On Thursday, the Federal Trade Commission shared that Amazon will pay more than $30 million in fines to settle alleged privacy violations concerning its voice assistant Alexa and doorbell camera Ring.
A lawsuit filed by the FTC alleges that the tech company violated privacy laws by keeping records of children’s conversations with its voice assistant Alexa. Another lawsuit claimed that the company’s employees monitored customers’ Ring camera recordings without consent.
Alexa’s lawsuit
In the first lawsuit, the FTC claims that Amazon was holding onto children’s voices and geolocation data indefinitely before using it illegally to improve its algorithm. It is also accused of keeping transcripts of their interactions with Alexa, even after parents requested that it delete them.
The accusations, if true, would mean that Amazon was in violation of the Children’s Online Privacy Protection Act, which requires online companies to alert and obtain consent from parents when they gather information on kids under the age of 13. It also requires companies to let parents delete the data whenever they want.
Now, Amazon will not be able to use the data collected, which parents asked to be deleted, in addition to paying $25 million in civil penalties and other stipulations.
In a statement released after the settlement was reached, Samuel Levine, the director of the FTC’s Bureau of Consumer Protection, shared that the actions of Amazon were in direct violation of COPPA.
“Amazon’s history of misleading parents, keeping children’s recordings indefinitely, and flouting parents’ deletion requests violated COPPA and sacrificed privacy for profits,” Levine said. “COPPA does not allow companies to keep children’s data forever for any reason, and certainly not to train their algorithms.”
Amazon also released a statement saying that it does not agree with the findings of the FTC and does not believe it violated any laws.
“We take our responsibilities to our customers and their families very seriously,” Amazon said. “We have consistently taken steps to protect customer privacy by providing clear privacy disclosures and customer controls, conducting ongoing audits and process improvements, and maintaining strict internal controls to protect customer data.”
The complaint alleges there were more than 800,000 Alexa accounts for children under 13. It also claims that when the FTC brought the concerns to the company, it did not take action to remedy the situation.
Still, the company argues that it requires parental consent for children’s profiles, provides parents with a Children’s Privacy Disclosure that discusses how it uses data, allows child recordings and transcripts to be deleted, and erases child profiles that have been inactive for 18 months.
Ring’s lawsuit
The FTC is also seeking $5.8 million in fines from Amazon over claims that its employees and contractors at Ring had full access to videos from customers’ security doorbells, a second lawsuit alleges.
Additionally, Amazon is accused of not properly taking the right precautions to protect Ring data, as hackers were able to break into two-way communication streams and sexually extort people, threaten families for ransom, and abuse them verbally.
The FTC says that even with such concerns, Ring did not implement a multi-factor authentication tool until 2019, almost a year after the company was acquired by Amazon.
“Ring’s disregard for privacy and security exposed consumers to spying and harassment,” Levine said. “The FTC’s order makes clear that putting profit over privacy doesn’t pay.”
The $5.8 million fine will be issued as customer refunds. Ring will also have to delete customers’ videos and faces collected before 2018, notify customers about the FTC’s actions, and also report any unauthorized access to videos to the FTC.
Before the proposed orders go into effect, they will need to be approved by federal judges.
Related
Related
