InfoSecBulletin Cybersecurity for mankind
Amazon has agreed to pay nearly $31 million to the Federal Trade Commission (FTC) in order to resolve allegations related to its Alexa and Ring home security businesses.
The larger portion of the settlement, amounting to $25 million, will address accusations that Amazon violated the US Children’s Online Privacy Protection Act Rule (COPPA Rule) and misled Alexa customers about the deletion of data collected by the smart voice assistant.
CVSS 10.0 Flaw
Critical flaw in Siemens OZW Web Servers Enable Unauthenticated RCE
Microsoft Patch Tuesday May 2025: 72 flaws, 5 Actively Exploited Zero-Day
OTP glitch disrupted NID services across the country
Google to pay Texas $1.4 billion for location tracking practices
YouTube geo-blocks at least 4 Bangladeshi TV channels in India
Microsoft Patches Four Critical Azure and Power Apps Vulns
Qilin Ransomware topped April 2025 with 45+ data leak disclosures
SonicWall Patches 3 Flaws in SMA 100 Devices
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed
Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA
The Department of Justice (DoJ), acting on behalf of the FTC, filed a complaint stating that Amazon falsely assured users, including parents, that they could delete Alexa voice recordings and geolocation information. However, it was alleged that Amazon retained some of this data for extended periods and used it unlawfully to enhance the Alexa algorithm.
ALSO READ:
World see transmission at a record speed of 200 gigabits per second
Samuel Levine, the director of the FTC’s Bureau of Consumer Protection, stated that Amazon’s actions of misleading parents, retaining children’s recordings indefinitely, and disregarding deletion requests violated COPPA, prioritizing profits over privacy. He emphasized that COPPA prohibits companies from retaining children’s data indefinitely, especially for the purpose of training algorithms.
Separately, Ring, a business acquired by Amazon in 2018, will pay $5.8 million to settle charges related to compromising consumer privacy and failing to implement adequate security practices. The funds will be used for consumer refunds.
The FTC complaint alleged that Ring deceived customers by allowing unauthorized access to their videos by employees and contractors, and by using customer videos to train algorithms without consent. The complaint claimed that one employee had accessed thousands of video recordings from female users’ Ring cameras, including intimate spaces like bathrooms.
Furthermore, the complaint stated that Ring was slow to enhance customer account security to mitigate the risk of brute-force attacks, despite users experiencing multiple credential stuffing attacks in 2017 and 2018. The complaint highlighted that inadequate implementation of security measures from 2019 onwards hindered their effectiveness. As a result, malicious actors gained access to stored videos, live video streams, and account profiles of approximately 55,000 US customers, and even engaged in threats and extortion attempts.
In addition to the financial penalties, Amazon will be required to delete inactive child accounts, as well as certain Alexa voice recordings and geolocation information. The company will also be prohibited from using this data for training its algorithms.
Ring will be mandated to delete data, models, and algorithms derived from videos that were unlawfully reviewed. It will need to establish a privacy and security program, incorporating safeguards for human review of videos, multi-factor authentication for employee and customer accounts, and other protective measures.
Amazon issued a statement expressing disagreement with the FTC’s claims regarding Ring and Alexa and denying any violations of the law. The company emphasized its commitment to strong privacy protections and customer controls, its compliance efforts with COPPA, and its collaboration with the FTC before expanding Amazon Kids to include Alexa. Amazon acknowledged that, as part of the settlement, it agreed to make a minor adjustment to its existing practices, including the removal of inactive child profiles after 18 months, unless a parent or guardian opts to retain them. The statement further claimed that Ring had addressed the identified issues independently years ago, prior to the FTC’s investigation.
