FTC: Amazon 'deceptive' about privacy policy
The Internet retailer and its Web-tracking subsidiary "likely" engaged in deception when they claimed they didn't keep personally identifiable information in Alexa's database of Web-usage patterns, FTC official C. Lee Peeler said in a recent letter to Amazon's lawyers.
Internet-privacy activist Richard Smith last year accused Amazon of surreptitiously collecting personal data on customers through its Alexa system, which is designed to assist shopping and other activities online. He complained to the FTC, and customers made the same claims in lawsuits that received class-action status.
Amazon and Alexa denied deliberately collecting any data, but conceded that some information could be stored in Alexa's database inadvertently. Last month, Amazon settled the civil suits for about $2 million while continuing to deny wrongdoing.
"Our review indicated that certain of Amazon.com's and Alexa Internet's practices likely were deceptive," Mr. Peeler, associate director of the FTC's division of advertising practices, wrote. "Nevertheless, we have decided not to recommend enforcement action at this time."
His letter emphasizes, however, that the decision to take no further action was made at the staff level and could later be reversed.
Alexa "revised the representations on its Web site to more accurately reflect its information practices," Mr. Peeler said. The court settlement, he added, provided other remedies and damage payments of as much as $40 to any person who used its software and has a file in Alexa's database.
"We believe we've always described our privacy policies accurately," Alexa President Brewster Kahle, said. The changes were intended to make the policy more explicit, he said. Instead of a brief statement declaring that the firm doesn't use personal information, Alexa now has "many pages describing that what we do with this information is nothing."
Mr. Smith, who works for the University of Denver-affiliated Privacy Foundation and has exposed a number of Internet-privacy violations, said the FTC decision is "more than a slap on the wrist, but it's maybe not strong enough. They made a pretty strong statement about not collecting personal data when in fact they were."