Amazon Echo Dot Kids Violates Privacy Rules, Advocates Claim
Several groups filed a complaint with the FTC. Amazon says one of the problems is a software bug that will be fixed.
Nineteen privacy advocacy organizations have filed a complaint with the Federal Trade Commission, urging the agency to investigate whether Amazon has violated the Children's Online Privacy Protection Act (COPPA) with the kids edition of its Echo Dot smart speaker.
The organizations, which include the Campaign for a Commercial-Free Childhood (CFCC), the Center for Digital Democracy (CDD), Public Citizen, and U.S. PIRG, say the colorful smart speaker can record and collect "vast amounts of sensitive, personal information from children under 13 [years old]" without the level of parental consent required by law.
The privacy protection act allows companies to verify parental consent by having an adult enter a credit card number and a CCV security code. The complaint says that Amazon's method for acquiring consent falls outside the rules, because it allows a user to enter numbers from gift cards instead. That could make it more likely for a child to enter personal data without a parent's permission, the complaint says.
Working with researchers at Georgetown University, the groups also discovered that once a child tells the Echo Dot Kids Edition to remember certain personal details, parents are unable to delete the information using the FreeTime feature on Amazon Alexa mobile app, which is designed to control the device. Consumer Reports confirmed this problem using our own Amazon Echo Dot Kids Edition.
But we found that if we entered the same information into a regular Echo Dot speaker, we could delete it using the app (details below).
Consumer Reports notified Amazon of this finding; several hours later a spokesperson responded by email, "There is a bug in the Remember This feature for FreeTime on Alexa, and we are working on a fix that should start rolling out soon.”
And the privacy policies of those that do are often "confusing or contained irrelevant information," according to a press release that accompanied the complaint.
"If you had a most incredibly motivated parent, who was determined to get to the bottom of what was being collected before consenting, I'm not sure that they could get to the bottom of what's being done with the data," says Josh Golin, executive director of the CCFC.
The organizations say they used a feature called Remember This, which allows a child to give the device personal information, anything from a dog's name to a phone number, the code for the garage door opener, or a best friend's name. The researchers then followed Amazon's directions for deleting each piece of information using the FreeTime feature in the Amazon Alexa app, which is meant for controlling the Echo Dot Kids Edition. When they checked later, the device had retained the information.
Consumer Reports replicated these results. We asked the Echo Dot Kids Edition to remember a birthday, the color of a dog (blue) and a name, then used the appropriate FreeTime menu in the Amazon Alexa app to delete the information. Then we asked the Dot to tell us what it remembered, and found that all of the information had been retained.
But we got different results with the adult version of the product. When we did the same experiment with a regular Echo Dot and standard menus in the Alexa app, we were able to delete the information.
"We were shocked to discover that even if you take the time to listen to these recordings of your child and delete the ones you don't want Amazon to have, Amazon retains that information in those recordings anyway," says Golin. "That seems fundamentally unfair to parents, but also clearly a violation of a parent's right to delete."
A bipartisan group of senators, Ed Markey (D-Mass.), Richard Blumenthal (D-Conn.), Dick Durbin (D-Ill.), and Josh Hawley (R-Mo.), wrote a letter to the FTC urging the agency to invesigate Amazon's potential COPPA violations.
Hawley and Markey, who was an author of COPPA, introduced a bill in March that would update the law by expanding its protections to 15-year-olds and mandate an "eraser button" that would allow parents to delete information collected about their children.
Protecting Your Privacy From Smart Speakers
How much is your smart speaker listening to you? On the "Consumer 101" TV show, Consumer Reports expert Bree Fowler explains to host Jack Rico how you can protect your digital privacy.
Editor's Note: The article has been updated with additional information from Amazon.