Coming from a hot girl? FTC says Amazon keeps kids’ Alexa voice data forever – even after parents order deletion

“Stop!” Moms and dads may have to repeat this instruction to their children, but when parents say this to Amazon in an attempt to get the company to delete children’s voice data obtained through the Alexa voice assistant, Amazon should immediately respect it. these requests. But Amazon responded by deleting some files from the database while retaining them elsewhere, meaning Amazon could use the information for its own purposes, according to a complaint filed by the U.S. Department of Justice on behalf of the FTC.The lawsuit accuses Amazon of violating Children’s Internet Privacy Protection Act Rules Ignoring parents’ deletion requests, retaining their children’s recordings indefinitely, and failing to speak directly to parents about their deletion practices.Amazon also allegedly violated the Federal Trade Commission Act by falsely stating that Alexa app users could delete their geolocation information and recordings through Engage in unfair privacy practices related to the deletion, retention and employee access of data. The $25 million settlement with Amazon sends a clear message about the consequences of putting profits over privacy.

In addition to the wealth of other information Amazon collects about its customers, the company has found direct access to millions of consumers’ homes through its Alexa-enabled devices, which respond to users’ verbal requests. Start with some background on how consumers of all ages interact with Alexa technology. When an Alexa device detects someone saying the word “wake,” Alexa begins recording what it hears in two formats: an audio file and a transcript. Alexa then responds by performing the requested task.

Given that Alexa can access so much highly personal data, privacy is an important consideration for many Alexa users. Not surprisingly, Amazon puts privacy at the heart of its marketing. For example, on Amazon’s Alexa Privacy Hub, the company claims that “Alexa and Echo devices are designed to protect your privacy” and “Alexa and Echo devices provide transparency and control.”

Users can also interact through the Alexa app, which collects their geolocation information.Amazon has repeatedly assured Alexa app users that they can delete their location information.But the FTC said Amazon deleted data from some locations but kept it even after consumers clicked the appropriate delete button data Elsewhere, in direct violation of its privacy commitments.Amazon first discovered the problem early 2018, But it wasn’t until September 2019 that Amazon finally took some corrective steps, the FTC said. “Some” is the key word here, because as the complaint alleges, Amazon didn’t finally get full control of the problem until early 2022 due to fix errors and failed processes.

Amazon has made a similar promise, allowing Alexa users to “see, hear and delete [their] recording. . . at any time. But as the complaint explains, Amazon again deleted files in some locations but kept transcripts elsewhere in a form the company could use for product development. To add insult to injury, for at least a year, Amazon allowed 30,000 employees access Alexa users’ recordings, even though many of them have no business need for the files.

Now look at how the FTC found that Amazon’s misrepresentations and compliance failures resulted in a violation of COPPA. Given Alexa’s presence in consumers’ homes and the fact that Amazon sells child-focused products like Echo Dot Kids Edition, FreeTime on Alexa, and FreeTime Unlimited on Alexa, many of the technology’s users are under the age of 13. In fact, more than 800,000 children interact directly with Alexa using their own Amazon profile, which is linked to their parent’s profile and includes the child’s name, date of birth, and gender. Like adults, Amazon saves children’s recordings as audio and text files and uses persistent identifiers to connect those files to the child’s Amazon profile.

The complaint alleges that Amazon’s practices violate parents’ rights under COPPA to maintain control over their children’s personal data in three ways.First, Amazon programmed Alexa to permanently retain children’s recordings, a practice that violated Article 312.10 COPPA rules. The provision requires companies to retain children’s data “only as long as is reasonably necessary to fulfill the purposes for which the information was collected.” Then, according to the plain language of the rules, they “must” safely delete it.

second, Article 312.6 COPPA provides parents with “opportunity at any time.” . . Instruct the operator to delete the child’s personal information. But according to the complaint, children’s recordings are subject to the same ineffective deletion procedures as adult recordings. So even if a parent tells Amazon to delete the files, Amazon keeps a record of the persistent identifiers linked to the child’s account.

Another fundamental privacy protection under COPPA is Article 312.4Requires companies to “provide notice and obtain verifiable parental consent before collecting, using or disclosing children’s personal information.” By failing to comply with its stated practices, Amazon failed to provide parents with complete and factual notice of their ability to delete their children’s personal information, which is inconsistent with COPPA requirements.

In addition to a $25 million civil penalty, the proposed settlement prohibits Amazon from making false statements about location and voice information. The company also can’t use geolocation, voice information and children’s information to create or improve any data products after customers instruct Amazon to delete the data. What’s more, Amazon must delete children’s inactive Alexa accounts, notify users about the FTC-DOJ lawsuit, and implement a privacy plan specifically addressing the company’s use of geolocation information.

Here are some tips other businesses can take from the action against Amazon.

COPPA compliance requires constant vigilance. For companies covered by COPPA, compliance is not a set of set-and-forget, check-the-box technical details. Instead, the rule creates substantive rights for parents and imposes ongoing legal liability on businesses. One example would be to require companies to clearly explain to parents in advance their rights to delete their children’s information and the attendant obligations to respect those requests. But even if parents don’t exercise their right to delete, companies can’t retain the data “just because.” Once the purpose of collection has passed, companies must securely delete them. For specific parental requests and COPPA’s general data deletion requirements, please ensure that you also delete related files stored in backups, separate databases, or other locations.

Recordings are biometric data and should be treated with caution. As the FTC May 2023 Biometric Information Policy Statement It was determined that audio recordings and audio transcripts fall into the category of biometric-sourced data that “raises significant concerns about consumer privacy and data security.”Now considering biometric data about children, these concerns rise to nth degree.

Don’t secretly use your customers’ personal information (especially information about children) to feed your algorithm. Through this enforcement action and the proposed settlement with Ring, the FTC is sending a clear and unmistakable message to companies developing artificial intelligence: When you intend to use consumers’ data for other purposes, you cannot comfort them with privacy promises. consumer. This principle takes on even greater significance for children. Children’s speech patterns are significantly different from adults, so Alexa recordings provide Amazon with a valuable data set for training the Alexa algorithm and further stimulate Amazon’s business interest in developing new products. That’s just one reason why Amazon’s empty promise to honor parental deletion requests is particularly troubling.