You’re Home Alone With Alexa. Are Your Secrets Safe?

(Bloomberg) -- Privacy at home is something most people take for granted. But the home has become the latest frontier in data harvesting for big tech companies. Smart speakers, app-activated thermostats and internet-connected everything else are scooping up information that could prove valuable to product designers, advertisers, governments and law enforcement. A range of interest groups, from civil liberties organizations to consumer advocates and children’s privacy watchdogs, worry about an erosion of privacy.

1. Who’s collecting data inside your home?

Amazon’s Echo, animated by the voice assistant Alexa, and Google’s Home, with its Assistant, keep track of the questions people ask and store recordings of them. Manufacturers can develop a catalog of information about how people use “smart home” appliances and devices, which communicate with a smartphone or a central hub (like Echo or Home) and take instructions by voice commands, remote controls or a touchscreen. Such devices include ceiling fans made by Hunter Fan; thermostats made by Ecobee, Emerson and Nest; Kwikset and Schlage branded door locks; and self-steering vacuums from iRobot.

2. How common is this?

More than 100 million Alexa devices have been purchased, making Amazon the clear leader among smart speakers, with an estimated 70% market share. But Alexa faces competition from Google Assistant, Apple’s Siri, Microsoft’s Cortana and Facebook’s equivalent service as tech companies weave their services much deeper into people’s lives, putting microphones in smartwatches, SUVs and everything in between. Consulting firm Juniper Research Ltd. estimates that by 2023 the global annual market for smart speakers will reach $11 billion, and there will be about 7.4 billion voice-controlled devices out there. That’s about one for every person on Earth.

3. What gets collected?

In addition to voice recordings by Echo and Google Home, data that can be collected include maps of homes (in the case of automated vacuums) or a record of every time a smart light bulb or stove is turned on. Such information can seem mundane. But especially when paired with other information about you, it helps fill out a record of your behavior in the home. A good rule of thumb is if a device is able to transmit data wirelessly, it is probably gathering, and may well be sharing, information about how it’s used.

4. Who gets access to all that?

In addition to technologists and product designers who look at aggregated user data, an army of low-paid humans hired by the tech companies listen to sound snippets recorded by the devices and annotate them so the electronic ears can be upgraded. That’s how our faintest whispers get turned into valuable datasets. Amazon has set up transcription farms in cities around the world, from Bucharest to Chennai. Amazon says it needs a complete understanding of regional accents and colloquialisms to make Alexa global. It also says it takes the “security of customers and their voice recordings seriously.” Amazon, Google and Apple all say they have measures in place to prevent employees and contractors from abusing their access to customer voice recordings.

5. How does that information get used?

Amazon and Google say the knowledge gained from use of smart devices could lead to helpful personalized tips, like a reminder to lock the door at night. Or a smart stove might tell its owner about a maintenance issue, or suggest a recipe. The companies benefit as well. They can sift through the accumulated data for ideas about new features or products that might be welcomed by consumers. They also can -- and do -- use their trove of recorded customer voices to refine the algorithms trained to interpret and respond to human speech. Sometimes, that process entails teams of humans charged with reviewing voice recordings and other data.

6. Can law enforcement use this data?

Police in the U.S. have sought records captured by Amazon Echo speakers. Nest, the security camera and thermostat maker owned by Google parent Alphabet, says it has received hundreds of requests for information about its users from governments around the world. Typically, tech companies pledge that they won’t turn over data without a valid court or government order. Amazon, citing First Amendment speech protections, initially resisted a police request for user data in a 2017 Arkansas murder case that ultimately was dropped. In another such case, involving a double murder in New Hampshire, Amazon was ordered to turn over Echo recordings. The Fourth Amendment also gets cited, since it sets limits on searches of homes. But police access to smart home data remains a gray area, as the legal code in most cases didn’t contemplate corporate-owned microphones on the kitchen table or microwaves capable of communicating with the internet.

7. Where is this headed?

The likely next frontier, observers say, is monetizing the cache of personal data through advertising. Google, for instance, could use its awareness of a newly purchased smart television to suggest a set of speakers to go with it. Or the maker of a freshly activated smart pressure cooker could sell information on the buyer to local grocers, who in turn could pepper the buyer with ads. Google, the biggest player in online ads, says it doesn’t use some smart home data, like readings on a Nest thermostat, to inform targeted advertising. But it does use what people tell the Google Assistant to personalize the ads that it shows alongside smartphone apps and websites. (Amazon says it doesn’t use data gleaned from Alexa commands for advertising purposes.)

8. What are companies doing?

Some tech companies tweaked their virtual-assistant programs this year after a steady drip of news reports spurred a backlash. Google suspended human transcriptions of Assistant audio, later resuming them. Apple began letting users delete their Siri history and opt out of sharing recordings. It also hired many former contractors to increase its control over human listening. Facebook and Microsoft added clearer disclaimers to their privacy policies. Amazon introduced a similar disclosure and started letting Alexa users opt out of manual reviews of their recordings.

9. What can people do?

Virtually all makers of smart devices put the onus on customers to wade through lengthy privacy policies to learn how their information is being used and what options they have to control that. Users of Amazon Echo, Google Home and Apple’s Siri can delete their accumulated voice recordings or opt out of some data collection. Other smart devices generally don’t allow such clear-cut options. Often the only way to stop an appliance from gathering and transmitting information on its use is to disconnect it from the internet. That, of course, eliminates much or all of the functionality promised by the “smart” label in the first place.

10. Is anybody cracking down on this?

The European Union’s expansive General Data Protection Regulation gives people the right to compel companies to stop using their personal information and to delete the information. A California law taking effect in 2020 will give residents the right to know how their data is being collected and shared and allow them to deny companies the right to sell it. Several other states including Illinois, Maryland, Massachusetts and New York have considered legislation giving customers more control over their data or limiting what smart speakers can scoop up, while the U.S. Congress continues to work on nationwide rules that could override state actions.

The Reference Shelf

• Thousands of Amazon workers listen to what you tell Alexa. Others do the same for Alexa’s rivals.
• Silicon Valley is listening to your most intimate moments.
• Google’s travel tools know what you did last summer.
• Amazon’s Echo for Kids has raised privacy issues of its own.
• Alexa is making a move on the classroom, too.
• Wired magazine on how to make Amazon Echo and Google Home as private as possible.
• Bloomberg Opinion columnist Lionel Laurent weighed the side effects of asking Alexa for medical advice.

To contact the reporter on this story: Matt Day in Seattle at mday63@bloomberg.net

To contact the editors responsible for this story: Tom Giles at tgiles5@bloomberg.net, Laurence Arnold, Jillian Ward

©2020 Bloomberg L.P.