Nineteen Privacy Groups Told the FTC That Alexa Couldn't Forget a Child
What happened
In May 2019, a coalition of nineteen privacy and children's advocacy organizations, led by the Campaign for a Commercial-Free Childhood, the Center for Digital Democracy, and Georgetown University's Institute for Public Representation, filed a complaint with the Federal Trade Commission over a specific product: Amazon's Echo Dot Kids Edition. Their claim was narrow and testable. The device was holding onto children's personal information longer than the Children's Online Privacy Protection Act permits, and parents had no reliable way to make it stop.
The mechanism mattered more than the headline. Once a child asked the Echo Dot Kids Edition to remember them, the coalition found that certain personal details, including date of birth, could not be deleted through the FreeTime parental controls in the Alexa app. COPPA's entire theory of protection rests on a parent being able to review and erase what a service holds on a minor. If that erase function does not work once triggered by a child's own voice command, the consent structure is decorative rather than functional. Amazon maintained that the Echo Dot Kids Edition complied with COPPA, but the advocates had already flagged the broader risk a year earlier, warning in 2018 that the device encouraged children to form artificial attachments to it.
What makes this incident worth revisiting is not that a smart speaker recorded a child's voice. Every voice assistant does that by design. The failure is that the retention and deletion controls presented to parents as the safeguard did not hold up once a child interacted with the system in an unanticipated way. A privacy promise that breaks under a foreseeable use case is not a minor bug. It is evidence that no one tested the control against the population it was built to protect.
Reported impact
- Affected parties
- Not publicly disclosed
- Harm type
- Not publicly disclosed
- Scale
- Not publicly disclosed
- Financial impact
- Not publicly disclosed
- Regulatory action
- Not publicly disclosed
Classification
Relevant governance controls
Governance control mapping is not available for this record.
- No controls mapped
Not publicly disclosed
Control mapping is analytical. It does not state that any control would have prevented the incident.
Sources and evidence
This record was researched and written by the Index. The event is also catalogued in the following database, which is listed for cross-reference.