According to a complaint filed by the Federal Trade Commission (FTC), about 30,000 employees of Amazon had access to voice recordings of Alexa users. The recordings were picked up by the company's voice-activated speakers and were available to these employees between August 2018 and September 2019. While it is unclear as to how many personnel still have such access, this is a significant number and demonstrates that the practice of Amazon giving employees overly broad access to personal data has been ongoing.
This revelation came as part of an FTC complaint about children's privacy that Amazon has settled for $25 million. The FTC has called the practice an "overbroad grant of access," which violated Amazon's own security policies governing sensitive data. Approximately half of the 30,000 employees had no business reason to access the data, and many did not even work on Alexa-enabled products. This news is the latest in a series of revelations that Amazon, despite promising to be a good steward of customer information, has given employees overly broad access to personal data and failed to disclose the practice to users.
Alexa, most commonly found in Amazon's Echo line of smart speakers, is designed to record audio when it hears a "wake word" and transmits user commands to read a news report or fetch the weather to Amazon's servers. By default, the company stores that data indefinitely, although it has added tools that allow users to auto-delete recordings and opt-out of having their voices used to train Alexa's systems. However, until mid-2019, Amazon kept a written transcript of the recordings when a user requested that Alexa delete their voice recordings. This is something that the FTC has criticized the company for not disclosing to users.
Furthermore, Amazon repeatedly failed to delete location data from Alexa app users who thought they had eliminated their files. According to the FTC's complaint, "Amazon itself determined that on many occasions between January 2018 and early 2022, Amazon retained Alexa app users' geo-location information in secondary data storage locations that were insulated from consumers' deletion requests." The company never informed Alexa users that it retained geo-location data they tried to delete.
Amazon has responded to the allegations, with a spokesperson stating that the company disagrees with the FTC's claims and denied violating the law. The FTC's proposed order, which requires a judge's signoff, would prohibit Amazon from using data customers had deleted to improve its services, require the company to notify users of its retention and deletion policies, and mandate the creation of a privacy program related to the use of location data, among other provisions. As Amazon continues to face scrutiny in regards to its privacy practices, it is clear that the company needs to implement more robust data policies and be more transparent with its users.