Privacy Experts, Senators Demand Investigation of Amazon’s Child Data Collection Practices

The complaint asks federal regulators to investigate allegations that Amazon’s “smart speaker” for kids violates a privacy law aimed at protecting children.

A still from a product video for the Amazon Echo Dot Kids Edition. Photo: Amazon

Last year, a coalition of privacy advocates and child psychologists warned against putting an Amazon Alexa speaker anywhere near your child on the fairly reasonable grounds that developing minds shouldn’t befriend always-on surveillance devices, no matter how cute the packaging. Now, a group of privacy researchers, attorneys, and U.S. senators are calling on the Federal Trade Commission to investigate Amazon’s alleged violations of COPPA, a law protecting the littlest users of all.

COPPA, the Children’s Online Privacy Protection Act, regulates how companies can collect and use data on users who might have trouble spelling “privacy,” let alone understand it enough to consent to relinquishing it. COPPA is the reason why so many sites, like Facebook, simply don’t allow children under 13 to sign up. Amazon, on the other hand, decided to court children for its data collection business, releasing the Amazon Echo Dot Kids Edition, an always-listening “smart speaker” that retains all of the functions of its adult counterpart, but tucks them inside a candy-colored shell. The kiddo speaker also adds child-specific features, like the ability to have Amazon’s virtual assistant Alexa read your child a story in her disembodied robo-voice, or play child-geared content from sources like Cartoon Network and Nickelodeon.

A new complaint drafted by the Campaign for a Commercial-Free Childhood, the consumer privacy group Center for Digital Democracy, and Georgetown University’s Institute for Public Representation says that Amazon is committing a litany of COPPA violations through the Echo Dot Kids Edition, and calls on the FTC to investigate.

Amazon’s COPPA violations, according to the complaint, include failure to provide parental notice and obtain parental consent for online services related to the kids’ Echo Dot, failure to tell parents that they have a right to review personal information submitted by their child, and failure to provide parents a way to delete such information or opt out of its collection.

Across 96 pages, the complaint gets more specific, offering examples of how Amazon dodges, obscures, and otherwise neglects its duties to parents. Given that the attorneys who drafted the complaint were confused by Amazon’s byzantine policies, it’s hard to imagine average parents faring much better:

Even if parents were for some reason motivated to seek out the website version of the Children’s Privacy Disclosure, the hyperlinked Privacy Notice is long, confusingly written, and contains a lot of unrelated material. It is unclear what, if any, parts apply to the Echo Dot Kids Edition, and some of the information seems to contradict the Children’s Privacy Disclosure. For example, the Privacy Notice discloses that Amazon collects “search term and search result information from some searches conducted through the Web search features offered by our subsidiary, Alexa Internet,” but it does not say whether it does so when a child is using the Echo Dot Kids Edition.

Perhaps most troubling is what the complaint says about Amazon’s treatment of child voice recordings, which aren’t supposed to be stored indefinitely, per recent FTC guidance: “The answer is clear: No, the company can’t keep it. Under Section 312.10 of COPPA, you’re allowed to retain children’s personal information ‘for only as long as is reasonably necessary to fulfill the purpose for which the information was collected.'”

But Amazon takes a different approach, the complaint explains: “In response to a Congressional inquiry about how long it keeps recordings and other information collected from children, however, Amazon responded: ‘Voice recordings are retained for the parent’s review until the parent deletes them.'” In other words, Amazon is keeping a child’s Amazon queries stored indefinitely, not “for only as long as is reasonably necessary.”

Worryingly, the researchers found that even if a concerned parent attempted to manually delete their child’s Alexa recordings, the feature is simply broken. In one example, Amazon recorded a young girl asking Alexa to remember a list of personal facts, such as a phone number, home address, and walnut allergy. When this same girl then asked Alexa to forget these things, the robot replied, “Sorry, I’m not sure about that.” Attempts to manually delete these recordings using software designed for parents appeared to have zero effect.

A demonstration of this apparent inability to forget is provided in a video created by the researchers:

In addition to the academics, advocates, and privacy researchers involved in its drafting, four senators are also supporting the complaint: Democrats Edward Markey of Massachusetts, Dick Durbin of Illionis, and Richard Blumenthal of Connecticut, along with Republican Josh Hawley of Missouri. In a letter addressed to FTC Commissioner Christine Wilson co-signed by his fellow senators, Markey wrote, “The Echo Dot Kids Edition captures not only the voice recordings of the children who speak to it, but also vast amounts of their personal information,” citing the new research. More than a dozen advocacy groups have also signed on to the original complaint, including the Consumer Federation of America, the Electronic Privacy Information Center, the Parents Television Council, and the U.S. Public Interest Research Group.”

Privacy policies aren’t generally written to be read by regular people, let alone understood, so none of the above should come as a surprise to anyone who’s tried to decipher one. A company is far likelier to get away with an invasive or otherwise unsavory data collection practice if its disclosure is buried beneath a tangle of legalese and vagaries. So far, there’s no law against asking adults to agree to an incomprehensible policy document before they can use your gadget or app. But there’s little point in having COPPA on the books if child privacy compliance is as hopelessly and inscrutably sloppy as what an adult might be up against on their own.

In a statement provided by an Amazon spokesperson, the company denied that it violates COPPA: “FreeTime on Alexa and Echo Dot Kids Edition are compliant with the Children’s Online Privacy Protection Act (COPPA). Customers can find more information on Alexa and overall privacy practices here:”

Join The Conversation