Federal Lawsuit Charges Amazon’s Alexa Violates Children’s Privacy

If Big Brother isn’t watching, maybe his little sister is listening.

An international law firm has filed a federal lawsuit against Amazon.com Inc., alleging that the company’s Alexa virtual assistant product violated privacy laws in Massachusetts and seven other states by making permanent recordings of children’s voices without their consent.

The lawsuit seeks class-action status on behalf of all persons who lived in a home with an operating Alexa device — which they didn’t set up — while a minor in Florida, Illinois, Maryland, Massachusetts, Michigan, New Hampshire, Pennsylvania and Washington. The suit names “C.O.,” described as the 10-year-old daughter of Massachusetts resident Alison Hall-O’Neil, as the lead plaintiff.

The suit says Amazon violated Massachusetts’ wiretap statute and similar laws in the other states by creating “persistent recordings” of C.O. and intentionally intercepting and using oral communications without the consent of the all parties.

Consumer organizations have also charged that Amazon is violating children’s privacy rights, in violation of federal law. The lawsuit takes another approach, citing state privacy laws.

“Amazon has strong commercial incentives to collect as many Alexa recordings as possible,” the suit says. “From the outset, Amazon has been a company built on the relentless acquisition of consumer behavioral data.”

Quinn Emanuel Urquhart & Sullivan, a law firm with an office in Seattle and other locations around the globe, filed the suit in the U.S. District Court for Western Washington. The suit asks the court to award unspecified damages and litigation costs, order Amazon to delete all recordings of the class members’ voices, and issue a declaration that Amazon violated state privacy laws.

Amazon said in a statement that it has strict measures and protocols in place to protect its customers’ privacy.

“Customers set up their Echo devices and we give them easy-to-use tools to manage them, including the ability to review and delete the voice recordings associated with their account,” a company spokeswoman said in an email. “We also offer FreeTime on Alexa, a free service that provides parental controls and ways for families to learn and have fun together.”

Amazon’s website says that Alexa records only after the device is given its wake word. A blue light indicates that the device is recording. Users can hear and delete voice recordings by using Alexa’s privacy settings. Users can also delete by voice by saying, “Alexa, delete everything I said today.”

But the lawsuit describes a deliberate effort by Amazon to record voices as a means of refining the natural language understanding of the Alexa product. Many recordings are individually reviewed by Amazon employees and part-time contractors “in locations as far flung as Costa Rica, India, and Romania,” the suit says.

If the wake word is recognized, the Alexa device records the ensuing communication and—unlike some other smart devices—transmits the recording to Amazon’s servers for interpretation and processing before receiving the relevant data back in response. Once Alexa has responded to a recording sent by an Alexa device, Amazon indefinitely stores a copy of that recording on its own servers for later use and analysis, the suit alleges.

“It takes no great leap of imagination to be concerned that Amazon is developing voiceprints for millions of children that could allow the company (and potentially governments) to track a child’s use of Alexa-enabled devices in multiple locations and match those uses with a vast level of detail about the child’s life, ranging from private questions they have asked Alexa to the products they have used in their home,” the suit says.

According to the suit, Amazon doesn’t have to make permanent recordings. Audio interactions could be processed locally on the device, which could send a digital query, rather than a voice recording, to Amazon’s servers.

The suit says Apple Inc.’s Siri product, unlike Alexa, stores recordings only for a short amount of time. Likewise, the automobile manufacturer Mercedes has developed a virtual assistant that likewise does not store recorded communications.

“The collection of Alexa Device recordings is a natural extension of Amazon’s modus operandi: collect as much consumer data as possible through any means possible, streamline the process so that consumers cannot or will not stop the collection, and use Amazon’s massive size to leverage that data more effectively than any of its competitors,” the suit says.

It’s not just plaintiff’s attorneys who have privacy concerns about virtual assistants like Alexa. The New York Times reported last week than a group of researchers at Stanford University has received a $3 million grant from the National Science Foundation to develop an voice assistant technology that will allow consumers to avoid surrendering personal information with technology companies.

“A monopoly assistant platform has access to data in all our different accounts. They will have more knowledge than Amazon, Facebook and Google combined,” the team leader, Dr. Monica Lam, told the Times in an interview.

The Stanford team is working to development an alternative technology, called Almond, which they hope to make freely available to consumers and manufacturers. The Almond virtual assistant software is decentralized so consumers can choose where their information is stored and how it is stored, the Times reported.

Several consumer advocacy organizations, led by the Campaign for a Commercial Free Childhood, have filed a complaint asking the federal Trade Commission to investigate and sanction Amazon for infringing on children’s privacy through its Echo Dot Kids Edition. The organization said the product collects sensitive personal information from children, including viewing, reading, listening and purchasing habits. The complaint says the collection of the data violates the federal Children’s Online Privacy Protection Act, or COPPA.

“Amazon markets Echo Dot Kids as a device to educate and entertain kids, but the real purpose is to amass a treasure trove of sensitive data that it refuses to relinquish even when directed to by parents,” said Josh Golin, the CCFC’s executive director. “COPPA makes clear that parents are the ones with the final say about what happens to their children’s data, not Jeff Bezos. The FTC must hold Amazon accountable for blatantly violating children’s privacy law and putting kids at risk.”