The Justice Department, together with the Federal Trade Commission announced that Amazon.com Inc. and its wholly-owned subsidiary Amazon.com Services LLC (collectively Amazon), have agreed to a permanent injunction and a $25 million civil penalty as part of a settlement to resolve alleged violations of the Children’s Online Privacy Protection Act, the Children’s Online Privacy Protection Rule and the Federal Trade Commission Act relating to Amazon’s voice assistant service Alexa.
Alexa is a proprietary voice-activated service that Amazon provides through its Echo smart speakers, its “Alexa App” mobile application, and other devices and applications. Since May 2018, Amazon’s Alexa-related offerings have included voice-activated products and services directed toward children under 13 years of age. When a user makes a verbal request to an Alexa-enabled device, Amazon saves the voice recording of the request and creates a written transcript of it.
In a complaint filed in the U.S. District Court for the Western District of Washington, the government alleges that, since at least May 2018, Amazon violated the FTC Act, COPPA, and the COPPA Rule with respect to Alexa and Alexa’s child-directed offerings. The complaint alleges that Amazon retained children’s voice recordings indefinitely by default, in violation of COPPA’s requirement that these recordings be retained only as long as reasonably necessary to fulfill the purposes for which they were collected. Other alleged violations include making deceptive representations that Alexa app users could delete their or their children’s voice recordings, including audio files and transcripts and their geolocation information, when in fact Amazon on some occasions failed to delete all such information at users’ request. The complaint also alleges that Amazon engaged in unfair privacy practices with respect to Alexa users’ geolocation information and voice recordings, including (in some instances) by failing to honor users’ deletion requests and failing to notify consumers that it had not done so.
The stipulated order entered today by the federal district court requires Amazon to pay $25 million in civil penalties. The order imposes injunctive relief that requires Amazon to identify and delete inactive child profiles (profiles that have not been used for 18 months) unless a parent requests that they be retained. Amazon also will notify parents whose children have accounts of this change to its policies. The order further prohibits Amazon from making misrepresentations about Amazon’s retention, access to, or deletion of geolocation information or voice information, including children’s voice information, and mandates deletion of geolocation information, voice information, and children’s personal information upon the request of the user or parent, respectively. Finally, the order requires Amazon to make disclosures to consumers relating to its retention and deletion practices regarding Alexa App geolocation information and voice information.
This matter was handled by Senior Trial Attorney James T. Nelson and Assistant Directors Lisa Hsiao and Rachael Doud of the Civil Division’s Consumer Protection Branch, Assistant U.S. Attorney Kayla Stahman for the Western District of Washington and Elisa Jillson, Andrew Hasty and Julia Horowitz of the FTC.
