The Internet of Things Has a Child Privacy Problem

"In sum: Alexa is kinda my new best friend," writes Rebecca Hanover, an author and blogger on Mommyproof. As a mother of young children, it's not hard to see why: Hanover details the joys of virtual assistant Amazon Echo, which functions as a kind of combined kitchen helper, child entertainer and DJ. "Is it weird that Alexa feels like my trusty little friend during that six pm witching hour, gently guiding me through dinnertime?"

Hanover's not alone: Other parent bloggers have touted the device's family-friendly uses when it comes to child care and household tasks. Many of these "mommy blog" posts are sponsored by Amazon in an ad campaign explicitly geared toward families with young children. In one recent television spot for the device, a young father excitedly purchases an Echo and watches as Alexa slowly becomes an integral part of the household.

But what about the realities of bringing an "always on" device that records children's voices into the privacy of one's home? Some analysts are raising potential violations of childhood privacy laws by such devices.

Companies with virtual assistants, such as Amazon, could be fined millions of dollars for the collection of children's data without explicit parental consent, The Guardian reported recently. Specifically, these AI devices store audio files of children's voice commands, but don't provide any information on how long these files are stored or how they are being used.

"Just telling parents to take effective responsibility for the child isn't sufficient," said Jeffrey Chester, a lawyer who helped to craft the Children's Online Privacy Protection Act, or COPPA, which aims to protect the digital privacy of children under the age of 13. "Under COPPA, they need to know what's being collected, how it will be used, they need to be provided with real informed consent to begin with."

The Amazon Echo isn't the only device Chester is concerned about. Google has announced that it is working on a similar virtual assistant. And then there's Siri, Apple's serene-voiced app accessible via iPhone and iPad, as well as rumors that Apple is developing its own Echo rival.

Chester also expressed concern with marketing tactics that aim to appeal to children. He cites an ad for Apple's Siri that shows Cookie Monster using the virtual assistant to help him bake cookies, as well as the Amazon ad that features young children asking Echo for new knock-knock jokes. Ads like these demonstrate an explicit desire to convert young children to customers, making an even stronger case that these companies are violating COPPA.

"The goal is to use these devices to feed into the ever growing mass of information that's being collected about us," said Chester, who cites the potential of creating highly informed consumer profiles for individuals before they even reach their adult years. "These devices are not seen as protecting privacy, they are seen as new ways to undermine our privacy." He adds that "opt-in" privacy settings that don't do a good job explaining potential privacy violations feed the problem. Amazon (whose chief executive, Jeffrey P. Bezos, owns The Washington Post) told The Washington Post that it does comply with COPPA and other applicable laws.

Collecting data on children has been a hot button issue of late. Recent reports demonstrate that education technology companies, such as those behind the effort to computerize the Common Core tests, are quietly collecting and selling data on students. This data is used for marketing purposes, to help target ad dollars toward the next generation of consumers. In the report "Learning to be Watched: Surveillance Culture at School," published by the National Center for Education Policy, Facebook and Google are identified as two of the biggest culprits. The report calls for greater insight into data collection processes and the requirement of parental consent.

But what about the data about kids that their own parents are willingly plugging into the digital world? After all, the average parent posts about 1,000 pictures of a child before they turn 5. The ethics of posting pictures, videos and anecdotes about children are entering a new, uneasy territory in today's world. It's a problem that could put parents at risk for severe punishment in France, a country with cherished privacy laws. French lawyers have warned parents that they could face fines of up to $50,000 (roughly Rs. 33 lakhs) or even up to a year of imprisonment for posting photos of their children without their explicit consent.

For Kathryn Montgomery, a communications professor and a co-writer of COPPA, the potential psychological impacts of data collection on children are worrisome. "Parents in their effort to share the joy of raising children ... can post things about their children and expose them before they are even old enough to know what's happening. They become another form of digital reality television," she said. "I think that could be really threatening and harmful and really affect the sense of invading the private space that young people really need in order to develop their identities."

But as Montgomery and Chester stress, it's the companies that need to take responsibility for informing parents about what's happening to data about their children. "This digital media that is driven by certain business models, that reward and incentivize certain behaviors... are fostering new social norms. You may not be thinking about whether this is the kind of society that we want to have here," said Montgomery.

© 2016 The Washington Post