Echo Dot Kids Edition Violates COPPA

We urge the FTC to investigate Amazon's violations of the Children's Online Privacy Protection Act (COPPA) for the safety and privacy of American children.

The Problems

Reviewing Information is Burdensome

Amazon's process for reviewing personal information places undue burden on parents. It does not allow parents to search through information collected, instead requiring them to read or listen to every voice recording of their child's interaction with the device.

No Verifiable Parental Consent

Amazon’s parental consent mechanism does not provide assurance that the person giving consent is the parent of the child. Among other issues, it can be bypassed by a kid with a disposable debit gift card.

Keeping Child Personal Info Forever

Amazon keeps children’s personal information longer than reasonably necessary. It only deletes information if a parent explicitly requests deletion by contacting customer service, otherwise it is retained forever.

Third Party Mystery

Amazon does not disclose which kid skills (developed by 3rd parties) collect child personal information or what they collect. It tells parents to read the privacy policy of each kid skill (impermissible under COPPA). 84.6% of kid skills do not provide privacy policies.

Inadequate Notice

Amazon’s direct notice does not satisfy COPPA's requirements as it is missing key pieces of information. Its online notice is also unsatisfactory as it includes so much confusing and unrelated information that a parent would be unable to decipher what applied to Echo Dot Kids Edition.

The Playdate Problem

Amazon does not give notice or obtain parental consent before recording the voices of children that do not live in the home (visiting friends, family, etc.) with the owner of the device. They advertise having the technology to create voice profiles for customized user experiences but fail to use it to stop information collection from unrecognized children.

Misleading Deletion Representations

Amazon's website and literature directs parents trying to delete information collected about their child to the voice recording deletion page and fails to disclose that deleting voice recordings does not delete the underlying information. This is a material omission likely to mislead reasonable parents.

"Remember" Feature Does Not Allow Parents to Delete Information

Play Video

Kid Skills Privacy Policy Analysis

84.6% of Kid Skills do not provide privacy policies.

We wrote software to open the listing pages of all of the kid skills available on Echo Dot Kids Edition and check for the presence of a privacy policy. At the time of testing, 1,758 of the 2,077 available kid skills did not provide privacy policies. Of the 319 kid skills that provided privacy policies, many were confusing or contained irrelevant information. This is particularly egregious because Amazon instructs parents to consult the privacy policies of kid skills to determine what information will be collected about/from their children. Amazon's attempt to place the burden on parents is impermissible under the Children's Online Privacy Protection Act. This is made worse by the shocking lack of privacy policies. In the system Amazon has created, even the most diligent parent would be unable to determine what information a kid skill was going to collect about/from their child in the majority of cases.

We have chosen to make available the lists of URLs of skills that are missing privacy policies and the stills that provide them. We are providing links to archived copies of each page so the pages will look exactly how they did when we performed our tests. We encourage others to perform additional tests.

Read the FTC Complaint

This complaint was prepared by the Institute of Public Representation at Georgetown Law on behalf of Campaign for a Commercial-Free Childhood. Sign up here to stay up-to-date on this and other CCFC campaigns.

Thank you to The Rose Foundation for Communities and the Environment, whose generous support made this project possible.