On May 9, 2019, a coalition of consumer groups submitted a complaint to the Federal Trade Commission (“FTC”) regarding Amazon’s Echo Dot Kids Edition, arguing that the device runs afoul of the Children’s Online Privacy Protection Act (“COPPA”). The Echo Dot Kids Edition is a child-focused version of Amazon’s popular voice-activated smart speaker device that utilizes Amazon’s Alexa digital assistant.
The complaint alleges a host of COPPA violations, such as:
(1) insufficient privacy notices, which do not provide parents the opportunity to give informed consent for the device to collect their child’s personal information;
(2) an insufficiently stringent parental verification process is; and
(3) inadequate options for deletion of personal information collected by the device.
Some of the complaint’s underlying legal theories may push the FTC to clarify existing COPPA guidance for the Internet of Things. For example, the complaint argues that Amazon’s parental verification method – which involves inputting a credit or debit card number, expiration date, billing address, and security code – does not meet COPPA’s requirement that it be “reasonably calculated, in light of available technology, to ensure that the person providing consent is the child’s parent,” as set forth in 16 CFR 312.5(b). The complaint points to 16 CFR § 312.5(b)(1)(ii), which states that “use [of] a credit card, debit card, or similar payment system” suffices as parental consent in combination with “a financial transaction,” and argues that Amazon collects the information but does not conduct a financial transaction.
The FTC’s previous statements do not go as far as the complaining parties would like. Back in 2015, the FTC issued guidance that said payment card information may suffice as parental consent if used “in conjunction with implementing other safeguards,” even if not used “in connection with a monetary transaction.” Whether the FTC will determine that Amazon’s method contains sufficient “other safeguards” to satisfy COPPA is an open question. The FTC’s decision has substantial ramifications for devices within the Internet of Things (many of which collect financial information but do not conduct financial transactions as part of parental verification).
The consumer groups were joined by a contemporaneous letter to the FTC from Senators Edward Markey (D-MA), Richard Blumenthal (D-CT), Josh Hawley (R-MO), and Richard Durbin (D-IL), urging the FTC to investigate the Echo Dot Kids Edition. The letter reflects increasing bipartisan concern regarding data collection by online marketplace firms like Amazon and suggests increased pressure on the FTC to provide additional guidance on not only child-focused devices, but all voice-activated devices.