This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
The FTC and DOJ charged Amazon with violating the Children's Online Privacy Protection Act (COPPA) by indefinitely retaining children's voice recordings and transcripts from its Alexa voice assistant. Amazon used this data to train its voice recognition algorithms without obtaining proper parental consent or honoring deletion requests. As part of a settlement, Amazon agreed to pay a $25 million civil penalty and is required to delete inactive child accounts and the unlawfully retained data.
Amazon's retention of children' voice recordings indefinitely as the default setting reportedly to train Alexa's voice recognition for Alexa-enabled devices was charged by the FTC and DOJ to violate COPPA Rule.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Amazon compromised children's privacy by indefinitely retaining their sensitive voice recordings and geolocation data without parental consent to train its algorithms.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The privacy risk was caused by human decisions at Amazon to intentionally retain children's voice recordings post-deployment to train their algorithms.
Amazon settled charges with the FTC and DOJ for 25 million dollars over COPPA violations involving the unlawful retention of children's voice data to train Alexa. While constituting a significant consumer privacy violation, the incident is a domestic corporate compliance issue with negligible implications for national security.
The report characterizes Alexa as a 'voice-activated virtual assistant' and a 'voice assistant service' designed to respond to voice commands and assist users.
Limited Risk: The Alexa system is a voice assistant and chatbot, which falls under the category of AI systems requiring specific transparency obligations to ensure users are aware they are interacting with an AI.
Alexa is explicitly described as a voice-activated virtual assistant, and the data was retained specifically to train its voice recognition algorithms to understand children's speech.
The reports from multiple reputable sources provide consistent and clear details about the regulatory action, the specific AI system involved (Alexa), the nature of the privacy violations, and the financial settlement terms.
None. The facts of the COPPA violation and the settlement are clear and uncontested in the reporting.
Technology
Speech recognition training needs
Amazon needed children's voices to train Alexa's speech recognition.
Persistent database storage
System kept voice transcripts in databases even after deletion requests.
Data Inputs
Unlawful retention of voice data
Indefinite retention of sensitive voice recordings of children under 13.
Geolocation data retention
Geolocation data was collected and retained unnecessarily.
Human Factors
Misleading assurances to parents
Parents were falsely assured they could delete children's data easily.
Parental deletion requests ignored
Parents requested deletion but the system failed to fully execute it.
Process and Methods
Flawed data deletion system
Amazon lacked an effective system to honor data deletion requests.
Inadequate deletion verification
No process to check if transcripts were deleted from all databases.
Management
Prioritizing profits over privacy
Retained data to improve algorithms and bottom line at expense of privacy.
Failure to fix known deletion errors
Management failed to fix geolocation deletion issues after discovery.
Regulatory Environment
COPPA Rule violations
Retaining children's data longer than necessary violates federal law.
Intense competition in AI market
Pressure to build AI datasets led to ignoring privacy regulations.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
