• by Wendy Davis  @wendyndavis, May 31, 2023

Amazon has agreed to pay $25 million to settle charges that it violated children's privacy laws by indefinitely retaining their voice recordings and geolocation data, the Federal Trade Commission said Wednesday.

The proposed settlement -- awaiting approval from a federal judge -- also requires Amazon to delete some data collected from children by the voice-assistant service Alexa, and to refrain from using that information to train algorithms, the FTC said.

Settlement details and the FTC's complaint were unveiled Wednesday in U.S. District Court for the Western District of Washington.

The FTC's complaint alleged that Amazon ran afoul of the federal Children's Online Privacy Act by failing to shed voice recordings collected from users under 13 after the data was no longer needed, and by failing to give parents accurate information about how to have their children's information deleted.

Alexa's default settings were configured to save voice recordings and written transcripts of those recordings indefinitely, “even if the user stops using the account for months or even years,” the FTC alleges.

Amazon harnessed the recordings and transcripts of them to “train and improve” Alexa, in addition to fulfilling consumers' requests, the complaint says.

The FTC also alleged that the company engaged in unfair and deceptive practices, including that it responded to parents' requests to delete children's voices by shedding the recordings, but maintaining transcripts of them.

Among other specific settlement terms, the deal requires Amazon to delete data from profiles of children who haven't been active for more than 18 months, unless a parent or guardian requests to keep them.

The FTC's complaint also includes allegations that Amazon retained adults' and children's “sensitive geolocation data in a manner and location that insulated that information from users’ deletion requests and allowed Amazon to access that data for product improvement."

The FTC said that Amazon learned in February of 2018 that it was retaining Alexa app users' geolocation data after they requested to delete it, and that the company unsuccessfully attempted to remedy the issue on several occasions.

“As a result of these repeated failures, Amazon continued to store some Alexa App users’ geolocation information contrary to their deletion requests into early 2022," the FTC alleged. "To date, Amazon has never informed Alexa App users that it retained geolocation data that they tried to delete.

In May of 2019, the advocacy groups Fairplay and Center for Digital Democracy filed an FTC complaint over Amazon's voice collection practices. The FTC sent Amazon a request for information several months later, according to its complaint.

The agency also said Wednesday it had resolved separate charges against Amazon over privacy practices associated with the Ring doorbell.

The agency alleged in that complaint that Amazon allowed employees or contractors to access Ring users' videos.

The proposed settlement requires Amazon to pay $5.8 million, delete data and algorithms from videos it unlawfully accessed, and to implement new privacy safeguards.

Amazon stated that it disagrees with the FTC's claims regarding Alexa and Ring, and denies violating the law.

“We built Alexa with strong privacy protections and customer controls, designed Amazon Kids to comply with COPPA, and collaborated with the FTC before expanding Amazon Kids to include Alexa,” a spokesperson stated Wednesday.

“Ring promptly addressed the issues at hand on its own years ago, well before the FTC began its inquiry,” the spokesperson added.