Amazon to pay over $30 million to settle Alexa, Ring privacy violation claims

Amazon will have to pay more than $30 million in consumer refunds and fines for violating the privacy of customers who own Alexa and Ring devices under settlement agreements filed Wednesday.

In one complaint, the Federal Trade Commission alleged that Amazon not only failed to delete the voice data of children at the request of their parents but also kept the recordings indefinitely in order to refine its algorithm.

In another, the FTC accuses Ring ‒ now owned by Amazon – of allowing its employees to access customers’ private videos and exposing them to hackers.

In the first instance, Amazon violated federal protection laws, the FTC said. In the second, Ring’s actions committed “egregious violations of users’ privacy.”

In a statement sent to USA TODAY, Amazon said the company takes its “responsibilities to our customers and their families very seriously."

“While we disagree with the FTC’s claims regarding both Alexa and Ring, and deny violating the law, these settlements put these matters behind us,” the company said.

Alexa allegations

Under the Alexa settlement, which needs approval by a federal court, the FTC and the Justice Department will require Amazon to delete inactive child accounts, some voice recordings and geolocation information, and Amazon won't be allowed to use such data for its algorithms, according to a news release announcing the settlement.

"Amazon prominently and repeatedly assured its users, including parents, that they could delete voice recordings collected from its Alexa voice assistant and geolocation information collected by the Alexa app," the FTC said. "The company, however, failed to follow through on these promises when it kept some of this information for years and used the data it unlawfully retained to help improve its Alexa algorithm."

The practices are in violation of the Children’s Online Privacy Protection Act Rule, or COPPA, according to the FTC.

"These allegations should set off alarms for any parent," FTC Commissioner Alvaro Bedoya said in a statement.

"Amazon is not alone in apparently seeking to amass data to refine its machine-learning models; right now, with the advent of large language models, the tech industry as a whole is sprinting to do the same," Bedoya said. "Today’s settlement sends a message to all those companies: Machine learning is no excuse to break the law ... The data you use to improve your algorithms must be lawfully collected and lawfully retained. Companies would do well to heed this lesson."

In its statement to USA TODAY, Amazon said the company "built Alexa with strong privacy protections and customer controls, designed Amazon Kids to comply with COPPA, and collaborated with the FTC before expanding Amazon Kids to include Alexa."

"As part of the settlement, we agreed to make a small modification to our already strong practices, and will remove child profiles that have been inactive for more than 18 months unless a parent or guardian chooses to keep them," the company said.

Ring allegations

The FTC's allegations against Ring stem from before Amazon purchased the California-based company in 2018. But Amazon is now responsible for making changes to Ring products and practices as a result of Wednesday's settlement.

The FTC charged the home security camera company with allowing employees and contractors to access customers' private videos and enabling hackers to access their accounts, cameras and videos "by failing to implement basic privacy and security protections," according to a news release about that settlement.

“Ring’s disregard for privacy and security exposed consumers to spying and harassment,” Samuel Levine, director of the FTC’s Bureau of Consumer Protection, said in a statement. “The FTC’s order makes clear that putting profit over privacy doesn’t pay.”

Amazon said that “Ring promptly addressed the issues at hand on its own years ago, well before the FTC began its inquiry."

"Our focus has been and remains on delivering products and features our customers love while upholding our commitment to protect their privacy and security," the company said.

What happens now?

First, a federal court must approve both settlements. If and when that happens, Amazon will have to pay a $25 million civil penalty for the Alexa violations.

The Ring violations will require $5.8 million to be used for consumer refunds.

"The company also will be required to delete any customer videos and ... data collected from an individual’s face that it obtained prior to 2018, and delete any work products it derived from these videos," the FTC said. "The proposed order also will require Ring to alert the FTC about incidents of unauthorized access or exposure of its customers’ videos and to notify consumers about the FTC’s action."

It's unclear when the court will issue a decision on whether to approve the settlements.

More coverage from the USA TODAY Network

What's behind Wednesday's Amazon walkout Amazon workers walk out in protest of company climate policies, return to office, job cuts

Join our book club for some summer fun Read with USA TODAY's Book Club all summer long. Next up is T.J. Newman's 'Drowning'

Ron DeSantis' White House race 'Florida of the north': DeSantis hitches his record to Iowa's to court GOP caucusgoers

Gun violence in America South Carolina gas station owner chased, fatally shot 14-year-old, police say

Trump's handling of classified documents Donald Trump recorded while talking about classified document he had on Iran, report says

This article originally appeared on USA TODAY: Amazon settles Alexa, Ring spying, data claim with $30 million