Privacy advocates have long worried about the implication of smart speakers, and now a new paper claims that the popular Amazon Echo range uses voice data to target ads both on Amazon and across the wider web.
The paper, titled Your Echos are Heard: Tracking, Profiling, and Ad Targeting in the Amazon Smart Speaker Ecosystem, is the handiwork of researchers from the University of Washington, UC Davis, UC Irvine and Northeastern University.
It claims that chatting with your Echo results in data being collected that can be shared with up to 41 advertising partners, where the data is used to “infer user interests” and “serve targeted ads” both on the Echo and the wider internet. Such data, the paper claims, can drive “30X higher ad bids from advertisers.”
Approached by The Verge, Amazon conceded some points in the research paper, but objected to others.
“Similar to what you’d experience if you made a purchase on Amazon.com or requested a song through Amazon Music, if you ask Alexa to order paper towels or to play a song on Amazon Music, the record of that purchase or song play may inform relevant ads shown on Amazon or other sites where Amazon places ads,” an Amazon spokesperson said.
“Customers may receive interest-based ads when they use ad-supported premium content — like music, radio or news streams,” Amazon added.
But the company objected to the paper’s conclusion on the main point about wider web advertising. The researchers reached this verdict by creating personas with divergent interests (pets, dating, health, etc.) to use third-party skills on Alexa. The targeted ads which these invented personas found on the web afterwards was, according to the researchers, “strong evidence that smart-speaker interactions are used for the purpose of targeting ads, and that this ad targeting implies significant data sharing across multiple parties.”
Not so, says Amazon. “Many of the conclusions in this research are based on inaccurate inferences or speculation by the authors, and do not accurately reflect how Alexa works,” the Amazon spokesperson told The Verge. “We are not in the business of selling our customers’ personal information and we do not share Alexa requests with advertising networks.”
That perhaps suggests that it’s the Alexa skill developers, and not Amazon itself, which are responsible for the researchers’ findings. And while Amazon requires third-party developers to publish their privacy policy on the skill’s page, the researchers found that this was not usually the case. In fact, they found just 10 skills with full disclosure about their data collections and privacy policies.
It’s not clear if consumers would pull away from the best smart speakers if they were concerned about data privacy. With free services, the old mantra of “if you’re not paying for the product, you are the product” is kind of tacitly accepted. With a $100 smart speaker, though, it’s more complicated. If the researchers are correct, you’re paying both with your cash and your data.
If the data obtained from smart speakers is useful to the companies that make them, perhaps it explains why the products are so competitively priced. But if people are subsidizing the low cost of entry with additional data, to help the manufacturers, it should certainly be advertised more clearly.
As the researchers conclude, things are currently too opaque. Smart speakers are “black-box devices without open interfaces that allow independent researchers to expose what data is collected or how they are shared and used.” Without a more open system, researchers and the public alike will continue to wonder exactly what they’re giving away when they invite such smart products into their home.
