Consumer Scams

Are Virtual Home Assistants Invading Your Privacy?

If you don’t already have a virtual home assistant, you have undoubtedly seen the ads on TV and the internet.  There is currently a big push to promote Amazon Echo, Google Home, Google Home Mini, and other similar technologies.  While it may be convenient to have a virtual assistant to turn on the dishwasher, order groceries, and answer trivia questions, privacy concerns have arisen that are both complex and troubling.  Those privacy issues pose serious legal questions and impact our civil rights.

Our Constitutional right to privacy is implied in the language of the 4th Amendment, when it says: “The right of the people to be secure in their persons, houses, papers and effects, against unreasonable searches and seizures, shall not be violated.”  Over the years, the courts have interpreted that language to guarantee your right to privacy in your home.  Now, legal scholars and those with communications and technology expertise are concerned that allowing virtual assistants into our homes could endanger that right.

The Importance of Personal Privacy.

Personal privacy is vital to maintain a free society.  In the past, even totalitarian regimes could not easily control what people said and did in the privacy of their homes.  Revolutions, including the American Revolution, were born in private homes where like- minded people met to discuss their grievances.  Today, cameras, listening devices and smart phones have made personal privacy harder to achieve.  The popularity of the virtual assistant raises those concerns to a whole new level.  Here, we will discuss some of the specific concerns.

The Bentonville Murder

In 2015, James Andrew Bates had an Amazon Echo in his home in Bentonville, Arkansas.  James invited several friends over to watch football, including Victor Collins.  After an evening of drinking and football, one of the friends went home.  Victor and another friend stayed the night.  Sometime during the night, Victor Collins was strangled in in the home’s hot tub.  Bates was arrested and charged with murder.  The Bentonville police subpoenaed Alexa recordings from the Amazon Echo in the hope the device had recorded all or part of the attack. Amazon resisted the demand for the recordings, and a legal battle ensued.  Amazon claimed the subpoena was a fishing expedition, that the police had no reasonable cause to believe the recordings contained any evidence relating to the murder.  Finally, in February 2017, Bates agreed to voluntarily release the data and instructed Amazon to turn over the recordings.  Apparently, the recordings did not contain any relevant information.  This past November, Bates was released when the attorney general’s office decided there was not enough evidence to prosecute.

Although the legal battle is over, the Bentonville case shows us that Bentonville will probably be the first skirmish in a long, legal battle over electronic discovery of virtual assistant recordings.  You can bet prosecutors and litigators all over the world will begin to routinely ask for discovery of these recordings in legal cases.  

Other Potential Privacy Issues.

Although these virtual assistants don’t begin recording until you say their “wake word,” once you say “Alexa” or “Ok Google,” your voice is recorded, and that recording is stored somewhere in the cloud until you delete it.  According to Amazon, the device is listening all the time, but it only stores snippets of conversations after it hears an awake word.  So, where is the concern?  Security experts fear these devices can be hacked by government agencies or criminal organizations to hear and record everything said in your home.  Is this a valid concern?  

The Dyn DDos Attack

The Dyn DDos attack of 2016 demonstrates the risk.  Dyn is a company that provides internet infrastructure.  It routes internet traffic to the appropriate location. When you type a url for your bank, your insurance company or any other website into your browser, Dyn is the company that gets you to your site.  In October 2016, attackers used internet connected devices to create a massive internet traffic jam, causing Dyn’s servers to break down.  The hackers basically hijacked people’s smart phones, computers, and other electronic devices.  This was a well-orchestrated, coordinated attack that “built an army” from accessing an untold number of internet devices.  The attack crippled major sites like Twitter, Paypal, Netflix, and Reddit.  While it sounds like science fiction, the Dyn attack actually happened.  Experts theorize virtual assistants are prime candidates for similar use in future attacks.

The Google Home Mini Speaker Debacle

In early October, 2017, Google previewed its Google Home Mini at an event in San Francisco.  The company sent Mini’s home with members of the press so that they could review the Mini before its expected October 19 launch.  A tech blogger was the first person to discover a bug in the software.  When he went to his Google activity account page, he found dozens of audio clips recorded in his home.  The Google Mini was recording and saving conversations even when the “OK Google” wake word was not used.  After testing, a Google spokesperson confirmed the existence of the bug.  The early model was recording everything said in the room 24 hours a day.  The flaw was corrected before the device was released to paying customers, but the incident points out the potential dangers of these devices.

Do Virtual Home Assistants Break Child Privacy Laws?

Some legal experts believe they do.  The Children’s Online Privacy Protection Act (COPPA) is designed to protect children under the age of 13.  For example, it is illegal under COPPA, to take an audio or video recording of a child without specific parental permission.  Does that apply to the voice recordings made by virtual assistants?  Some authorities believe it does.  In 2017, COPPA was amended to address some of these issues. Now, companies can provide services to children if they meet specific guidelines, including: (a) post a privacy policy that is COPPA compliant; (b) notify parents directly about company policies for collecting and handling personal information before taking any information from kids; (c) obtain a verifiable consent from parents before collecting personal information from kids.  The amendment still leaves areas of uncertainty.  If your child talks to Alexa and your neighbor’s child is also recorded, is that a violation?

Today’s children become internet savvy very early.  Small children love taking to these devices, and parents get a kick out of watching their toddler talk to Alexa.  But, as one woman reported, letting your kids talk to Google or Alexa can create problems.  She was flabbergasted when a dollhouse costing $148.00 was delivered to her home.  Her six-year old daughter ordered the dollhouse through the Amazon Echo.  

How Much Does Your Contract with Amazon or Google Protect You?

One of the sources for this article reviewed the legal documents for Amazon Echo.  In paragraph 1.3 Voice Services:  Amazon informs you that your voice input is processed and retained in the cloud.  Thus, you are on notice that when you use an Echo, your audio recordings will be retained on Amazon servers.  Paragraph 2.1, covering third party services, contains Amazon’s notification that using Echo for third party services means they will send your data to that service.  If you use Echo to control your lights, the power company can obtain your personal data from Amazon, and you are subject to the terms of both Amazon’s data policies and those of the third party.

Paragraph 3.1 tells you Amazon is collecting all sorts of data from your Echo use.  3.6 says if you have a privacy dispute with Amazon, you are subject to binding arbitration.  The Privacy Notice section tells you that Amazon will hand over your personal information when “appropriate to comply with the law.”  This harkens back to the Bentonville case.  If a court issues a subpoena that is specific enough and directly related to a crime or legal dispute, Amazon will turn it over to authorities or to the opposing party in a lawsuit.

How to Protect Your Personal Privacy.

Of course, the easy answer is not to purchase a virtual home assistant, but the convenience of having all these services at the command of your voice is alluring.  If you have an Echo or Google Home or similar device, there are things you can do to protect yourself.

  1. If you are not currently using your device, mute it.  The Echo has a mute button right on top of the device. Google Home’s mute is on the back. Muting will shut off the microphone that is always listening. You can turn it back on when you want to use it.
  2. Don’t connect any sensitive accounts to Echo. Your bank and credit card accounts should not be on this device.
  3. Erase old records.  Erase old recordings on a regular schedule.  With Echo, you can go to your Amazon account, look under “manage my device” and delete the audio recordings.  With Google Home, go to the “my activity” section of your Google account.  Click on “filter by product and date.”  Then, check “voice and audio.”  Like the Echo, you will be able to delete individual recordings or all recordings.
  4. Tighten Device Settings.  If you use Google Home, you can go online and restrict the permissions on your device.  Industry giants like Google and Amazon survive on collecting data from individuals.  You have the right to limit the data they acquire.

Technology is a wonderful tool, and to one degree or another, we are all seduced by its convenience and entertainment value.  Yet, we must always guard against the risk of giving up our civil rights for convenience.  




Amazon Terms of Use:

Google Terms of Service:

Fourth Amendment:


This website has been prepared for general information purposes only. The information on this website is not legal advice. Legal advice is dependent upon the specific circumstances of each situation. Also, the law may vary from state-to-state or county-to-county, so that some information in this website may not be correct for your situation. Finally, the information contained on this website is not guaranteed to be up to date. Therefore, the information contained in this website cannot replace the advice of competent legal counsel licensed in your jurisdiction.