Amazon.com Inc. agreed to pay $30.8 million to resolve two cases brought by the Federal Trade Commission Wednesday related to privacy lapses by its smart devices.
In one case, the FTC alleged that Amazon didn’t take steps to protect the privacy of users of its Ring video doorbell. The company will pay $5.8 million to settle the complaint filed in federal court in Washington, DC.
In the second case, filed in Washington state federal court on behalf of the FTC, the Justice Department said Amazon’s Alexa-powered speakers collected information about children under the age of 13 without parental consent in violation of the Children’s Online Privacy Protection Act. Amazon will pay $25 million as part of that settlement.
In a statement, Amazon said it disagreed with the FTC’s claims and denies violating the law in either case. “Ring promptly addressed these issues on its own years ago, well before the FTC began its inquiry,” the company said. On Alexa, the company consulted with the FTC to ensure its program complied with children’s privacy laws but agreed to a change that will delete kids’ profiles if they have been inactive for 18 months.
The settlements mark the FTC’s first actions against Amazon since Chair Lina Khan took over the agency in 2021. Khan has long had Amazon in her sights, writing a seminal paper as a law student about how to rethink the antitrust laws in connection with the online commerce platform.
The FTC, which has been investigating Amazon since 2019, is finalizing an antitrust lawsuit against Amazon over the company’s control over its online marketplace. The agency opened a separate investigation into Amazon Prime in 2021 focused on whether the service violates consumer protection laws by making it difficult for customers to cancel.
The Ring video doorbell, introduced in 2014, is an internet-connected device allowing users to remotely view their doorstep. Amazon bought the company in 2018 for about $1 billion.
After its 2018 acquisition, Ring’s video-connected doorbells and cameras immediately became a centerpiece of Amazon’s growing suite of home electronics, built around the Echo smart speaker and Alexa digital assistant. The company has expanded its domain to home and business security systems, smart lighting, a car dashboard-mounted camera and a yet-to-be-released flying home drone.
Amazon also sells a kids-focused edition of its Echo smart speaker and offers a subscription service that opens up a curated selection of apps, books and other content. While the company said its Echo Dot Kids Edition and FreeTime, since rebranded Kids+, complied with the federal children’s privacy law, a group of advocacy organizations had asked the FTC to investigate whether Amazon’s smart speakers violated children’s privacy rights.
Read More: Amazon’s Echo for Kids Violated Privacy Law, Advocacy Groups Say
The FTC said in its complaint that until 2017 “Ring gave every employee — as well as hundreds of Ukraine-based third-party contractors — full access to every customer video, regardless of whether the employee or contractor actually needed that access to perform his or her job function.”
‘Master Bedroom’
One Ring employee in 2017 viewed thousands of videos belonging to at least 81 women users of Ring Stick Up Cams, focusing his searches on camera names including “Master Bedroom,” “Master Bathroom” or “Spy Cam,” the FTC alleges in the complaint.
The FTC alleged that Amazon didn’t do enough to address the problems after buying the company, with data security issues continuing until 2020.
The company also didn’t take sufficient steps to protect customer accounts, leading hackers to access at least 1,250 devices in the US, the FTC alleged.
Many of those hacked cameras involved Ring’s products designed for indoor use, allowing strangers to threaten and harass individuals and children in their homes. The FTC’s complaint detailed a number of instances where hackers sexually propositioned women, taunted or uttered racist slurs to children.
In at least 20 cases, hackers maintained access to the cameras for more than a month, the FTC said. Users whose cameras were hacked told Ring they were “terrified” after the episodes.
The company said it fired some employees in 2020 for improperly trying to access customer data and subsequently revamped its security practices, including adding encryption to its video devices.
Household digital devices like Ring can capture conversations, movements, and other information that law enforcement has sought to leverage for investigating crimes. In response, privacy and civil rights advocates have called for limits on police access to such recordings due to concerns around bias and over-policing.
Ring has vowed not to give law enforcement data on its users without a legally valid subpoena or search warrant, depending on what kind of information is being sought or whether it’s an emergency.
In March, Amazon announced that Ring founder Jamie Siminoff was stepping down and would be replaced by Elizabeth Hamren, chief operating officer at chat company Discord Inc.
--With assistance from Matt Day.
(Updates with additional details throughout.)
