DOJ Charges Tech Company with Improperly Retaining Children's Voice Recordings
The DOJ charged a multinational technology company ("Company") for retaining children's personal information on a voice assistant service indefinitely and for misleading parents regarding their ability to delete such information.
In a Complaint filed with the U.S. District Court Western District of Washington, the DOJ alleged that the Company retained thousands of children's voice recordings and transcripts using a voice assistant service developed by the Company, and featured products aimed at children under 13 years old, violating both the Children's Online Privacy Protection Act ("COPPA") and Section 5 of the FTC Act ("Unfair methods of competition unlawful; prevention by Commission").
Under COPPA, companies may not store children's personal information longer than is "reasonably necessary" to fulfill the purposes for which the information was collected and parents have the right to request deletion of their children's personal information. The DOJ alleged that the Company violated COPPA by maintaining a practice (until September 2019) of retaining children's voice recordings and transcripts indefinitely, unless a parent actively requested deletion of the information.
In addition, the DOJ alleged that the Company’s default settings continue to save users' voice recordings and transcripts regardless of whether the child's service account is in use, thus retaining the data longer than is "reasonably necessary." The DOJ said that the Company's privacy policy allows parents to delete voice recordings upon request. The DOJ asserted that the Company honored parents' deletion requests with respect to voice recordings, but retained written transcripts of the recordings – a fact that was not disclosed to parents. Finally, the DOJ alleged that the Company falsely represented to users that they could delete their own voice information and geolocation information, and further retained that data for its own potential use, constituting unfair and deceptive trade practices in violation of Section 5 of the FTC Act.
The DOJ requested that the Court enforce a (i) permanent injunction of future FTC Act and COPPA violations and (ii) monetary civil penalty.
In a concurrently filed proposed settlement agreement, the Company agreed to pay a $25 million civil penalty and to adhere to the following requirements: (i) delete any personal information collected from inactive child service accounts; (ii) not misrepresent its data retention, access, and deletion practices; (iii) delete all personal information where the consumer has requested such deletion; (iv) not use deleted information for the creation or improvement on any data product; (v) clearly and conspicuously display links to retention and deletion disclosures; (vi) notify users of the lawsuit; and (vii) maintain a comprehensive privacy to program to protect personal information.