Amazon Asked To Overhaul Data Deletion Practices, Implement Robust Privacy Safeguards

In a landmark settlement, Amazon has been ordered to overhaul its data deletion practices and implement robust privacy safeguards following allegations that the company violated the Children's Online Privacy Protection Act Rule (COPPA Rule) and deceived parents and users of its Alexa voice assistant service. 

The US Federal Trade Commission (FTC) and the Department of Justice (DOJ) have taken decisive action to protect the privacy of children and consumers alike.

The complaint, filed by the DOJ on behalf of the FTC, accused Amazon of preventing parents from exercising their deletion rights under the COPPA Rule. The company is further accused of retaining sensitive voice and geolocation data for extended periods and utilising it for its own purposes, potentially compromising the security and privacy of the data.

Samuel Levine, Director of the FTC's Bureau of Consumer Protection, said, "Amazon's history of misleading parents, keeping children's recordings indefinitely, and flouting parents' deletion requests violated COPPA and sacrificed privacy for profits. COPPA does not allow companies to keep children's data forever for any reason, and certainly not to train their algorithms."

The proposed settlement, which is subject to court approval, imposes strict requirements on Amazon. The company will be compelled to delete inactive child accounts, specific voice recordings, and geolocation information. Importantly, Amazon will be prohibited from utilising this data to train its algorithms, ensuring the privacy of users and preventing further misuse of sensitive information.

The complaint alleged that Amazon repeatedly assured users, particularly parents, that they could delete voice recordings and geolocation data collected by the Alexa voice assistant. However, the company failed to fulfill these promises, retaining significant amounts of data for extended periods and using it to enhance the Alexa algorithm. This alleged behavior violates COPPA and prioritizes profit over user privacy.

Under the COPPA Rule, companies operating websites or online services directed towards children under 13 must inform parents about data collection, obtain parental consent, and allow parents to delete the information at any time. Retaining data for longer than necessary to provide the service is strictly prohibited.

Amazon purportedly justified retaining children's voice recordings to improve voice command responses, allow parental review, and enhance Alexa's speech recognition capabilities. The unlawfully retained voice recordings created a valuable database for training the Alexa algorithm to understand children, furthering Amazon's bottom line but compromising children's privacy.

The proposed settlement includes a USD 25 million civil penalty for Amazon. Additionally, the settlement order prohibits Amazon from using deleted geolocation, voice, and children's voice information for data product creation or improvement. The company will delete inactive child accounts, notify users of the FTC-DOJ action, inform users of retention and deletion practices, prevent misrepresentation of privacy policies, and establish a privacy program concerning geolocation information.