Children’s data privacy advocates filed a complaint with the Federal Trade Commission on Thursday morning, calling for the federal agency to investigate the “Kids Edition” of Amazon’s Echo Dot smart speaker.
Amazon’s smart speaker for kids reportedly stores sensitive information — even after parents delete it
The Campaign for a Commercial-Free Childhood and the Center for Digital Democracy filed a complaint with the FTC Thursday morning.
The 96-page complaint was co-authored by the Campaign for a Commercial-Free Childhood (CCFC) and the Center for Digital Democracy (CDD), and co-signed by 17 other digital privacy and children’s rights organizations.
“Amazon markets Echo Dot Kids as a device to educate and entertain kids, but the real purpose is to amass a treasure trove of sensitive data that it refuses to relinquish even when directed to by parents,” CCFC’s executive director, Josh Golin, wrote in a statement. “The FTC must hold Amazon accountable for blatantly violating children’s privacy law and putting kids at risk.”
Update: “FreeTime on Alexa and Echo Dot Kids Edition are compliant with the Children’s Online Privacy Protection Act (COPPA),” an Amazon spokesperson replied in a statement to Vox.
“Amazon markets Echo Dot Kids as a device to educate and entertain kids, but the real purpose is to amass a treasure trove of sensitive data”
Amazon launched the Echo Dot Kids Edition a year ago today, promising that parents would have control over their children’s data through the device’s FreeTime service, and offering more than 2,000 kid-specific Alexa “skills” (mostly made by third parties like Disney, Nickelodeon, and National Geographic). In addition to parental controls, FreeTime includes kid-friendly radio stations from iHeartRadio and hundreds of kid-friendly audiobooks through Audible. It’s ad-free, blocks shopping, news, and other third-party skills that involve linking to outside accounts, and initially seemed like a solid option for parents looking to provide kids with screen-free downtime and educational entertainment.
Thursday’s complaint outlines several ways in which the device isn’t so worry-free. The Children’s Online Privacy and Protection Act (COPPA) of 1996 mandates that no data be collected about children under the age of 13 unless their parents explicitly consent on their behalf. In today’s complaint, the CCFC and CDD argue that the mechanism on the Echo Dot Kids Edition that is supposed to provide this consent can be easily bypassed by a child. Their study also found that voice recordings are kept forever by default — instead of, as COPPA mandates, only so long as is necessary to complete relevant tasks — and can’t be deleted without calling Amazon customer service.
Alexa remembered a child saying their Social Security number and food allergies even after the device history was wiped
The complaint also takes issue with the fact that Amazon advertises its superior technology and ability to create customized profiles for each new voice it hears, but does not attempt to get parental consent when it hears a new child’s voice. (A problem if you’re inviting other kids over for play dates and letting them … talk.)
Most of the child-specific Alexa skills — e.g., Disney character alarm clocks — are made by third parties. And 84.6 percent of the skills (1,753 of 2,077) do not have privacy policies at all. In the first place, under COPPA, Amazon isn’t supposed to be able to direct parents to other companies’ privacy policies — it’s obligated to provide all that information in a clear way itself. So, in their view, it’s a pretty damning obfuscation.
Most glaringly, the CCFC performed a test in which it had a child tell Alexa a fake phone number, Social Security number, and food allergy, then asked an adult to delete all voice recordings and Alexa history in the Echo Dot app. Alexa still remembered the underlying information even once the transcript disappeared, and recited the supposedly removed sensitive data back to the child.
Children’s data privacy has been the subject of broader interest recently — uniting researchers and politicians around a fairly obvious common goal. England’s children’s commissioner Anne Longfield published a report in December 2018 that raised questions about all the major tech companies’ approach to children’s data.
“Collecting so much data about children raises important questions about their freedom and independence,” she wrote. “So much data from children sends the wrong message — it does not convey how valuable and sensitive personal information is and how important it is to guard it.”
The CCFC also filed an FTC complaint against Facebook in October 2018, citing COPPA violations. An open letter called Facebook “unfit to make products for children” and asked that the company voluntarily shut down its Messenger Kids product. So far, that has not happened. The FTC has yet to do much of anything with regards to alleged COPPA violations by Facebook, Amazon, or Google-owned YouTube, though it did fine TikTok a record $5.7 million for collecting data from kids under 13 in February, and Facebook is likely to pay somewhere in the billions for broader privacy violations later this year.
It’s worth noting that two days after the Echo Dot Kids’ release, the CCFC and CDD published a joint warning citing several experts — including the renowned human-computer interaction researcher and sociologist Sherry Turkle — urging parents to “steer clear.”
“Children already spend too much time immersed in digital technologies at the expense of their emotional growth — the last thing they need is their own AI assistant,” Turkle wrote. “When we encourage children to form faux-relationships with devices, we undermine their ability to form healthy relationships with people.”
Want more stories from The Goods by Vox? Sign up for our newsletter here.
Update May 9th, 3:25 PM: Updated to include statement from Amazon.
See More:
