Why the FTC’s Child Privacy Push Cost Amazon, Microsoft Millions

With recent privacy-focused investigations, government regulators are looking to send Big Tech a message — and it’s landing in Seattle’s tech-fueled backyard.

Since May, the Federal Trade Commission has announced multimillion-dollar settlements with two of the Seattle area’s largest employers: Amazon and Microsoft. The FTC accused both companies of failing to protect the data of consumers, including users under the age of 13.

Both companies said they had already made changes to protect consumers’ digital information, but still agreed to pay millions to settle the cases. Amazon, which was involved in two settlements, denies violating the law in either case.

The FTC probe involves Meta and other tech giants like Google and could signal a new era in how governments view technology that has become commonplace in consumers’ homes.

Until now, since companies like Amazon and Microsoft have introduced tools that rely on emerging technologies, the companies have been allowed to more or less regulate themselves, under the principle that technology changes too quickly for regulators. That could change as the FTC takes a closer look at the technology that’s operating everything from Xbox to Alexa.

The change comes under the direction of Leena Khan, who takes over as the chair of the FTC in 2021. Khan has outlined an agenda focused on children’s privacy online, which also includes stricter enforcement of long-standing laws.

The recent settlement process shows that the FTC may be starting to wade into the “weeds” of compliance, said Kobun Zweifel-Keegan, managing director of the International Association for Privacy Professionals, a nonprofit that provides organizations with risk management and security solutions. Provides resources to help with security. their data.

“The FTC recognizes that as technology develops and consumer expectations change, business practices must keep up,” Zweifel-Keegan said. “They use these types of enforcements as a way to help explain what not to do. … The FTC is trying to send a message.”

Privacy & Consumer

For most consumers, privacy isn’t top of mind when they’re asking Alexa for the weather or logging in on Xbox. Norman Sadeh, a professor in the computer science department at Carnegie Mellon University, said that privacy is usually a “secondary task”.

Said Sadeh, when consumers focus more on the primary task (having fun playing games) than the secondary task (protecting their data), they overlook longer-term consequences such as privacy.

On the other hand, companies cannot make privacy a secondary task, Sadeh said. This should be factored into the design of the technology, partly because it’s really hard to ask for consumers’ consent once a company starts collecting their data.

“You think about privacy from the very earliest stages of the process, and if you don’t, you’re going to shoot yourself in the foot,” Sadeh said. “Privacy is one of those virtues you can’t slap on the end.”

In the most recent of cases, the FTC accused Amazon of violating security around children’s data it collected through the Alexa voice assistant and other technology targeting children. The FTC found that Amazon stored data longer than necessary and failed to delete the information after it was requested.

The FTC also alleged that Amazon failed to remove customers’ geolocation data from the Alexa app when consumers requested it to do so and that between August 2018 and September 2019, the company’s more than 30,000 employees were denied access to user data from Alexa devices. Gave the permission to.

Amazon said it refutes the FTC’s claims. “We take our responsibilities to our customers and their families very seriously,” the company wrote in a blog. “We have consistently taken steps to protect customer privacy by providing clear privacy disclosures and customer controls, ongoing audits and process improvements, and maintaining strict internal controls to protect customer data.”

Customers can view, listen to, and delete voice recordings and transcripts at any time, Amazon said. They can also choose to avoid saving any recordings or transcripts or to automatically delete them on an ongoing basis.

Amazon said in the post that it saves voice recordings for children — unless parents choose to delete them — to improve Amazon’s own services and to let parents see how their child is using the device. how to use

Later this year, Amazon plans to remove profiles of children who have been inactive for more than 18 months.

In a separate allegation, the FTC accused home security camera company Ring, which was acquired by Amazon in 2018, of failing to protect consumers’ data. Some of the events that prompted the FTC’s findings occurred after Amazon acquired the company, the agency noted in some of its 2020 findings.

The FTC found that Ring allowed all employees and third-party contractors to access customers’ video data. The FTC alleged that this enabled an employee to watch the video from inside the women’s bedroom. The commission also found that Ring failed to provide security for consumer data, which led to more than 55,000 online attacks on Ring customers between January 2019 and March 2020. In some cases, hackers will use the two-way communication function of a security system to make threats. People inside their house.

Ring said in a blog post that the FTC complaint focuses on matters that the company “promptly addressed on its own,” “misrepresents our security practices; and undermines the many protections we have in place for our customers.” Ignores.”

The company said it has policies and controls in place to restrict employees’ access to stored video of customers.

Days after the Amazon settlement, Microsoft agreed to pay $20 million to settle a claim by the FTC that the company illegally collected data from children who signed up to use its Xbox gaming system. . The company required anyone using the Xbox Live service to register with name, email address, and age information. According to the FTC, Microsoft continued to collect and retain data even when it knew about users under the age of 13.

Microsoft attributed this to a “technical glitch” where its systems did not remove account creation data for children, going against its policy of only saving that information for 14 days. The company now plans to test new ways to verify a consumer’s age.

In a blog post, Dave McCarthy, corporate vice president of Xbox Player Services, said Microsoft is “innovating on the next generation of identity and age verification – a convenient, secure, one-time process for all players that allows us to deliver customized, secure age-appropriate experience.”

“The long-term benefits will be felt by all players, especially children and their families,” he added.

kids and technology

Since 1998, when Congress passed the Children’s Online Privacy Protection Act, or COPPA, lawmakers have been regulating how to keep kids safe online. That law, which went into effect in 2000, prohibits companies from the “unauthorized and unnecessary” online collection of children’s personal information.

The FTC cited COPPA violations in two recent agreements with Amazon and Microsoft.

“Kids deserve private places to play,” said Leah Plunkett, Harvard Law School faculty member and author of “Sharenthood: Why We Should Think Before We Talk About Our Kids Online.”

Plunkett said that in addition to simply playing video games safely, children need to be able to experiment without being monitored by a company that could expose them to dangers or make predictions about them. can be used that will change their future.

Justin Brookman, director of technology policy at Consumer Reports, said although COPPA has been in place for more than 20 years, interest in protecting children’s digital security has grown in the past year. He blamed the change on former Facebook employee whistleblower Frances Haugen, who alleged that the company prioritized profits over security on its social platform.

With the most recent settlement, Microsoft and Amazon are among the dozens of companies penalized by the FTC for collecting data on children without parental consent. Meta’s Facebook, Alphabet’s Google and ByteDance’s TikTok have also faced FTC investigations.

Brookman said COPPA gives the FTC the authority to act swiftly if other violations are found. Under COPPA’s authority, the FTC only needs to prove a fault before issuing a fine.

Now, two US senators—Democrat Edward Markey of Massachusetts and Republican Bill Cassidy of Louisiana—have introduced COPPA 2.0 to update online privacy rules. It would ban advertising targeted to children and teens, create an eraser button to delete personal information, and limit the collection of teens’ personal information.

“I don’t think the backlash against tech companies is going to end anytime soon,” Brookman said.

Companies are starting to notice and make changes, he said. “It’s changing the calculus of a lot of companies,” Brookman said.

‘move the needle’

The FTC puts the onus on platform providers to keep children safe online, said Zweifel-Keegan of the International Association of Privacy Professionals.

When a company asks a user to verify their age, they do so to ensure that the user is seeing the correct version of their product. But since it’s easier for people to lie and get away with “age-gating,” companies are trying to discourage kids from pretending their age, Zweifel-Keegan said.

He said that both Microsoft and Amazon already have standards for children’s data, but the FTC found loopholes in compliance. For Amazon, he said, it may be unclear whether the company had to delete both the audio file and the written transcript of the conversation with Alexa.

“Some of the allegations in these cases are moving the needle a little bit on regulatory expectations,” Zweifel-Keegan said.

As privacy concerns grow and technology evolves, Zweifel-Keegan expects to see more thorny enforcement actions. He pointed to three big fronts: biometric data, reproductive health information, and anything related to AI.

Sadeh, a professor at Carnegie Mellon University, expects AI to take center stage. The current regulatory environment reminds him of the 1990s, when the Internet was first coming online. At that time, technology was changing so rapidly that the rules and regulations could not keep up. Sadeh said government regulators essentially threw up their hands and left it to the tech companies. This went on for some time before they reconsidered.

Now, Sadeh predicts a similar approach to regulating AI. But, he added, “historically, the industry doesn’t have a good track record.”

(c) 2023 The Seattle Times
Distributed by Tribune Content Agency, LLC.