Amazon's Alexa privacy notice discloses collection of voice recordings, geolocation, and — for certain subscription features — health data, and states that this information is used to train machine-learning models. Amazon's own policy states it is "not in the business of selling" customer personal information but discloses sharing with third parties, including for advertising purposes, and its corporate structure has been named explicitly in federal litigation even though the consumer-facing privacy notice does not itemize all affiliated subsidiaries. In 2023 the FTC and DOJ reached a $25 million settlement with Amazon over allegations that Alexa retained children's voice recordings and geolocation data despite deletion requests, and a 2019 report noted a European regulator's inquiry into human review of Alexa audio.
TRACK RECORD
2 ENFORCEMENT ACTIONS
[2023-05-31]
In May 2023, the FTC and DOJ announced a $25 million civil penalty settlement with Amazon resolving allegations that Alexa retained children's voice recordings indefinitely and that Amazon undermined parents' deletion requests, in alleged violation of COPPA.
The DOJ complaint underlying the 2023 settlement alleged that Amazon prevented parents from exercising deletion rights under the COPPA Rule and used retained voice and geolocation data for its own purposes.
Amazon's state-specific privacy disclosures list categories of information collected through Alexa, including audio/visual voice recordings, geolocation, health data (via the Alexa Emergency Assist subscription), education information, and inference data about purchase preferences.
Amazon's Alexa Terms of Use state that Alexa's machine learning models are trained using a variety of data sources, including content generated from use of Amazon's services.
Amazon's privacy notice describes information sharing with subsidiaries that Amazon.com, Inc. controls, without publishing an itemized list of those subsidiaries within the notice itself.
The Department of Justice's 2023 press release on the Alexa children's-privacy settlement identifies Amazon.com, Inc. and its wholly-owned subsidiary Amazon.com Services LLC as the corporate entities involved, collectively referred to as "Amazon" in the enforcement action.
Amazon's additional state-specific privacy disclosures identify categories of third parties with whom personal information may be shared for cross-context behavioral advertising purposes under state privacy laws.
Amazon's privacy notice states that the company is not in the business of selling customers' personal information, while also disclosing that information is shared with third parties as described elsewhere in the notice.
In May 2023, the FTC and DOJ announced a $25 million civil penalty settlement with Amazon resolving allegations that Alexa retained children's voice recordings indefinitely and that Amazon undermined parents' deletion requests, in alleged violation of COPPA.
The DOJ complaint underlying the 2023 settlement alleged that Amazon prevented parents from exercising deletion rights under the COPPA Rule and used retained voice and geolocation data for its own purposes.
Reporting on Alexa's underlying voice-activation technology describes the device as continuously listening for a wake ('trigger') word before streaming audio to the cloud, with trigger-word systems shown to be prone to accidental activation.