A report released last week contends that Amazon uses voice data from its Echo devices to serve targeted ads on its own platforms and the web. The report, produced by researchers affiliated with the University of Washington, UC Davis, UC Irvine, and Northeastern University, said the ways Amazon does this is inconsistent with its privacy policies.

Titled, “Your Echos are Heard: Tracking, Profiling, and Ad Targeting in the Amazon Smart Speaker Ecosystem,” the report concludes that Amazon and third parties (including advertising and tracking services) collect data from your interactions with Alexa through Echo smart speakers and share it with as many as 41 advertising partners. That data is then used to “infer user interests” and “serve targeted ads on-platform (Echo devices) as well as off-platform (web).” It also concludes that this type of data is in hot demand, leading to “30X higher ad bids from advertisers.”

Amazon confirmed to The Verge that it does use voice data from Alexa interactions to inform relevant ads shown on Amazon or other sites where Amazon places ads. “Similar to what you’d experience if you made a purchase on Amazon.com or requested a song through Amazon Music, if you ask Alexa to order paper towels or to play a song on Amazon Music, the record of that purchase or song play may inform relevant ads shown on Amazon or other sites where Amazon places ads.” Amazon spokesperson Lauren Raemhild said in an email.

The company also confirmed there are targeted ads on its smart speakers. “Customers may receive interest-based ads when they use ad-supported premium content – like music, radio or news streams,” said Raemhild, pointing out that this is the same experience if they engaged with that content on other channels. She went on to say that Amazon does not share voice recordings with developers. “Developers get the information necessary to fulfill your requests within their skills, such as answers when you play a trivia skill, or the name of the song you want to play,” she said. “We do not share our customers’ personal information to third-party skills without the customer’s consent.” Amazon allows Alexa users to opt out of ad targeting as well (see sidebar).

The 10 research scientists behind the report, led by Umar Iqbal, postdoctoral researcher at the University of Washington, created an auditing framework to measure online advertising data collection. They then created a number of personas to interact with Alexa using third-party skills; these personas had specific interests: spirituality, connected car, smart home, pets, fashion, dating, navigation, beverages, and health. They also created a “vanilla” persona as a control.

Statistical analysis of the results determined that each persona was served targeted ads elsewhere on the web, leading to the conclusion that smart speaker interactions are used for ad targeting on the web and in audio ads. This led the researchers to determine there was “strong evidence that smart-speaker interactions are used for the purpose of targeting ads, and that this ad targeting implies significant data sharing across multiple parties.”

The report notes that only processed transcripts were shared, not raw audio, concurring with what Amazon’s Raemhild said. Additionally, compared to prior research on smart TVs and VR headsets, there was less data activity tracking on smart speakers.

Photo by Dan Seifert / The Verge

Amazon told The Verge that it believes the research is flawed. “Many of the conclusions in this research are based on inaccurate inferences or speculation by the authors, and do not accurately reflect how Alexa works,” Raemhild said. “We are not in the business of selling our customers’ personal information and we do not share Alexa requests with advertising networks.”

Raemhild said that all third-party skills that collect personal information are required to post their privacy policy on their skill page and that developers may then use that information in accordance with those policies. “For example, an ad-supported music streaming service may allow customers to opt-in or out of interest-based ads anywhere that service can be used,” said Raemhild. However, the report found that those policies were spotty at best, with more than 70 percent of the skills it examined not even mentioning Alexa or Amazon, and only 10 skills (2.2 percent) being clear about data collection practices in their privacy policies.

The authors conclude there is a need for greater transparency into smart speaker data collection, sharing, and use. They note these devices are currently “black-box devices without open interfaces that allow independent researchers to expose what data is collected or how they are shared and used.”