FTC Announces $25 Million Fine Against Amazon for Kids Privacy Violations
May 31, 2023
Today the Federal Trade Commission announced a major enforcement action against Amazon, moving to fine the tech and retail giant $25 million and requiring updated data deletion practices. As the complaint explains, Amazon’s children’s data retention practices violated the Children’s Online Privacy and Protection Act (COPPA) Rule and Section 5 of the FTC Act. This enforcement action follows the 2019 complaint drafted by groups including the Center for Digital Democracy, Fairplay, and the Consumer Federation of America that called on the FTC to investigate Amazon for COPPA violations.
More than 800,000 children have their own Alexa profiles on Amazon devices that target and collect children’s personal data, retaining voice recordings and geolocation indefinitely—including when a child’s Alexa profile has been inactive. The FTC noted that even when parents requested that Alexa delete their children’s voice recordings, Amazon failed to honor those requests for a significant length of time, if at all. Instead, Amazon retained that data for its own use to improve its Alexa algorithm. In addition to Section 5 violations for unfair and deceptive business practices, the complaint charges that Amazon violated the COPPA Rule by retaining children’s voice recordings indefinitely and failing to provide parents with truthful notice or an effective opportunity to delete the recordings.
Under the proposed order, Amazon will be fined $25 million and required to delete inactive accounts held by children. Additionally, Amazon will be prohibited from “using geolocation, voice information, and children’s voice information subject to consumers’ deletion requests for the creation or improvement of any data product.” In a statement joined by Chair Kahn and Commissioner Slaughter, Commissioner Bedoya reiterated that data used to improve algorithms must be lawfully collected, emphasizing that “machine learning is no excuse to break the law.”
The FTC announced another enforcement action against Amazon today, addressing privacy violations from their Ring camera products and requiring data deletion. EPIC regularly advocates before the FTC for strong consumer protection and data protection safeguards, including privacy protections for children. The FTC previously considered EPIC’s recommendations in an early review of the COPPA Rule and incorporated several of EPIC’s recommendations in the 2013 regulations. EPIC filed comments in response to the FTC’s rulemaking on commercial surveillance, arguing for regulations that would safeguard the privacy of minors. Recently, EPIC led a coalition amicus brief to defend California’s Age-Appropriate Design Code.