FTC v. Amazon Alexa: COPPA Violations for Children's Voice Data in AI Training

Summary

Amazon retained children's voice recordings collected by Alexa indefinitely — even after parents requested deletion — in violation of the Children's Online Privacy Protection Act (COPPA). Amazon used the retained data to improve Alexa's AI models despite being told to delete it. A separate violation related to Ring doorbell cameras allowed employees and contractors to access private customer video footage.

Details

• Violation: COPPA violations for children's data retention + Ring privacy violations
• Penalty: $25M civil penalty for Alexa COPPA violations; $5.8M in disgorgement for Ring
• Framework: COPPA, FTC Act Section 5
• Status: Settled (May 2023)

Key Takeaways

1. Children's data used for AI training requires parental consent and deletion on request
2. Retaining data after deletion requests is a COPPA violation
3. AI model training data must comply with privacy laws
4. Employee access to private AI-collected data triggers enforcement

Injunctive Relief

Amazon was required to delete all children's data collected in violation of COPPA, prohibited from using that data for training AI, and required to implement a comprehensive children's data deletion program.