Friday , May 9 2025

FTC fines Amazon with $25 Million for Alexa’s Violation of Children’s Privacy

Amazon has agreed to pay nearly $31 million to the Federal Trade Commission (FTC) in order to resolve allegations related to its Alexa and Ring home security businesses.

The larger portion of the settlement, amounting to $25 million, will address accusations that Amazon violated the US Children’s Online Privacy Protection Act Rule (COPPA Rule) and misled Alexa customers about the deletion of data collected by the smart voice assistant.

Microsoft Patches Four Critical Azure and Power Apps Vulns

Microsoft has fixed critical vulnerabilities in its core cloud services, including Azure Automation, Azure Storage, Azure DevOps, and Microsoft Power...
Read More
Microsoft Patches Four Critical Azure and Power Apps Vulns

Qilin Ransomware topped April 2025 with 45+ data leak disclosures

The cyber threat landscape is rapidly changing, with a notable increase in ransomware activity in April 2025, driven by the...
Read More
Qilin Ransomware topped April 2025 with 45+ data leak disclosures

SonicWall Patches 3 Flaws in SMA 100 Devices

SonicWall has released patches for three security flaws in SMA 100 Secure Mobile Access appliances that could allow remote code...
Read More
SonicWall Patches 3 Flaws in SMA 100 Devices

Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed

From April 2024 to April 2025, Flashpoint analysts noted that the financial sector was a major target for threat actors,...
Read More
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed

Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA

Cisco has issued a security advisory for a critical vulnerability in its IOS XE Software for Wireless LAN Controllers (WLCs)....
Read More
Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA

CVE-2025-29824
Play Ransomware Exploited Windows CVE-2025-29824 as Zero-Day

Attackers linked to the Play ransomware operation deployed a zero-day privilege escalation exploit during an attempted attack against an organization...
Read More
CVE-2025-29824  Play Ransomware Exploited Windows CVE-2025-29824 as Zero-Day

Hacker exploited Samsung MagicINFO 9 Server RCE flaw

Hackers are exploiting an unauthenticated remote code execution vulnerability in the Samsung MagicINFO 9 Server to take control of devices...
Read More
Hacker exploited Samsung MagicINFO 9 Server RCE flaw

CISA adds Langflow flaw to its KEV catalog

CISA added the Langflow vulnerability, CVE-2025-3248 (CVSS score 9.8), to its Known Exploited Vulnerabilities catalog. Langflow is a popular tool...
Read More
CISA adds Langflow flaw to its KEV catalog

Google Fixes Android Flaw (CVE-2025-27363) Exploited by Attackers

Google has released its monthly Android security updates, addressing 46 vulnerabilities, including one that has been actively exploited. CVE-2025-27363 (CVSS...
Read More
Google Fixes Android Flaw (CVE-2025-27363) Exploited by Attackers

UAP hosted “UAP Cyber Siege 2025”, A national level cybersecurity competition

The Cyber Security Club, representing the Department of Computer Science and Engineering at the University of Asia Pacific (UAP), has...
Read More
UAP hosted “UAP Cyber Siege 2025”, A national level cybersecurity competition

The Department of Justice (DoJ), acting on behalf of the FTC, filed a complaint stating that Amazon falsely assured users, including parents, that they could delete Alexa voice recordings and geolocation information. However, it was alleged that Amazon retained some of this data for extended periods and used it unlawfully to enhance the Alexa algorithm.

ALSO READ:

World see transmission at a record speed of 200 gigabits per second

Samuel Levine, the director of the FTC’s Bureau of Consumer Protection, stated that Amazon’s actions of misleading parents, retaining children’s recordings indefinitely, and disregarding deletion requests violated COPPA, prioritizing profits over privacy. He emphasized that COPPA prohibits companies from retaining children’s data indefinitely, especially for the purpose of training algorithms.

Separately, Ring, a business acquired by Amazon in 2018, will pay $5.8 million to settle charges related to compromising consumer privacy and failing to implement adequate security practices. The funds will be used for consumer refunds.

The FTC complaint alleged that Ring deceived customers by allowing unauthorized access to their videos by employees and contractors, and by using customer videos to train algorithms without consent. The complaint claimed that one employee had accessed thousands of video recordings from female users’ Ring cameras, including intimate spaces like bathrooms.

Furthermore, the complaint stated that Ring was slow to enhance customer account security to mitigate the risk of brute-force attacks, despite users experiencing multiple credential stuffing attacks in 2017 and 2018. The complaint highlighted that inadequate implementation of security measures from 2019 onwards hindered their effectiveness. As a result, malicious actors gained access to stored videos, live video streams, and account profiles of approximately 55,000 US customers, and even engaged in threats and extortion attempts.

In addition to the financial penalties, Amazon will be required to delete inactive child accounts, as well as certain Alexa voice recordings and geolocation information. The company will also be prohibited from using this data for training its algorithms.

Ring will be mandated to delete data, models, and algorithms derived from videos that were unlawfully reviewed. It will need to establish a privacy and security program, incorporating safeguards for human review of videos, multi-factor authentication for employee and customer accounts, and other protective measures.

Amazon issued a statement expressing disagreement with the FTC’s claims regarding Ring and Alexa and denying any violations of the law. The company emphasized its commitment to strong privacy protections and customer controls, its compliance efforts with COPPA, and its collaboration with the FTC before expanding Amazon Kids to include Alexa. Amazon acknowledged that, as part of the settlement, it agreed to make a minor adjustment to its existing practices, including the removal of inactive child profiles after 18 months, unless a parent or guardian opts to retain them. The statement further claimed that Ring had addressed the identified issues independently years ago, prior to the FTC’s investigation.

Check Also

Data Center

Amazon Follows Microsoft’s Lead, Halts Some Data Center Deals

Amazon has paused some data center lease negotiations for its cloud division, particularly in international …

Leave a Reply

Your email address will not be published. Required fields are marked *