Amazon will be required to overhaul how it deletes data and implement new privacy guidelines following Federal Trade Commission (FTC) and Department of Justice (DOJ) charges. The charges claim the company violated the Children’s Online Privacy Protection Act Rule (COPPA Rule) and deceived parents and users of the Alexa voice assistant service about its data deletion practices. According to a complaint filed by the DOJ on behalf of the FTC, Amazon prevented parents from exercising their deletion rights under the COPPA Rule, kept sensitive voice and geolocation data for years, and used it for its own purposes, while putting data at risk of harm from unnecessary access.

Under the proposed federal court order also filed by DOJ, Amazon will be required to delete inactive child accounts and certain voice recordings and geolocation information and will be prohibited from using such data to train its algorithms. The proposed order must be approved by the federal court to go into effect.

According to the complaint, Amazon prominently and repeatedly assured its users, including parents, that they could delete voice recordings collected from its Alexa voice assistant and geolocation information collected by the Alexa app. The company, however, failed to follow through on these promises when it kept some of this information for years and used the data it unlawfully retained to help improve its Alexa algorithm, according to the complaint.

The company claims that its Alexa service and Echo devices are “designed to protect your privacy” and that parents and other users can delete geolocation data and voice recordings. Amazon also offers Alexa-enabled devices and services targeted to children and collects personal data, including voice recordings, from children. Amazon retained children’s recordings indefinitely — unless a parent requested that this information be deleted, according to the complaint. And even when a parent sought to delete that information, the FTC said, Amazon failed to delete transcripts of what kids said from all its databases.

The COPPA Rule requires, among other things, that an operator of a commercial website or online service directed to children under 13 years of age notify parents about the information they collect from children, obtain parents’ consent for the collection of that data, and allow them to delete that information at any time. In addition, such a service is prohibited from retaining the information collected from children under 13 for longer than is reasonably necessary to provide the service.

Amazon claimed it retained children’s voice recordings in order to help it respond to voice commands, allow parents to review them, and to improve Alexa’s speech recognition and processing capabilities, according to the complaint. Children’s speech patterns and accents differ from those of adults, so the unlawfully retained voice recordings provided Amazon with a valuable database for training the Alexa algorithm to understand children, benefitting its bottom line at the expense of children’s privacy.

The FTC said the company failed to put in place an effective system to ensure that it honored users’ data deletion requests and to give parents meaningful notice about deletion. Even when Amazon discovered its failures to delete geolocation data, the FTC said that Amazon repeatedly failed to fix the problems.

Proposed order

In addition to the data deletion requirement in the proposed order, Amazon will be required to pay a $25 million civil penalty. Other provisions of the proposed order:

• Prohibit Amazon from using geolocation, voice information and children’s voice information subject to consumers’ deletion requests for the creation or improvement of any data product.
• Require the company to delete inactive Alexa accounts of children.
• Require Amazon to notify users about the FTC-DOJ action against the company.
• Require Amazon to notify users of its retention and deletion practices and controls.
• Prohibit Amazon from misrepresenting its privacy policies related to geolocation, voice and children’s voice information.
• Mandate the creation and implementation of a privacy program related to the company’s use of geolocation information.