Amazon agreed on Wednesday to pay more than $30 million to settle allegations by the Federal Trade Commission that the company’s Ring and Alexa divisions violated customers’ privacy by enabling illegal surveillance by employees and hackers.
The FTC filed a complaint accusing Amazon’s Ring video doorbell unit of violating the FTC Act, which prohibits unfair or deceptive business practices. According to the complaint, Ring ― which marketed itself as a home security camera ― deceived its customers by allowing employees and contractors to access customers’ videos without consent.
According to the FTC’s complaint, one Ring employee viewed thousands of videos from over 80 different female users from cameras labeled for use in intimate spaces like bedrooms and bathrooms. The employee looked through the videos for at least an hour a day on hundreds of occasions between June and August 2017, and was not reprimanded until another employee discovered the behavior, the agency claimed.
The FTC said that bad actors also used Ring cameras’ two-way functionality to harass and threaten customers, including elderly individuals and children, whose rooms were monitored by Ring cameras. Hackers “taunted several children with racist slurs, sexually propositioned individuals, and threatened a family with physical harm if they didn’t pay a ransom,” the agency said.
“Importantly, because Ring failed to implement basic measures to monitor and detect inappropriate access before February 2019, Ring has no idea how many instances of inappropriate access to customers’ sensitive video data actually occurred,” the complaint stated.
Ring operates as a subsidiary of Amazon after the tech giant acquired it in 2018. Amazon agreed to pay $5.8 million to settle the Ring complaint, and will be required to delete data from videos it unlawfully reviewed. Ring will also need to implement a new privacy and security program that includes multifactor authentication for both employee and customer accounts.
“Ring’s disregard for privacy and security exposed consumers to spying and harassment,” Samuel Levine, director of the FTC’s Bureau of Consumer Protection, said in a statement. “The FTC’s order makes clear that putting profit over privacy doesn’t pay.”
Separately, Amazon agreed to pay a $25 million settlement after the FTC accused the company of violating the FTC Act and the Children’s Online Privacy Protection Act by illegally keeping voice and geolocation information associated with children for years while preventing parents from using their rights to delete their kids’ data.
As part of the Alexa settlement, Amazon will have to delete inactive child accounts, certain voice recordings and geolocation information, and will be banned from using such data to train its algorithms or improve its products.
Both settlements however, must first be approved by a court to take effect due to a 2021 Supreme Court ruling that limited the scope of the kinds of monetary relief the FTC can impose.
“While we disagree with the FTC’s claims regarding both Alexa and Ring, and deny violating the law, these settlements put these matters behind us,” Amazon told The Wall Street Journal in a statement. “As part of the settlement, we agreed to make a small modification to our already strong practices, and will remove child profiles that have been inactive for more than 18 months unless a parent or guardian chooses to keep them.”