Amazon’s Ring used to spy on customers, FTC says in privacy settlement

A former employee of Amazon.com’s Ring doorbell camera unit spied for months on female customers in 2017 with cameras placed in bedrooms and bathrooms, the Federal Trade Commission said in a court filing on Wednesday when it announced a $5.8 million settlement with the company over privacy violations.

Amazon also agreed to pay $25 million to settle allegations it violated children’s privacy rights when it failed to delete Alexa recordings at the request of parents and kept them longer than necessary, according to a court filing in federal court in Seattle that outlined a separate settlement.

The FTC settlements are the agency’s latest effort to hold Big Tech accountable for policies critics say place profits from data collection ahead of privacy.

The FTC is also probing Amazon.com’s $1.7 billion deal to buy iRobot Corp (IRBT.O), which was announced in August 2022 in Amazon’s latest push into smart home devices, and has a separate antitrust probe underway into Amazon.

Amazon, which purchased Ring in April 2018, pledged to make some changes in its practices.

“While we disagree with the FTC’s claims regarding both Alexa and Ring, and deny violating the law, these settlements put these matters behind us,” Amazon.com said in a statement.

The FTC said Ring gave employees unrestricted access to customers’ sensitive video data: “As a result of this dangerously overbroad access and lax attitude toward privacy and security, employees and third-party contractors were able to view, download, and transfer customers’ sensitive video data.”

In one instance in 2017, an employee of Ring viewed videos made by at least 81 female customers and Ring employees using Ring products. “Undetected by Ring, the employee continued spying for months,” the FTC said.

A colleague noticed the misconduct and the employee was eventually terminated, the FTC complaint said.

In May 2018, an employee gave information about a customer’s recordings to the person’s ex-husband without consent, the complaint said. In another instance, an employee was found to have given Ring devices to people and then watched their videos without their knowledge, the FTC said.

As part of the FTC agreement with Ring, which expires after 20 years, Ring is required to disclose to customers how much access to their data the company and its contractors have.

In February 2019, Ring changed its policies so that most Ring employees or contractors could only access a customer’s private video with that person’s consent.

FTC Commissioner Alvaro Bedoya told Reuters the settlements should send a message to tech companies that their need to collect data was not an excuse to break the law. “This is a very clear signal to them,” he said.

The fines, totaling $30.8 million, represent a fraction of Amazon’s $3.2 billion first-quarter profit.

In its complaint against Amazon.com filed in Washington state, the FTC said that it violated rules protecting children’s privacy and rules against deceiving consumers who used Alexa. For example, the FTC complaint says that Amazon told users it would delete voice transcripts and location information upon request, but then failed to do so.