Tracking, Profiling, and Ad Targeting in the Alexa Echo Smart Speaker Ecosystem

TL;DR

This paper presents a framework to analyze data collection, usage, and sharing in the Amazon Echo smart speaker ecosystem, revealing extensive tracking, targeted advertising, and opaque privacy disclosures.

Contribution

It introduces a novel measurement framework for smart speaker data practices and applies it to Amazon, uncovering detailed insights into data collection, inference, and ad targeting.

Findings

Amazon collects and processes voice interaction data.

Smart speakers infer user interests for targeted ads.

Data practices are often poorly disclosed in policies.

Abstract

Smart speakers collect voice commands, which can be used to infer sensitive information about users. Given the potential for privacy harms, there is a need for greater transparency and control over the data collected, used, and shared by smart speaker platforms as well as third party skills supported on them. To bridge this gap, we build a framework to measure data collection, usage, and sharing by the smart speaker platforms. We apply our framework to the Amazon smart speaker ecosystem. Our results show that Amazon and third parties, including advertising and tracking services that are unique to the smart speaker ecosystem, collect smart speaker interaction data. We also find that Amazon processes smart speaker interaction data to infer user interests and uses those inferences to serve targeted ads to users. Smart speaker interaction also leads to ad targeting and as much as 30X higher bids in ad auctions, from third party advertisers. Finally, we find that Amazon's and third party skills' data practices are often not clearly disclosed in their policy documents.