Amazon barreled into the children’s smart-speaker market last year with a brightly colored device called Echo Dot Kids Edition. The tech giant played up the device as a simple way for youngsters to converse with Alexa, the company’s voice-activated virtual assistant, and obtain age-appropriate apps.
But recent research commissioned by two prominent advocacy groups found that the device also enabled children to easily divulge their names, home addresses, Social Security numbers and other intimate information to Alexa. In addition, the researchers reported that Amazon made it cumbersome for parents to delete their child’s personal details from the system.
On Thursday, the two groups — the Campaign for a Commercial-Free Childhood and the Center for Digital Democracy — joined more than a dozen others in lodging a complaint with the Federal Trade Commission. The groups say that Amazon’s practices violated the Children’s Online Privacy Protection Act, a federal law protecting the personal information of people under 13.
Among other things, the complaint said that Amazon had failed to obtain verified consent from parents before collecting their children’s voice recordings and had kept such records unnecessarily after extracting the data to respond to children. The groups also complained that Amazon had not sufficiently disclosed how it collected and used children’s data.
“It seems pretty clear from our findings that the only control that parents really have is not purchasing this device,” Josh Golin, executive director of the Campaign for a Commercial-Free Childhood, said in an interview. “Once they purchase it, they are essentially ceding control of their children’s data — which could be really sensitive when you’re talking about a voice-activated device that lives in a home — to Amazon.”
Amazon said in a statement that the device and a related subscription service for children, called FreeTime Unlimited, “are compliant with the Children’s Online Privacy Protection Act.” The company added that its site provided information about Alexa-related privacy practices. Before children’s services can be used on Alexa, a user must consent and provide a credit-card number or a code number sent by Amazon via text message.
Amazon is seeking to capture children’s attention at a time of heightened public concern over the data-mining of youngsters.
The children’s online privacy law requires digital services aimed at those under 13 to obtain a parent’s verifiable permission before collecting their child’s name, home address, precise location, phone number, video, voice recording and other personal information.
Over the last year, however, state and federal regulators have charged numerous tech giants and start-ups with failing to comply with that law. An investigation by The New York Times last year found that app stores had allowed children’s services to track youngsters’ locations without their parents’ permission.
Because many parents, advocacy groups and regulators consider voice recordings to be among the most sensitive types of children’s data, Amazon’s Echo Dot Kids device has found itself under particular scrutiny.
This gadget records children’s voice commands and uses artificial intelligence to respond. Children can ask the system to play music, answer questions, tell jokes or remember information they tell it. The device also comes with a subscription to an Amazon service that gives children access to thousands of apps while enabling their parents to manage screen time.
But the advocacy groups say that the device failed to comply with provisions in the privacy law requiring digital services for children to provide parents with clear explanations of their data practices and to delete a child’s information as soon as it is no longer needed to fulfill the service for which it was collected.
In particular, researchers tested the device last month by having a child ask Alexa to remember a made-up phone number, Social Security number, home address and phrases like “I am allergic to peanuts.”
After the testers used parental controls to delete the voice recordings, they found that Alexa still remembered and was able to repeat the personal information included in the recordings. In order to delete the underlying data, researchers had to contact Amazon customer service and ask to have the child’s entire profile deleted.
In a response to questions about the device last year from concerned members of Congress, an Amazon executive said that the company kept a child’s voice recordings indefinitely by default, saying they were “retained for the parent’s review until the parent deletes them.”
Amazon also retained the recordings to improve its services, such as training its speech recognition system to better understand children’s requests, the executive said.