Nineteen privacy advocacy organizations have filed a complaint with the Federal Trade Commission, urging the agency to investigate whether Amazon has violated the Children's Online Privacy Protection Act (COPPA) with the kids edition of its Echo Dot smart speaker.

The organizations, which include the Campaign for a Commercial-Free Childhood (CFCC), the Center for Digital Democracy (CDD), Public Citizen, and U.S. PIRG, say the colorful smart speaker can record and collect "vast amounts of sensitive, personal information from children under 13 [years old]" without the level of parental consent required by law.

The privacy protection act allows companies to verify parental consent by having an adult enter a credit card number and a CCV security code. The complaint says that Amazon's method for acquiring consent falls outside the rules, because it allows a user to enter numbers from gift cards instead. That could make it more likely for a child to enter personal data without a parent's permission, the complaint says.

Working with researchers at Georgetown University, the groups also discovered that once a child tells the Echo Dot Kids Edition to remember certain personal details, parents are unable to delete the information using the FreeTime feature on Amazon Alexa mobile app, which is designed to control the device. Consumer Reports confirmed this problem using our own Amazon Echo Dot Kids Edition.

But we found that if we entered the same information into a regular Echo Dot speaker, we could delete it using the app (details below).

Consumer Reports notified Amazon of this finding; several hours later a spokesperson responded by email, "There is a bug in the Remember This feature for FreeTime on Alexa, and we are working on a fix that should start rolling out soon.”

More about smart speakers

Consumer advocates say that parental consent remains a concern. "If Amazon wants to store sensitive information, such as voice recordings of kids and transcripts of those recordings, they need to ensure that their disclosures to parents are sufficient and that they have obtained verifiable parental consent under COPPA," says Katie McInnis, policy counsel with Consumer Reports. "In this case, it seems that Amazon has failed to provide such notice and properly verify parental consent, and could be subject to FTC enforcement."

“FreeTime on Alexa and Echo Dot Kids Edition are compliant with the Children’s Online Privacy Protection Act (COPPA)," an Amazon spokesperson emailed Consumer Reports, while directing customers to a page outlining the company's privacy practices.

The complaint also alleges that Amazon fails to give notice and obtain consent for information collected by third parties. Of the 2,077 apps—known as "skills" in Amazon parlance—available for the Echo Dot Kids Edition, 1,758 (or 86.4 percent) don't provide any privacy policy, the complaint says.

And the privacy policies of those that do are often "confusing or contained irrelevant information," according to a press release that accompanied the complaint.

"If you had a most incredibly motivated parent, who was determined to get to the bottom of what was being collected before consenting, I'm not sure that they could get to the bottom of what's being done with the data," says Josh Golin, executive director of the CCFC.

The organizations say they used a feature called Remember This, which allows a child to give the device personal information, anything from a dog's name to a phone number, the code for the garage door opener, or a best friend's name. The researchers then followed Amazon's directions for deleting each piece of information using the FreeTime feature in the Amazon Alexa app, which is meant for controlling the Echo Dot Kids Edition. When they checked later, the device had retained the information.

Consumer Reports replicated these results. We asked the Echo Dot Kids Edition to remember a birthday, the color of a dog (blue) and a name, then used the appropriate FreeTime menu in the Amazon Alexa app to delete the information. Then we asked the Dot to tell us what it remembered, and found that all of the information had been retained.

But we got different results with the adult version of the product. When we did the same experiment with a regular Echo Dot and standard menus in the Alexa app, we were able to delete the information.

"We were shocked to discover that even if you take the time to listen to these recordings of your child and delete the ones you don't want Amazon to have, Amazon retains that information in those recordings anyway," says Golin. "That seems fundamentally unfair to parents, but also clearly a violation of a parent's right to delete."

A bipartisan group of senators, Ed Markey (D-Mass.), Richard Blumenthal (D-Conn.), Dick Durbin (D-Ill.), and Josh Hawley (R-Mo.), wrote a letter to the FTC urging the agency to invesigate Amazon's potential COPPA violations.

Hawley and Markey, who was an author of COPPA, introduced a bill in March that would update the law by expanding its protections to 15-year-olds and mandate an "eraser button" that would allow parents to delete information collected about their children.

Protecting Your Privacy From Smart Speakers

How much is your smart speaker listening to you? On the "Consumer 101" TV show, Consumer Reports expert Bree Fowler explains to host Jack Rico how you can protect your digital privacy. 

Editor's Note: The article has been updated with additional information from Amazon.