collection of that data, and allow them to delete that information at any time. In addition, such a service is prohibited from retaining the information collected from children under 13 for longer than is reasonably necessary to provide the service.
Amazon will have to pay a $25 million civil penalty and follow these new rules:
- Prohibit Amazon from using geolocation, voice information, and children’s voice information subject to consumers’ deletion requests for the creation or improvement of any data product;
- Require the company to delete inactive Alexa accounts of children;
- Require Amazon to notify users about the FTC-DOJ action against the company;
- Require Amazon to notify users of its retention and deletion practices and controls;
- Prohibit Amazon from misrepresenting its privacy policies related to geolocation, voice and children’s voice information; and
- Mandate the creation and implementation of a privacy program related to the company’s use of geolocation information.