SAN FRANCISCO - Amazon on Wednesday agreed to pay US$30.8 million (S$41.7 million) to settle Ring and Alexa privacy complaints filed by United States regulators, including accusations that employees spied on female customers, according to court documents.

The Federal Trade Commission (FTC) charged Amazon-owned home security camera company Ring with failing to implement basic protections to stop hackers or employees from accessing people’s devices or accounts.

It said that Ring, which Amazon acquired in 2018, had “unreasonable” data security and privacy practices from at least 2016 through January 2020.

According to the FTC complaint, Ring’s failures in security resulted in “egregious” violations of privacy, such as female users of home security cameras being “surveilled”.

In 2017, for instance, one Ring employee viewed thousands of videos belonging to dozens of female customers, including in sensitive locations such as the women’s bedrooms and bathrooms, the agency said in a legal complaint filed in US District Court for the District of Columbia.

“Ring’s disregard for privacy and security exposed consumers to spying and harassment,” the FTC bureau of consumer protection director, Mr Samuel Levine, said in a statement.

The proposed settlement order, which requires approval by a federal judge, would require Amazon to pay US$5.8 million in consumer refunds, institute stringent security measures and delete algorithms or other data products derived from the illegal viewing of consumers’ videos.

Hackers exploited vulnerabilities to not only access video streams but also to take control of cameras to taunt children, sexually proposition people, and threaten a family with harm if they did not pay a ransom, according to the FTC.

“Ring promptly addressed these issues on its own years ago, well before the FTC began its inquiry,” Ring said in response to an AFP inquiry, adding that it disagrees with the allegations.

In a separate case, Amazon agreed to pay a civil penalty of US$25 million to settle federal charges that it kept sensitive information collected from children for years, including their precise locations and voice recordings, in violation of a children’s online privacy law.

It was the latest legal action in an intensifying regulatory effort to require some of the world’s largest tech platforms to better safeguard their younger users.

The case, brought by the FTC and the Justice Department, centres on Amazon’s handling of the personal details it collected from children who conversed with Alexa, the company’s voice-activated virtual assistant.

In a legal complaint filed in US District Court for the Western District of Washington, regulators said the tech giant had kept young people’s Alexa voice recordings indefinitely and used the data for business purposes like training its algorithm to understand children, violating the federal Children’s Online Privacy Protection Act.

That law, known as Coppa, requires online services aimed at people younger than 13 to obtain parental consent before collecting a child’s personal details and to allow parents to have their children’s data deleted.

But even after parents sought to delete their children’s voice recordings, Amazon failed to delete transcripts of the children’s conversations with Alexa from all its databases, regulators said.

“Amazon’s history of misleading parents, keeping children’s recordings indefinitely, and flouting parents’ deletion requests violated” the children’s online privacy law and “sacrificed privacy for profits”, Mr Levine said in a statement.

“Coppa does not allow companies to keep children’s data forever for any reason, and certainly not to train their algorithms.”

The complaint also charged Amazon with deceiving consumers, including parents, by repeatedly assuring users they could delete data, like their Alexa voice recordings, yet failed to adequately honour users’ deletion requests.

​Though it agreed to settle the charges, Amazon said it disagreed with the FTC’s claims and denied violating the children’s law.

“We built Alexa with strong privacy protections and customer controls,” the company said in a statement.

The statement added that the company had designed Amazon Kids, a service that enables parents to manage games, books and other content for their children, to comply with the children’s online privacy law, and that Amazon had worked with the FTC before expanding the children’s content service to include Alexa.​

Under the terms of the proposed settlement agreement, Amazon would be required to delete children’s voice recordings and precise location data, as well as inactive Alexa accounts belonging to children.

The proposed agreement also prohibits Amazon from misrepresenting how it handles users’ voice recordings, precise location data and children’s data.

A federal court must approve the settlement order.

The Amazon case comes at a moment of heightened public concern over how some prominent social networks, video game services and device makers treat their younger users.

It highlights intensifying efforts by the FTC to force large tech platforms to bolster protections for sensitive information, like precise location or personal health details, whose disclosure could pose privacy or physical risks to adult consumers and children.

In December, Epic Games, the maker of Fortnite, agreed to pay US$520 million to settle accusations by the FTC that it had illegally harvested data from players younger than 13 and, separately, steered millions of users to make unwanted payments.

In 2019, Google agreed to pay a US$170 million penalty to settle charges from the FTC and the Attorney-General of New York that it had violated children’s privacy on YouTube.

The intensifying regulatory push to protect children online is not limited to the US.

Last September, Irish regulators announced they would levy a fine of about US$400 million against Meta for its handling of children’s information on Instagram. Meta said it disagreed and planned to appeal. AFP, NYTIMES