What Amazon’s FTC Settlement Means if You Love Ring and Alexa

Ring is back at it again, and this time parent company Amazon is along for the ride. We’ve talked about privacy concerns with Ring doorbells many times (we even have FAQ and videos dedicated to it), but yesterday’s news of a $30 million settlement with the FTC is the first major action we’ve seen from the video doorbell pioneer.

But the bigger part of the settlement ($25 million) is related to allegations about privacy on Amazon Kid accounts that use Alexa. Both Ring and Alexa have had parents and watchdogs nervous over reports of hackers watching and talking to kids over cameras and Amazon Echo devices. It looks like the FTC listened, and now Amazon is, too.

Over the past few years, Ring’s partnerships with law enforcement have gone under fire for the same types of privacy concerns highlighted in this settlement. The FTC alleges that, prior to September 2017, Ring employees could access video footage for all Ring customers—with no restrictions in place. The agency also claims that Ring didn’t provide any data privacy training before 2018 (when Amazon acquired Ring), and failed to implement even basic online security measures to protect customers.

• In essence, Ring allowed employees and contractors to spy on customers.
• Ring didn’t put any measures in place to prevent hackers from accessing Ring cameras and customer footage. Around 55,000 U.S. customers had their accounts hacked.
• Ring also used customer footage to develop and improve products and features (including facial recognition) without obtaining explicit permission.

• Amazon’s $5.8 million settlement for the Ring allegations will be used to refund customers. We don’t have word yet on who’s eligible for a refund.
• Ring needs to implement a mandatory privacy and security program, which includes deleting all customer data collected before 2018 and requiring multi-factor authentication for both employee and customer accounts.
• Ring also must delete any algorithms or other products developed with that customer data.

Ring released a statement on its website, explaining its disagreements with the FTC allegations and defending its efforts to protect customers’ privacy.

“We take our responsibility to protect our customers’ privacy and security extremely seriously, and believe it’s important to provide context in relation to this settlement. We want our customers to know that the FTC complaint draws on matters that Ring promptly addressed on its own, well before the FTC began its inquiry; mischaracterizes our security practices; and ignores the many protections we have in place for our customers. While we disagree with the FTC’s allegations and deny violating the law, this settlement resolves this matter so we can focus on innovating on behalf of our customers.”

The statement goes on to outline what the company is doing (and has already done) to protect customer privacy. Ring claims to use “industry-leading protections” on customer accounts, which includes required two-factor authentication and using tools like CAPTCHA to enhance login security. The company also notes that Ring customers have total control over all saved footage and that employee access to saved videos is restricted.

Ring closes out its statement trying to reassure customers that the missteps of the past won’t be repeated:

“We work every day to earn and keep our customers’ trust. We will continue to invent more privacy and security features on behalf of our customers, and ensure they are aware of the controls and options available to them. To learn more about our commitment to customer privacy, visit www.ring.com/privacy.”

It may seem surprising that the bigger settlement is related to Amazon’s voice assistant, Alexa, but when it comes to kids, the FTC and DOJ don’t seem to be holding back. Both agencies allege that Amazon violated the Children’s Online Privacy Protection Act Rule (COPPA Rule) by storing voice recordings from Alexa and misleading parents about deletion practices and requests.

• Amazon kept voice and geolocation data on children for years and used it to develop or improve its products and services.
• Amazon told parents that data could be deleted, but failed to follow through, sometimes retaining transcripts of recordings that parents believed had been deleted.
• The COPPA Rule prohibits any entity from storing data on children under 13 years old for longer than necessary to deliver the service.

Read the full DOJ complaint.

• Under the COPPA Rule, Amazon should have deleted all voice recordings by children after Alexa answered the question, told the joke, or played the requested song.
• The FTC and DOJ assert that keeping those recordings and using them to improve their algorithm to better recognize children’s speech patterns “benefitted its bottom line at the expense of children’s privacy.”
• The proposed $25 million settlement is a civil penalty imposed along with other sanctions, including a requirement to delete inactive child accounts.
• Amazon is also prohibited from using any child data (including geolocation and voice recordings) for product development, subject to parental deletion requests, and must be transparent in its privacy, storage, and deletion practices.

A joint statement from DOJ Commissioner Alvaro Bedoya, FTC Chair Lina M. Khan, and Commissioner Rebecca Kelly Slaughter, said, “These allegations should set off alarms for any parent . . . Amazon is not alone in apparently seeking to amass data to refine its machine learning models; right now, with the advent of large language models, the tech industry as a whole is sprinting to do the same. Today’s settlement sends a message to all those companies: Machine learning is no excuse to break the law.”

Amazon released a statement on its website, highlighting its commitment to retaining the trust of its customers and their families.

“We take our responsibilities to our customers and their families very seriously. We have consistently taken steps to protect customer privacy by providing clear privacy disclosures and customer controls, conducting ongoing audits and process improvements, and maintaining strict internal controls to protect customer data. While we disagree with the FTC’s claims and deny violating the law, this settlement puts the matter behind us, and we believe it’s important to put the settlement in the right context.”

Amazon denies violating the COPPA Rule and doubles-down on its privacy practices at present and moving forward. The statement directs consumers to its Childrens’ Privacy Disclosure and Alexa Privacy page, for explicit information about how it handles children’s data and the rights of parents to control, access, and delete such data.

If you’re worried about privacy risks on Ring and Amazon Echo devices in light of this news, take heart. The good news is that this settlement requires both divisions to improve user privacy and online security measures. But, we never recommend leaving your security up to a third party.

Here’s what you can do to increase security on your devices:

• Update all firmware and software on your Ring and Alexa devices and apps.
• Review the privacy policies and make sure you understand them. Contact the company if you have questions or concerns.
• Make sure your home Wi-Fi network is secured, your router is updated, and you have a unique, complicated password or passphrase.
• Don’t reuse passwords on multiple accounts.
• Review best online and smart device practices with your kids and consider signing a family agreement to follow them.

• AI Can Crack Eight-Character Passwords in Under Seven Hours
• Ultimate Guide to Alexa and the Amazon Echo Family
• VIDEO: How to Set Up Ring End-to-End Encryption | Is it Worth It?
• VIDEO: Amazon Sidewalk—Privacy Nightmare or Connected Dream? What it is and how you can disable it