The Federal Trade Commission (FTC) and the Department of Justice (DOJ) have settled with Amazon, requiring the e-commerce giant to revamp its deletion practices and enforce stringent privacy measures. The settlement addresses allegations that Amazon violated the Children's Online Privacy Protection Act Rule (COPPA Rule) and deceived parents and users of its Alexa voice assistant service regarding data deletion practices.
According to a complaint filed by the DOJ on behalf of the FTC, Amazon impeded parents from exercising their deletion rights under the COPPA Rule. Additionally, the company retained sensitive voice and geolocation data for extended periods, utilizing it for its own purposes while exposing the data to unnecessary risks.
Samuel Levine, Director of the FTC's Bureau of Consumer Protection, expressed concern over Amazon's actions, stating, "Amazon's history of misleading parents, keeping children's recordings indefinitely, and disregarding deletion requests violated COPPA and prioritized profits over privacy. COPPA does not permit companies to retain children's data indefinitely for any reason, let alone for training algorithms."
Under the proposed federal court order, Amazon will be compelled to delete inactive child accounts and specific voice recordings and geolocation information. Furthermore, the order prohibits Amazon from employing this data to train its algorithms. The court must approve the proposed order for it to take effect.
The complaint alleges that Amazon repeatedly assured its users, including parents, that they could delete voice recordings and geolocation information collected from its Alexa voice assistant. However, the company failed to follow through on these assurances, retaining some of this information for extended periods and illicitly using it to enhance its Alexa algorithm.
As one of the world's largest retailers, Amazon amasses vast quantities of consumer data, ranging from geolocation data acquired through the Alexa app to voice recordings collected by the Alexa voice assistant service. The company claims that the Alexa and Echo devices are designed to protect users' privacy, allowing parents and other users to delete geolocation data and voice recordings.
Amazon also offers Alexa-enabled devices and services for children, collecting personal data, including voice recordings, from minors. According to the complaint, Amazon retained children's recordings indefinitely unless a parent explicitly requested their deletion. Even when parents sought to delete the information, Amazon allegedly failed to remove transcripts of children's speech from all its databases.
The COPPA Rule stipulates that operators of commercial websites or online services directed at children under 13 years of age must notify parents about the data they collect, obtain parental consent for data collection, and provide the option to delete the collected information at any time. Additionally, such services are prohibited from retaining data collected from children under 13 for longer than necessary to provide the service.
Amazon claimed that it retained children's voice recordings to facilitate response to voice commands, enable parental review, and improve Alexa's speech recognition and processing capabilities. The complaint asserts that by unlawfully retaining voice recordings, which offer valuable insights into children's speech patterns and accents, Amazon acquired a valuable database for training the Alexa algorithm to comprehend children. This action benefited the company's financial bottom line at the expense of children's privacy.
The settlement with the FTC and DOJ requires Amazon to rectify its practices, ensuring compliance with COPPA Rule requirements and safeguarding the privacy of its users. The court's approval of the proposed order will cement the obligations imposed on Amazon. With this settlement, regulatory authorities are taking a stand against the mishandling of children's data and reinforcing the importance of protecting their privacy in the digital realm.
Proposed Order
In addition to the data deletion requirement in the proposed order, Amazon will be required to pay a $25 million civil penalty. Other provisions of the proposed order:
- Prohibit Amazon from using geolocation, voice information, and children's voice information subject to consumers' deletion requests for the creation or improvement of any data product;
- Require the company to delete inactive Alexa accounts of children;
- Require Amazon to notify users about the FTC-DOJ action against the company;
- Require Amazon to notify users of its retention and deletion practices and controls;
- Prohibit Amazon from misrepresenting its privacy policies related to geolocation, voice and children's voice information; and
- Mandate creating and implementing a privacy program related to the company's use of geolocation information.
No comments:
Post a Comment