Amazon to pay over $30 million to settle Ring claims Alexa invaded users’ privacy: NPR

The Federal Trade Commission has accused Amazon of harboring children’s data even when parents request its deletion, as well as giving its Ring employees access to user videos.

Michael Sohn/AP

hide caption

toggle caption

Michael Sohn/AP

The Federal Trade Commission has accused Amazon of harboring children’s data even when parents request its deletion, as well as giving its Ring employees access to user videos.

Michael Sohn/AP

Amazon will pay more than $30 million in fines to settle alleged privacy breaches involving its Alexa voice assistant and Ring doorbell camera, according to federal documents.

In one lawsuit, the Federal Trade Commission says the tech company violated privacy laws by keeping recordings of children’s conversations with its voice assistant Alexa, and in another that its employees monitored recordings from the Ring camera. customers without their consent.

The FTC alleges that Amazon retained the children’s voice and geolocation data indefinitely, unlawfully used it to improve its algorithm, and kept transcripts of their interactions with Alexa despite parental requests to delete it.

The alleged practices would violate the Children’s Online Privacy Protection Act, or COPPA, which requires online companies to alert and obtain parental consent when collecting data for children under 13. and allow parents to delete data at will.

In addition to the $25 million civil penalty, Amazon would not be able to use the data requested to be deleted. The company should also remove children’s inactive Alexa accounts and be required to notify customers of FTC actions against the company.

“Amazon’s history of deceiving parents, retaining children’s records indefinitely, and flouting parental deletion requests violated COPPA and sacrificed privacy for profit,” said Samuel Levine, director from the FTC’s Consumer Protection Bureau, in a statement. “COPPA does not allow companies to retain children’s data indefinitely for any reason, and certainly not to train their algorithms.”

Until September 2019, Alexa’s default settings were to store recordings and transcripts indefinitely. Amazon said it uses the recordings to better understand speech patterns and respond to voice commands, the complaint states.

After the FTC intervened at the time, Amazon added a setting to automatically delete the data after three or 18 months, but still kept the default setting indefinite.

Amazon said in a statement that it disagrees with the FTC’s findings and does not believe it violated any laws.

“We take our responsibilities to our customers and their families very seriously,” he said. “We have always taken steps to protect customer privacy by providing clear privacy disclosures and customer controls, performing ongoing audits and process improvements, and maintaining strict internal controls to protect customer data. “

The company said it requires parental consent for all child profiles, provides a children’s privacy statement explaining how it uses children’s data, allows deletion of children’s recordings and transcripts in the app Alexa and was erasing profiles of children who had been inactive for at least 18 months. .

More than 800,000 children under the age of 13 have their own Alexa account, according to the complaint.

The FTC says that when these issues were brought to Amazon’s attention, it took no action to address them.

In a separate lawsuit, the FTC is seeking a $5.8 million fine from Amazon for claiming that employees and contractors of Ring – a home surveillance company purchased by Amazon in 2018 – had access complete to customer videos.

Amazon is also accused of not taking its security protections seriously, as hackers have been able to break into two-way video feeds to sexually propose people, call racial slurs at children and physically threaten families for ransom.

Despite this, according to the FTC, Ring only implemented multi-factor authentication in 2019.

In addition to paying the $5.8 million, which will be issued as refunds to customers, Ring is expected to remove pre-2018 customer videos and faces, notify customers of FTC actions, and report unauthorized access. cleared to videos at the FTC.

“Ring’s disregard for privacy and security has exposed consumers to espionage and harassment,” Levine said. “The FTC order makes it clear that putting profit before privacy doesn’t pay.”

The proposed orders require the approval of federal judges.