'Alexa, Stop Spying on My Kids': FTC Complaint Charges Amazon's Echo Dot Violates Child Privacy Law

A coalition of consumer and public health groups demanded Thursday that federal regulators investigate and sanction Amazon for its Echo Dot Kids Edition, arguing that the device illegally collects and retains children's personal data.

The brightly colored, always-on listening device "will play music, answer questions, read stories, tell jokes, and more--all with younger ears in mind," according to Amazon. "The included one year of FreeTime Unlimited gives your kids access to thousands of hours of fun and educational content, including ad-free radio stations and playlists, Audible books, and a growing list of premium kids skills."

"The FTC must hold Amazon accountable for blatantly violating children's privacy law and putting kids at risk."
--Josh Golin, CCFC

Amazon maintained in statements to reporters on Thursday that Echo Dot Kids Edition and FreeTime comply with federal privacy rules--but 19 groups, led by Commercial-Free Childhood (CCFC) and the Center for Digital Democracy (CDD), disagree.

In a complaint submitted to the Federal Trade Commission (FTC) Thursday, the coalition charged that the device violates the Children's Online Privacy Protection Act (COPPA), based on the findings of an investigation conducted by CCFC and the Institute for Public Representation (IPR) at Georgetown Law.

"We spent months analyzing the Echo Dot Kids and the device's myriad privacy policies and we still don't have a clear picture of what data is collected by Amazon and who has access to it," Angela Campbell, a CCFC board member and director of IPR's Communications and Technology Clinic, said in a statement.

"If privacy experts can't make heads or tails of Amazon's privacy policy labyrinth," Campbell asked, "how can a parent meaningfully consent to the collection of their children's data?"

Though questions remain about the device and data collection, what researchers found alarmed them. Alongside the complaint to federal regulators, the coalition launched a website that outlines specific ways in which experts say the device raises privacy concerns and breaks the law:

1. Amazon's process for reviewing personal information places undue burden on parents. It does not allow parents to search through information collected, instead requiring them to read or listen to every voice recording of their child's interaction with the device.
2. Amazon's parental consent mechanism does not provide assurance that the person giving consent is the parent of the child. Among other issues, it can be bypassed by a kid with a disposable debit gift card.
3. Amazon keeps children's personal information longer than reasonably necessary. It only deletes information if a parent explicitly requests deletion by contacting customer service, otherwise it is retained forever.
4. Amazon fails to clearly explain how to delete information collected about children through Echo Dot Kids Edition.
5. Amazon's website and literature directs parents trying to delete information collected about their child to the voice recording deletion page and fails to disclose that deleting voice recordings does not delete the underlying information. This is a material omission likely to mislead reasonable parents.
6. Amazon does not give notice or obtain parental consent before recording the voices of children that do not live in the home (visiting friends, family, etc.) with the owner of the device.
7. Amazon's direct notice does not satisfy COPPA's requirements as it is missing key pieces of information. Its online notice is also unsatisfactory as it includes so much confusing and unrelated information that a parent would be unable to decipher what applied to Echo Dot Kids Edition.
8. Amazon does not disclose which kid skills (developed by 3rd parties) collect child personal information or what they collect. It tells parents to read the privacy policy of each kid skill (impermissible under COPPA). 84.6% of kid skills do not provide privacy policies.

The groups also released a video that shows a test of the device's "remember" feature. As IPR put it, "Amazon forgot to teach Alexa how to 'forget.'"

"Amazon markets Echo Dot Kids as a device to educate and entertain kids, but the real purpose is to amass a treasure trove of sensitive data that it refuses to relinquish even when directed to by parents," said CCFC executive director Josh Golin. "The FTC must hold Amazon accountable for blatantly violating children's privacy law and putting kids at risk."

Sens. Ed Markey (D-Mass.), Richard Blumenthal (D-Conn.), Dick Durbin (D-Ill.), and Josh Hawley (R-Mo.) submitted a letter to FTC Commissioner Christine Wilson Thursday, also calling for a federal investigation of the Amazon device.

"We urge the commission to take all necessary steps to ensure their privacy as 'Internet of Things' devices targeting young consumers come to market," the lawmakers wrote, "including promptly initiating an investigation in the Amazon Echo Dot Edition's compliance with COPPA."