An Uneasy Love Triangle Between Alexa, Your Personal Life, and Data Security: Exploring Privacy in the Digital New Age

• Publication year: 2020

An Uneasy Love Triangle Between Alexa, Your Personal Life, and Data Security: Exploring Privacy in the Digital New Age

Marissa Merrill

[Page 637]

An Uneasy Love Triangle Between Alexa, Your Personal Life, and Data Security: Exploring Privacy in the Digital New Age^*

I. Introduction

Would you willingly welcome a stranger into your home to listen and record your private conversations? You might have already done so if you own a voice-controlled, personal assistant device like Amazon's Alexa products. These devices listen to your conversations and record your interactions awaiting a command, sending personal data through the cloud to Amazon employees to translate the information into an action. So how private is your personal data if it's being shared through these devices?

For years people have dreamed about the technology of the future. But these technological advances open the door to new, different problems. Voice-controlled, personal assistant devices have become the norm, earning its space on our kitchen counters, living room tables, bedroom nightstands, and inside our hand-held devices. With the sound of your voice, this technology is alert and ready to take action. Yet, the problem lies within that technology and it exists because of the ease. While these devices are listening for the user's command, they also record interactions and personal information to personalize or improve each user's experience. However, there is one lingering concern about the interactions with such voice-controlled, personal assistant devices: how private is the personal data it consumes?

This Article explores privacy concerns in a world of technological advancements and ease. While examining the recent privacy and legal issues with these devices, this Article will analyze the current state of

[Page 638]

privacy laws and compare it to other regions for a conclusion on how to best protect your data.

II. The Devices: The Digital New Age

A. Voice-Controlled, Personal Assistant Devices

Voice technology is the future and many new devices have built-in personal assistants activated by voice commands.¹ In 2018, PricewaterhouseCoopers (PwC) conducted a survey about consumers' familiarity with voice-controlled devices.² Of the respondents, 72% had used a product equipped with voice technology.³ More specifically, 57% had used voice-assistant programs on a smartphone, 29% on a laptop, and 27% on a speaker.⁴ Younger consumers, ages eighteen to twenty-four years old, are driving this new trend and encouraging the usage of such devices.⁵ Although these voice-controlled devices are mobile, "three out of every four consumers (74%) are using their mobile voice assistants at home."⁶ Consumers reported using voice technology to assist them in multiple everyday tasks.⁷ These tasks include asking a simple question, checking the weather, asking for the news report, sending texts or emails, and purchasing online products.⁸ A large majority of people found the new technology to be "the smarter, faster, and easier way to perform everyday activities."⁹

In addition to welcoming voice-assistant devices into their homes, the survey reported that 44% of people used their device to control another product in their home.¹⁰ As a result, this technology is potentially linked to bank accounts, security systems, televisions, personalized calendars, contact lists, and personal conversations.¹¹ The survey also reported that 9% of respondents had never used a voice assistant and had no plan to use one in the future.¹² Why? Because of privacy

[Page 639]

concerns; specifically, these respondents were uneasy about the device constantly listening and the security of their personal data.¹³ Despite these concerns, "[t]he average consumer is using their voice assistant more than they were before, and will use it even more in the future."¹⁴

As the technology of voice assistants progresses, companies must balance the "fine line between being 'cool' or 'helpful' and being 'creepy[,]' [because] [t]he key is to use personal consumer data in a secure and transparent way to create personalized experiences that the consumer wants and has asked for."¹⁵

B. Popular Devices with Voice-Controlled Assistants

Voice-controlled, personal assistant devices come in all shapes and sizes and are marketed by many popular companies. This new technology is fascinating and was quickly picked up by powerhouse developers. Many major companies have their own variation of a digital assistant: Amazon's Alexa, Apple's Siri, Microsoft's Cortana, and the Google Assistant.¹⁶ This Article focuses specifically on the voice technology and experience with Alexa-enabled Amazon products to address a widespread privacy concern with all similar devices.

C. Amazon's Alexa-Enabled Devices

Amazon markets its Alexa devices by stating "[w]ith Alexa, you can build natural voice experiences that offer customers a more intuitive way to interact with the technology they use everyday."¹⁷ The company also poses extensive privacy protections, with "transparency and control over your Alexa experience."¹⁸

Amazon offers three different sized speakers called Echos. Each device is designed with four buttons on its face: two volume buttons, an action button, and a microphone-off button.¹⁹ The device lights up with

[Page 640]

a blue ring to signal that Alexa is recording the interaction and sending requests to the cloud.²⁰ Amazon's Alexa is suited with learning technology to help improve the users' experience with the device and provide assistance in a personalized way because "Alexa is designed to get smarter every day."²¹ While these features use personal data to improve the experience, the company allows users to turn off such learning features.²² Consequently, the user who chooses to do so will have inhibited the learning technology and stunted personalized improvements for their device.

Amazon's Alexa is popular because of its extensive capabilities. The company quotes that the devices have "hundreds of thousands of supported commands."²³ A list of supported commands includes the ability to set calendar appointments, connect to Bluetooth, communicate through calls and messages, purchase online products, play games, tell jokes, read weather reports, and much more.²⁴ While these features assist the user with everyday activities, the information shared between the two is sent into the cloud to be processed. As you will see later in this Article, Amazon creates a file of information from each device, which serves as a glimpse into your private life pieced together from your communications with "Alexa."

As of January 2019, over 100 million Alexa-enabled devices were sold worldwide.²⁵ Although people welcome these devices into their homes, a 2018 survey noted that 28% of people are concerned about their data privacy.²⁶ More specifically, 38% were concerned with the Amazon product listening to their private conversations.²⁷ A different online survey with 5,716 responses reported that 56% of respondents found

[Page 641]

Alexa's listening and recording habits to be "creepy."²⁸ Throughout the following sections, this Article analyzes these consumer concerns and recorded instances of a breach in data privacy.

Before addressing the issues with these devices and personal privacy, it is important to highlight Amazon's privacy policy. The company provides that "[y]ou can view, hear, and delete your voice recordings at Alexa Privacy Settings or in the Alexa app at any time. To delete by voice, you can also say, 'Alexa, delete what I just said' or 'Alexa, delete everything I said today.'"²⁹ The privacy settings allow for users to enable a feature called "auto-delete."³⁰ Yet enabling these protective features, such as deleting your recorded information, "may degrade your Alexa experience."³¹

Amazon also puts users on notice that their recordings may be reviewed, stating that "[a]n extremely small fraction of voice recordings are manually reviewed to improve Amazon services and develop new features."³²

III. The Problem: Data Breaches And Privacy Concerns

Although the PwC survey from 2018 reported user satisfaction with voice-controlled, personal—assistants, respondents also reported serious privacy concerns.³³ While 50% of consumers had used their voice assistant device to make an online purchase, which created a direct link to their credit card or bank account and the device, another 45% stated they did not feel comfortable paying through the device.³⁴ One respondent was uneasy about the ability of the device to process payments through her account, stating "[t]his reminds me of when my daughter racked up almost $1,500 playing a mobile game . . . Can it get to a point where the device can confirm it's me who's talking and not my 11-year-old who's going rogue?"³⁵

Voice-assistant devices are equipped with learning technology. Two key components of this technology are listening and recording its

[Page 642]

interactions with consumers to create a more personalized experience to better assist each user.³⁶ Yet, because of these critical features, many consumers' concerns about a security breach of their personal data have been brought to life through interesting scenarios since the technology's creation.³⁷

In mid-2018, Amazon's Alexa misinterpreted a private conversation between a woman and her husband to be a user command to send a voice message to an outside party.³⁸ The Alexa-enabled product recorded the conversation and sent the message to one of the couple's contacts.³⁹ The Amazon company explained the scenario by detailing that Alexa had asked confirmation questions before completing the command.⁴⁰ However, the couple from the incident explained that they were not speaking directly to the Amazon product, and instead, were having a private conversation from which the product heard and reacted to words of confirmation picked out of the conversation.⁴¹

In March 2018, Amazon again came under criticism for its Alexa-enabled products due to...