Amazon has been ordered to pay the US government $25m by next week, as well as agreeing to change how it handles children’s data and what it collects through Alexa, its popular voice assistant.
The settlement, approved by a Washington federal judge, follows a 2019 complaint to the Federal Trade Commission (FTC) by privacy advocates, who accused Amazon of saving children’s voice recording and transcriptions for longer than allowed under the Children’s Online Privacy Protection Act (COPPA).
This privacy breach comes hot on the heels of Meta’s $100k-a-day fine over “data hoarding” techniques in Europe, highlighting a crackdown on tech giants’ data and privacy practices.
A New Data Process Is Needed
The July 19 court order states that Amazon must delete all data, including its voice recordings, when requested. It will also have to delete data for accounts that have been inactive for at least 18 months.
This follows a federal law titled COPPA that was passed in 1998, stating websites should only hold onto children’s personal information “as long as is reasonably necessary to fulfil the purpose for which the information was collected.”
“Parents want and deserve to have control over data related to their young children. This includes recordings of the child's voice, the child's location, and the questions the child asks an Alexa device” – Tessa M. Gorman, an acting attorney
Amazon Insists No Wrongdoing
Despite the recent finding, Amazon insists in no wrongdoing and claims it has always abided by federal privacy protections. In a statement released by the company, it claimed:
“While we disagree with the FTC's claims and deny violating the law, this settlement puts the matter behind us. As part of the settlement, we agreed to make a small modification to our already strong practices, and will remove child profiles that have been inactive for more than 18 months unless a parent or guardian chooses to keep them.”
The modification in question includes a notification to parents and guardians when it has deleted their child’s data. This will be seen on the “Parent Dashboard”, where adults are able to set limits on their children’s use of Amazon products and services.
According to the settlement, this update must be in place by next month.
Amazon also got into hot water with the FTC recently, when it was accused of making it deliberately hard to cancel Prime membership.
The Fine Follows Similar Complaints
Amazon has already been the subject of an FTC lawsuit this year, having been charged by the Department of Justice with misleading consumers over how much access to children’s data it would hold onto.
The complaint, filed in May, stated that Amazon stored the personal information of children even when their accounts had been “inactive for years”. It also included recordings, and transcripts of those recordings, and was in violation of COPPA.
Despite parents asking for their children’s data to be deleted, Amazon held onto it for a “significant period of time”, using it to improve its Alexa algorithm, according to the complaint.
While this latest fine and imposed privacy revision feels like a step in the right direction for protecting data, the longevity of its success relies on strict surveillance of tech companies.
Law fellow at the Electronic Privacy Information Center, Suzanne Bernstein, stated:
“Unfortunately, Big Tech has long demonstrated that without strict monitoring, they cannot be counted on to comply with FTC orders. [They] must closely monitor Amazon's compliance with this order to ensure that it no longer illegally profits off of children's personal data.”
See our full guide to Amazon scams here.
