A former employee of Amazon’s Ring doorbell camera unit spied on female customers for months in 2017 with cameras placed in bedrooms and bathrooms, the Federal Trade Commission said in a court filing on Wednesday when it announced a $5.8m settlement with the company over privacy violations.
Amazon also agreed to pay $25m to settle allegations that violated children’s privacy rights when it failed to delete Alexa recordings at the request of parents and kept them longer than necessary, according to a court filing in federal court in Seattle that outlined a separate settlement.
The FTC settlements are the agency’s latest effort to hold big tech accountable for policies that critics say place profits ahead of privacy.
Amazon, which purchased Ring in April 2018, pledged to make some changes in its practices.
“While we disagree with the FTC’s claims regarding both Alexa and Ring, and deny violating the law, these settlements put these matters behind us,” Amazon said in a statement.
Alvaro Bedoya, the FTC commissioner, told Reuters that settlements should send a message to tech companies that their need to collect data is not an excuse to break the law. “This is a very clear signal to them,” he said.
The fines, totaling $30.8m, represents a fraction of Amazon’s $3.2bn first-quarter profit.
In its complaint against Amazon filed in Washington state, the FTC said that it violated rules protecting children’s privacy and rules against deceiving consumers who used Alexa. For example, the FTC complaint says that Amazon told users it would delete voice transcripts and location information upon request, but then failed to do so.
In one instance in 2017, employees of Ring viewed videos made by at least 81 female customers and Ring employees using Ring products. “Undetected by Ring, the employee continued spying for months,” the FTC said.
A colleague noticed the misconduct and the employee was eventually terminated.
The FTC also said Ring gave employees unrestricted access to customers’ sensitive video data said “as a result of this dangerously overbroad access and lax attitude toward privacy and security, employees and third-party contractors were able to view, download and transfer customers’ sensitive video data for their own purposes”.
As part of the FTC agreement with Ring, which spans 20 years, Ring is required to disclose to customers how much access to their data the company and its contractors have.
In February 2019, Ring changed its policies so that most Ring employees or contractors could only access a customer’s private video with that person’s consent.