Amazon Alexa Secretly Records Children, Lawsuits Allege | Hacker News Reader

Amazon Alexa Secretly Records Children, Lawsuits Allege

threatpost.com

93 pointsgexos48 comments

I mean, not secretly. Amazon is very explicit that it saves recordings of all commands for training and personalization -- you can even manually review and delete them, or disable them completely.

And obviously if you have your children speak to Alexa, it will record them too. Same with visitors in your home. It's not a secret... it's how it works.

Alexa does support voice profiles. But it's certainly not perfect -- voice identification can be hard even for people to do (depending on similarity), and there's a huge leap from distinguishing between pre-identified voices, versus determining if a voice is one of those and not one of billions of other people. And there's certainly no magic way to analyze a voice a determine that it's 12 (not allowed) or 13 (allowed).

So I'm not exactly sure what this lawsuit intends to change?

The only thing I can imagine is perhaps to allow disabling voice recordings per voice profile, so you can create a voice profile of your child and then do that -- but intriguingly, Amazon says voice profiles can only be created for users 13+, so there's presumably something legal here.

But really, if you don't want your kids (or visitors) using Alexa, either tell them not to use it, or don't have one in the first place. I really can't see how this is up to anyone other than the parents?

"but intriguingly, Amazon says voice profiles can only be created for users 13+, so there's presumably something legal here"

Presumably if they're banned from storing and processing the information of under-13s, that includes doing so for the purposes of identifying that individual as under-13.

well then, that's simply an impossible condition (if you can't find out whether they're under 13, then you can't comply, and if you do try to find out, you aren't complying: there's no way out)

Throw out audio for any non registered profile.

Important to note that if this allegation is true, it means Alexa is recording everyone and storing it indefinitely, not just children. The lawsuit just says children because children have more privacy protections than adults so it's easier to win a case when children's rights are being violated.

I'm not sure you can call a documented feature of the product an "allegation". Its well known that Amazon saves voice recordings that the devices capture after the wake word.

https://www.amazon.com/gp/help/customer/display.html?nodeId=...

https://www.usatoday.com/story/tech/talkingtech/2018/05/28/h...

Though I also don't see how Amazon is responsible when parents put a recording device like the Echo, a Nest Cam, a recording baby monitor, a Ring Doorbell, etc in the home and it ends up recording a child.

I completely agree with you that having an Alexa in your home means you must accept that your (i.e. you, the registered user) voice commands are being stored indefinitely.

But to be fair, there is a distinction here. That is, if you're not the registered Alexa user and you're not the one who agreed to the usage terms, shouldn't Amazon try to recognise that your voice is different and not store your voice commands? It's clear they have the recognition tech to do this. I'd say it's a pretty reasonable expectation.

Even if you posit that consent is implicit in using Alexa (i.e. if you use a friend's, for example, in making that choice you're consenting to Amazon storing your voice command) - something that's debatable but certainly within reason - I'd say you definitely can't extend this to children, who simply can't be expected to even know what this means let alone understand the implications.

Soon, on front doors around the country: "By entering this home you agree to our privacy policy, available here [QR code]"

> having an Alexa in your home means you must accept that your (i.e. you, the registered user) voice commands are being stored indefinitely.

is that actually true? That doesn't sound like it's GDPR compliant.

edit: I've just looked into the alexa privacy settings on amazon and it allows me to delete all my recordings from their servers (I'm in Germany, no idea if this is region specific)

> Is that actually true?

I believe it can be disabled.

> That doesn't sound like it's GDPR compliant.

GDPR compliance hasn't been litigated enough to actually know what the term means, so maybe it's not.

> I'm in Germany, no idea if this is region specific.

It's available everywhere.

(IANAL but...) I’m pretty sure it’s legal to record anything within your own home if you’re the one that set it up. That’d cover placing devices that delegate that recording to Amazon.

> California's wiretapping law is a "two-party consent" law. California makes it a crime to record or eavesdrop on any confidential communication, including a private conversation or telephone call, without the consent of all parties to the conversation. See Cal. Penal Code § 632. The statute applies to "confidential communications" -- i.e., conversations in which one of the parties has an objectively reasonable expectation that no one is listening in or overhearing the conversation.

Communication (say over the phone) is different than recording within the four walls of your home.

This is addressed in the comment to which you are replying by the prepositional phrase "including a private conversation".

That’s interesting. I’d have imagined it to be superseded by the castle doctrine.

I’d imagine more of an implied consent angle. In any event the truly paranoid can just put a small notice on the door.

It's sort of a chicken-and-egg scenario. Once someone tells you that there's an active recording device it's no longer a "confidential communication" because you no longer have an "objectively reasonable expectation that no one is listening in or overhearing the conversation". You don't have to stop recording just because someone wants you to stop, you just can't do it without being upfront about it. Home assistant devices are common enough (ads in the superbowl!) that I imagine a judge would consider the physical presence of the device as being reasonable indication that there is no "objectively reasonable expectation that no one is listening in or overhearing the conversation".

No, it's not. It depends on the laws where you are at, but most places usually have something saying if the guest has a reasonable expectation of privacy, then you are not allowed to record.

I don't think you have a reasonable expectation of privacy when someone is speaking into a recording device, after intentionally saying a word to start recording.

And when the Alexa gets confused and records anyway? Or the guest is, at least initially, unaware that an Alexa is present?

Amazon may have some legal responsibilities to avoid the first scenario, but certainly not the second. The legal onus falls upon the resident to inform their guests of any recording devices. Nowhere that I can think of is it illegal to run a recording device in your own residence, or even to do so against the wishes of guests. It is only illegal (in some places) if done secretly. Amazon is well within reason to operate on the assumption that their customers are using their product only in legal ways.

IANAL either, but I’v come to understand that covert recording conversations which you are not party of, is illegal, regardless of the location.

Generally true, but not what's happening. One of the parties in the conversation owns the Alexa device, and it is that party that is recording the conversation. Otherwise, selling recording equipment would be almost universally illegal! If the owner of the Alexa device does not want it to record a conversation it is within their power to turn off the device.

You need to be party of the conversation being recorded. Ownership is irrelevant.

It is impossible for a recording device to be party to a conversation because recording devices are not people. What is of significance is whether the recording device is operating at the direction of a party to the conversation.

Yes, I guess something got lost in translation there.

So, what's not allowed is to

1. Setup a covert recording device in your house.

2. Go to the store/work/gym/zoo.

3. Covertly record your spouses conversation with her secret lover.

4. Use that recording in court.

Plastic bag packaging often says "keep away from children" and maybe privacy invasions should too. You might say there's a big difference in that one is life safety and the other isn't, but there's plenty of non-life-safety messaging applied to products such as "not for street use" on car mods affecting emissions in California. I mean I guess that's life safety at a macro level but then privacy invasions could be too. I think the car part manufacturer could be liable if they don't present a reasonable effort to keep the use of their products well contained.

The difference here is that the illegal part requires active ongoing support from Amazon. If these devices all communicated with a central hub located in the home that was owned and controlled by the user, I think this would be viewed very differently.

Similarly, I don't think a car mod company could plausibly argue their mods weren't for street use if they had cloud support and GPS access but didn't make any effort to go into a street-legal mode when driving on public roads.

“Legal in California only for off-highway use” is a dodge of the law (at least in the intent of the law, though perhaps not in the fact) for at least 95% of products so labeled.

My point is that the dodge wouldn't work if the company had to actively assist in making the product work on a highway and had enough data to determine that the product was being used on a highway.

The dodge relies on customers being in control of whether the law is broken. You can buy any of these products and use them only in a car that you tow between locations where it's legal to use. The dodge works because the company can't tell whether that's what you're doing.

It goes further than that though. People mostly don't have a requirement to police each other's behavior, and by extension companies mostly don't either. It's reasonable to assume that your users use your product in compliance with the law. A cloud storage provider isn't required to ensure that their users aren't storing illegal data like stolen government secrets or child porn. It's certainly within their power to check if the stored data is illegal to possess, but they don't have to, and they're not on the hook to do anything more than turn it over to authorities if the user gets busted.

People providing services that are restricted for children generally do have a duty to make at least a nominal effort to ensure that children aren't using the service. You check ID when selling someone alcohol. You have people indicate that they're 13 or 18 when using your website. If you don't do these simple things, you can be on the hook.

The Alexa version of this is that Amazon says they won't record children without consent. The lawsuit is about whether they're doing this.

The allegation is that Amazon has the ability to differentiate from children vs adults, but still records children and saves the recordings indefinitely without the parents permission if a child says the word "Alexa". I call it an allegation because it's not entirely provable from outside of Amazon.

Did you read the article? That is not what the lawsuit is saying at all. And it would be pretty trivial to figure out if Alexa was recording all the time by putting a sniffer on your network and seeing how much data is being transmitted to the cloud when Alex is on vs. when Alexa is listening to you. Alexa on board does not have the tech to convert speech to text, it sends all the audio to the cloud for that.

I think you misread my comment.

It's an always-on Internet connected home microphone. What do people think it is doing?

That description fits your cell phone too, except it’s “everywhere you go” rather than “home.” Do you expect it to record you?

The cell phone is not voice activated. That said, I do expect the worst of it.

Isn’t that literally what “Hey Siri”, “Ok Google”, etc. are?

You can (and probably should) disable Siri on an iPhone and the phone works just great without it.

It can be. Both as a user-activated and potentially remotely via a security vulnerability.

Every smartphone has access some sort of assistant whether its Siri, Google, Alexa or even Cortana. Some of those come out of the box with annoying defaults.

Not that you know of....

The celphone does in fact record you. I don't care what THEY say publicly.

What “fact” backs this suspicion?

The critical question clearly seems to be what evidence do the plaintiffs have?

Presumably, the plaintiffs could at the least have records of various advertising that is uncannily targeting related subject matter to what the children may have been consuming and outputting, though I wonder how they could prove that the children didn't inadvertently activate Alexa and provide this data. Perhaps that is enough to subpoena Amazon?

It seems like the marketing industry will be at the front line of the battle over what age is enough to give your own consent in many aspects of life, and I personally am standing on the other side of that line.

I hear that some scandanavian regions have laws prohibiting adverters from targeting children, and I wonder how tech companies will deal with such restrictions.

No, they're talking about the recordings made when people say the wake word. People, especially children, probably don't know that this recordings are stored indefinitely: “At no point does Amazon warn unregistered users that it is creating persistent voice recordings of their Alexa interactions, let alone obtain their consent to do so.”

Someone in my network who is in marketing at Alexa accidentally linked to one of these articles instead of an internal blog announcing a new feature for kids.

Reply on news.ycombinator.com