Podcast - The FTC and DOJ Act Against Amazon to Protect Privacy

Good day, this is Tony DiResta, and I welcome you to another podcast of Clearly Conspicuous. As we've noted in previous sessions before, our goal in these podcasts is to make you succeed in this environment that's very aggressive and progressive, make you aware of what's going on with the federal and state consumer protection agencies and give you practical tips for success. It's a privilege to be with you today.

Legal Basis for the FTC and DOJ's Actions Against Amazon

Today, we discussed the recent actions the FTC and the Department of Justice took against Amazon for unlawfully retaining sensitive children's data indefinitely, misleading parents about their ability to delete that data and misleading Alexa users about their ability to delete their geolocation information. Amazon will be required to pay $25 million in civil penalties to essentially overhaul its data deletion practices and to implement stringent data safeguards. The FTC and DOJ brought action against Amazon for violating the Children's Online Privacy Protection Act, which prohibits the retention of children's personal data and information for longer than is reasonably necessary to fulfill the purposes for which the information is collected. The FTC and DOJ brought action against Amazon for violating Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices and for behaviors or policies that cannot be reasonably avoided by consumers and that are not outweighed by benefits to consumers or competition.

How Alexa Works and How Amazon Retains Data

So with that overview, let's talk about the facts. First, how Alexa works. Alexa is the voice assistant service featured in Amazon's Echo Smart speakers and Alexa app. Used today by millions of Americans, Alexa offers users a wide variety of services, such as playing music and online shopping. Users often activate Alexa by saying "Alexa," followed by their requests, such as "play music" or "set a five-minute timer." When such requests are audibly made, Alexa's default settings save them as both audio voice recordings and text transcripts for adult and children users alike. And Amazon retains that data indefinitely, even if the user stops using their Amazon accounts for an extended period of time. In addition, the Alexa app allows Amazon to access the geolocation of Alexa app users, and it retains that data indefinitely as well.

In May of 2018, Amazon launched a series of Alexa-powered products designed for children under the age of 13. Free Time Unlimited on Alexa, for instance, provides subscribers with children-oriented audio books, games, educational tools, among other things. To use these products, parents create profiles for their children, which contain their child's name, birth, date and gender. When children use these child-oriented products and speak to Alexa, Amazon's default settings, as mentioned, save their speech as audio recordings and as text transcripts. And because children's speech patterns differ from those of adults, their voice recordings give Amazon valuable data for training the Alexa algorithm to better understand children. Since May of 2018, more than 800,000 children have interacted directly with Alexa using their own profiles. And because of Alexa's default settings, Amazon has been accumulating and indefinitely retaining their data. Until September of 2019, parents who sought to delete their children's data could only do so by contacting Amazon's customer service or navigating Amazon's online deletion options.

Allegations Against Amazon and Terms of the Settlement

Following a civil investigative demand, or CID, or subpoena from the FTC, Amazon started allowing users to audio delete their voice recordings every three or 18 months, but Amazon's default settings remained the same. As a result, Amazon continued to indefinitely retain children's data. Amazon claimed to retain children's voice recordings for three reasons: to respond to children voice commands, to enable parents to listen to their children's old voice recordings and to improve Alexa's voice recognition capabilities. But the FTC argued that despite those objectives, it was still not reasonably necessary for Amazon to forever keep children's data. Consequently, Amazon's indefinite retention of that data violated COPPA. So the allegations were twofold. First, Amazon misled Alexa users about their ability to delete data. And second, Amazon misled Alexa app users about their ability to delete geolocation information. Under the settlement, Amazon will be required to pay a $25 million civil penalty, and the proposed order also mandates the following:

• Amazon must implement a process to identify inactive Alexa child profiles.
• Amazon must delete the personal information and data collected from a child associated with an inactive account within 90 days, unless a parent requests that their child's data be retained or the child's profile becomes active again.
• Amazon cannot misrepresent, either expressly or by implication, the extent to which they retain any geolocation information or voice data or the extent to which consumers may exercise control over Amazon's retention of their or their children's geolocation information or voice data.
• Amazon must delete the geolocation information and voice data of consumers that have previously requested their information or their children's information be deleted, and Amazon cannot subsequently use that information for the creation or improvement of any of their products.
• Amazon must notify Echo's Smart Speaker and Alexa app users about the FTC DOJ action against the company.
• And finally, Amazon must create and implement a privacy program related to the company's use of geolocation information.

Key Takeaway

So with all of that, here's the key takeaway. This action against Amazon is illustrative of a larger data privacy concern that companies and consumers potentially face when using tech products. Tech companies often have a vested interest in obtaining and retaining consumers' data. For instance, tech companies use consumer data to develop and improve the algorithms that run their products, as well as to become better at consumer identification for trends and preferences. Also, given their size, tech companies like Amazon here mistakenly retain consumer data in secondary databases. In short, data is invaluable to tech companies. So consumers should be aware that tech companies, whether intentionally or not, may make it difficult for them to delete their data. In addition, this action against Amazon is indicative of the increasing importance regulators are placing on data governance for children. One-third of internet users today are children, and they are often less able to understand the implications of consenting to data collection.

So please stay tuned to further programs as we identify and address the key issues in developments and provide strategies for success. I wish you continued success and a meaningful day. Thank you.