Amazon agrees to injunctive relief, $25 million civil penalty for alleged violations of children's privacy law relating to Alexa.

• Author: Schuster, Steve

Byline: Steve Schuster, sschuster@dailyreporter.com

By Steve Schuster

sschuster@wislawjournal.com

The Justice Department and Federal Trade Commission (FTC) announced Wednesday that Amazon.com Inc. and its wholly-owned subsidiary Amazon.com Services LLC (collectively Amazon), have agreed to a permanent injunction and a $25 million civil penalty as part of a settlement to resolve alleged violations of the Children's Online Privacy Protection Act (COPPA), the Children's Online Privacy Protection Rule (COPPA Rule) and the Federal Trade Commission Act (FTC Act) relating to Amazon's voice assistant service Alexa.

Alexa is a proprietary voice-activated service that Amazon provides through its Echo smart speakers, its "Alexa App" mobile application, and other devices and applications. Since May 2018, Amazon's Alexa-related offerings have included voice-activated products and services directed toward children under 13 years of age. When a user makes a verbal request of an Alexa-enabled device, Amazon saves the voice recording of the request and creates a written transcript of it, according to Justice Department officials.

According to the complaint filed in the U.S. District Court for the Western District of Washington, the government alleges that, since at least May 2018, Amazon violated the FTC Act, COPPA and the COPPA Rule with respect to Alexa and Alexa's child-directed offerings. The complaint alleges that Amazon retained children's voice recordings indefinitely by default, in violation of COPPA's requirement that these recordings be retained only as long as reasonably necessary to fulfill the purposes for which they were collected. Other alleged violations include making deceptive representations that Alexa app users could delete their or their children's voice recordings, including audio files and transcripts and their geolocation information, when in fact Amazon on some occasions failed to delete all such information at users' request. The complaint also alleges that Amazon engaged in unfair privacy practices with respect to Alexa users' geolocation information and voice recordings, including (in some instances) by failing to honor users' deletion requests and failing to notify consumers that it had not done so.

The stipulated order entered Wednesday by the federal district court requires Amazon to pay $25 million in civil penalties. The order imposes injunctive relief that requires Amazon to identify and delete inactive child profiles...