Amazon settlement for FTC privacy complaints over Alexa and Ring

Amazon has agreed to pay more than $30 million to settle two federal lawsuits alleging that the tech giant violated user privacy — including children’s privacy — through its assistant. Alexa voice and doorbell camera.

Video above: Alexa celebrity voices are being discontinued

Wednesday’s twin settlements with the Federal Trade Commission underscored claims that Amazon has withheld Ring videos and Alexa voice recordings, along with related geolocation information, for years. – in some cases without consent and despite consumer requests for data deletion.

Additionally, the FTC alleges that lax data policies at Amazon mean that information can often be accessed by unauthorized parties — and often so in the case of doorbell footage.

Amazon acquired Ring in 2018, paving the way for the e-commerce giant to enter the home security business. In addition to video doorbells, Ring also manufactures indoor and outdoor security cameras and alarm systems.

In the complaint accompanying the settlement, the FTC claims Ring granted employees unrestricted access to videos from customers’ home security systems. In one case, the complaint states, a Ring employee viewed thousands of video recordings from at least 81 female users between June and August 2017, viewing the cameras users pointed to. for bathrooms and bedrooms. An employee’s initial misconduct report was not taken seriously, the complaint said.

“Only after the supervisor noticed that the male employee only watched videos of ‘pretty girls’ did the supervisor report the misconduct,” the FTC alleges in the complaint. “Only at that point did Ring review part of the employee’s activities and, ultimately, terminate his employment.”

The complaint against Ring also recounts numerous alleged cases where hacked cameras allowed bad actors to talk to victims, causing distress. According to the complaint, many of these attacks are believed to have occurred through the successful guessing of users’ passwords, reflecting Amazon’s failure to require strong password protections. .

“From January 2019 to March 2020, more than 55,000 US customers suffered credential-stuffing and brute-force attacks that compromised Ring devices,” the FTC alleges. “Through these attacks, the bad guys gained access to hundreds of thousands of videos of consumers’ personal spaces in their homes, including their bedrooms and their children’s bedrooms—recorded by the devices Ring sells by claiming they will enhance consumer security.”

As part of the proposed settlement, Ring agreed to pay $5.8 million and implement a new data privacy program, according to the filing.

“Ring quickly addressed these issues many years ago, long before the FTC began investigating,” Ring said in a statement provided to CNN. “While we disagree with the FTC’s allegations and deny breaking the law, this agreement will address the issue so we can focus on innovation on behalf of our customers. .”

Separately, Amazon will pay $25 million to settle the allegations surrounding its Alexa voice assistant.

In a complaint, the FTC alleges that Amazon violated a children’s privacy law known as COPPA, which restricts the collection of personal information from children under the age of 13 without parental consent. Mom.

According to the FTC, Amazon keeps Alexa children’s voice recordings “indefinitely” unless the user specifically instructs the company to delete the recordings. It is also accused of sometimes not honoring deletion requests “and instead retaining that data for its own potential use.”

The proposed Alexa settlement requires Amazon to delete voice recordings and geolocation data in response to previous consumer requests, including requests by children. The company would also be prohibited from using that data to train its algorithms, the FTC said. Amazon also agreed to notify consumers of the FTC settlement and implement a geolocation data privacy program.

Amazon did not immediately respond to a request for comment on the Alexa settlement.