Business ProfileforAmazon.com

The following describes a government action that has been resolved by either a settlement or a decision by a court or administrative agency. If the matter is being appealed, it will be noted below.

On July 19, 2023, in the United States District Court, Western District of Washington, the United States of America and Amazon.com, Inc. and Amazon.com Services LLC entered into a Stipulated Order for Permanent Injunction, Civil Penalty Judgement and Other Relief.  The Justice Department, together with the Federal Trade Commission (FTC),  Amazon.com Inc. and its wholly-owned subsidiary Amazon.com Services LLC (collectively Amazon), have agreed to a permanent injunction and a $25 million civil penalty as part of a settlement to resolve alleged violations of the Children’s Online Privacy Protection Act (COPPA), the Children’s Online Privacy Protection Rule (COPPA Rule) and the Federal Trade Commission Act (FTC Act) relating to Amazon’s voice assistant service Alexa. 

Amazon neither admits nor denies any of the allegations in the Complaint, except as specifically stated in this Order. Only for purposes of this action, Amazon admits the facts necessary to establish jurisdiction.

The Complaint charges that Amazon violated the COPPA Rule and the FTC Act with respect to Alexa by misrepresenting that they would delete voice transcripts and geolocation information of users of their Alexa voice assistant service upon request and limit employees' access to Alexa users' voice information; by failing to delete children's personal information at the request of parents; and by retaining children's personal information longer than reasonably necessary to fulfill the purpose for which the information was collected. 

Under the Order also filed by DOJ, Amazon will be required to delete inactive child accounts and certain voice recordings and geolocation information and will be prohibited from using such data to train its algorithms. 

According to the complaint, Amazon prominently and repeatedly assured its users, including parents, that they could delete voice recordings collected from its Alexa voice assistant and geolocation information collected by the Alexa app. The company, however, failed to follow through on these promises when it kept some of this information for years and used the data it unlawfully retained to help improve its Alexa algorithm, according to the complaint. Amazon, one of the world’s biggest retailers, collects vast amounts of data about consumers ranging from their geolocation data via the company’s Alexa app to their voice recordings collected by Amazon’s Alexa voice assistant service. The company claims that its Alexa service and Echo devices are “designed to protect your privacy” and that parents and other users can delete geolocation data and voice recordings. Amazon also offers Alexa-enabled devices and services targeted to children and collects personal data, including voice recordings, from children. Amazon retained children’s recordings indefinitely—unless a parent requested that this information be deleted, according to the complaint. And even when a parent sought to delete that information, the FTC said, Amazon failed to delete transcripts of what kids said from all its databases.

The COPPA Rule requires, among other things, that an operator of a commercial website or online service directed to children under 13 years of age notify parents about the information they collect from children, obtain parents’ consent for the collection of that data, and allow them to delete that information at any time. In addition, such a service is prohibited from retaining the information collected from children under 13 for longer than is reasonably necessary to provide the service.

Amazon claimed it retained children’s voice recordings in order to help it respond to voice commands, allow parents to review them, and to improve Alexa’s speech recognition and processing capabilities, according to the complaint. Children’s speech patterns and accents differ from those of adults, so the unlawfully retained voice recordings provided Amazon with a valuable database for training the Alexa algorithm to understand children, benefitting its bottom line at the expense of children’s privacy.

The FTC said the company failed to put in place an effective system to ensure that it honored users’ data deletion requests and to give parents meaningful notice about deletion. Even when Amazon discovered its failures to delete geolocation data, the FTC said that Amazon repeatedly failed to fix the problems.

In addition to the data deletion requirement in the order, Amazon will be required to pay a $25 million civil penalty. Other provisions of the order:

• Prohibit Amazon from using geolocation, voice information, and children’s voice information subject to consumers’ deletion requests for the creation or improvement of any data product;
• Require the company to delete inactive Alexa accounts of children;
• Require Amazon to notify users about the FTC-DOJ action against the company;
• Require Amazon to notify users of its retention and deletion practices and controls;
• Prohibit Amazon from misrepresenting its privacy policies related to geolocation, voice and children’s voice information; and
• Mandate the creation and implementation of a privacy program related to the company’s use of geolocation information.

This matter was handled by Senior Trial Attorney James T. Nelson and Assistant Directors Lisa Hsiao and Rachael Doud of the Civil Division’s Consumer Protection Branch, Assistant U.S. Attorney Kayla Stahman for the Western District of Washington and Elisa Jillson, Andrew Hasty and Julia Horowitz of the FTC.

For more information about the United States Department of Justice Consumer Protection Branch and its enforcement efforts, visit its website at www.justice.gov/civil/consumer-protection-branch. For more information about the FTC, visit its website at www.FTC.gov.