Hacker News Reader

Comment by freehunter | Hacker News Reader

Important to note that if this allegation is true, it means Alexa is recording everyone and storing it indefinitely, not just children. The lawsuit just says children because children have more privacy protections than adults so it's easier to win a case when children's rights are being violated.

View on HN

I'm not sure you can call a documented feature of the product an "allegation". Its well known that Amazon saves voice recordings that the devices capture after the wake word.

https://www.amazon.com/gp/help/customer/display.html?nodeId=...

https://www.usatoday.com/story/tech/talkingtech/2018/05/28/h...

Though I also don't see how Amazon is responsible when parents put a recording device like the Echo, a Nest Cam, a recording baby monitor, a Ring Doorbell, etc in the home and it ends up recording a child.

I completely agree with you that having an Alexa in your home means you must accept that your (i.e. you, the registered user) voice commands are being stored indefinitely.

But to be fair, there is a distinction here. That is, if you're not the registered Alexa user and you're not the one who agreed to the usage terms, shouldn't Amazon try to recognise that your voice is different and not store your voice commands? It's clear they have the recognition tech to do this. I'd say it's a pretty reasonable expectation.

Even if you posit that consent is implicit in using Alexa (i.e. if you use a friend's, for example, in making that choice you're consenting to Amazon storing your voice command) - something that's debatable but certainly within reason - I'd say you definitely can't extend this to children, who simply can't be expected to even know what this means let alone understand the implications.

Soon, on front doors around the country: "By entering this home you agree to our privacy policy, available here [QR code]"

> having an Alexa in your home means you must accept that your (i.e. you, the registered user) voice commands are being stored indefinitely.

is that actually true? That doesn't sound like it's GDPR compliant.

edit: I've just looked into the alexa privacy settings on amazon and it allows me to delete all my recordings from their servers (I'm in Germany, no idea if this is region specific)

> Is that actually true?

I believe it can be disabled.

> That doesn't sound like it's GDPR compliant.

GDPR compliance hasn't been litigated enough to actually know what the term means, so maybe it's not.

> I'm in Germany, no idea if this is region specific.

It's available everywhere.

(IANAL but...) I’m pretty sure it’s legal to record anything within your own home if you’re the one that set it up. That’d cover placing devices that delegate that recording to Amazon.

> California's wiretapping law is a "two-party consent" law. California makes it a crime to record or eavesdrop on any confidential communication, including a private conversation or telephone call, without the consent of all parties to the conversation. See Cal. Penal Code § 632. The statute applies to "confidential communications" -- i.e., conversations in which one of the parties has an objectively reasonable expectation that no one is listening in or overhearing the conversation.

Communication (say over the phone) is different than recording within the four walls of your home.

This is addressed in the comment to which you are replying by the prepositional phrase "including a private conversation".

That’s interesting. I’d have imagined it to be superseded by the castle doctrine.

I’d imagine more of an implied consent angle. In any event the truly paranoid can just put a small notice on the door.

It's sort of a chicken-and-egg scenario. Once someone tells you that there's an active recording device it's no longer a "confidential communication" because you no longer have an "objectively reasonable expectation that no one is listening in or overhearing the conversation". You don't have to stop recording just because someone wants you to stop, you just can't do it without being upfront about it. Home assistant devices are common enough (ads in the superbowl!) that I imagine a judge would consider the physical presence of the device as being reasonable indication that there is no "objectively reasonable expectation that no one is listening in or overhearing the conversation".

No, it's not. It depends on the laws where you are at, but most places usually have something saying if the guest has a reasonable expectation of privacy, then you are not allowed to record.

I don't think you have a reasonable expectation of privacy when someone is speaking into a recording device, after intentionally saying a word to start recording.

And when the Alexa gets confused and records anyway? Or the guest is, at least initially, unaware that an Alexa is present?

Amazon may have some legal responsibilities to avoid the first scenario, but certainly not the second. The legal onus falls upon the resident to inform their guests of any recording devices. Nowhere that I can think of is it illegal to run a recording device in your own residence, or even to do so against the wishes of guests. It is only illegal (in some places) if done secretly. Amazon is well within reason to operate on the assumption that their customers are using their product only in legal ways.

IANAL either, but I’v come to understand that covert recording conversations which you are not party of, is illegal, regardless of the location.

Generally true, but not what's happening. One of the parties in the conversation owns the Alexa device, and it is that party that is recording the conversation. Otherwise, selling recording equipment would be almost universally illegal! If the owner of the Alexa device does not want it to record a conversation it is within their power to turn off the device.

You need to be party of the conversation being recorded. Ownership is irrelevant.

It is impossible for a recording device to be party to a conversation because recording devices are not people. What is of significance is whether the recording device is operating at the direction of a party to the conversation.

Yes, I guess something got lost in translation there.

So, what's not allowed is to

1. Setup a covert recording device in your house.

2. Go to the store/work/gym/zoo.

3. Covertly record your spouses conversation with her secret lover.

4. Use that recording in court.

Plastic bag packaging often says "keep away from children" and maybe privacy invasions should too. You might say there's a big difference in that one is life safety and the other isn't, but there's plenty of non-life-safety messaging applied to products such as "not for street use" on car mods affecting emissions in California. I mean I guess that's life safety at a macro level but then privacy invasions could be too. I think the car part manufacturer could be liable if they don't present a reasonable effort to keep the use of their products well contained.

The difference here is that the illegal part requires active ongoing support from Amazon. If these devices all communicated with a central hub located in the home that was owned and controlled by the user, I think this would be viewed very differently.

Similarly, I don't think a car mod company could plausibly argue their mods weren't for street use if they had cloud support and GPS access but didn't make any effort to go into a street-legal mode when driving on public roads.

“Legal in California only for off-highway use” is a dodge of the law (at least in the intent of the law, though perhaps not in the fact) for at least 95% of products so labeled.

My point is that the dodge wouldn't work if the company had to actively assist in making the product work on a highway and had enough data to determine that the product was being used on a highway.

The dodge relies on customers being in control of whether the law is broken. You can buy any of these products and use them only in a car that you tow between locations where it's legal to use. The dodge works because the company can't tell whether that's what you're doing.

It goes further than that though. People mostly don't have a requirement to police each other's behavior, and by extension companies mostly don't either. It's reasonable to assume that your users use your product in compliance with the law. A cloud storage provider isn't required to ensure that their users aren't storing illegal data like stolen government secrets or child porn. It's certainly within their power to check if the stored data is illegal to possess, but they don't have to, and they're not on the hook to do anything more than turn it over to authorities if the user gets busted.

People providing services that are restricted for children generally do have a duty to make at least a nominal effort to ensure that children aren't using the service. You check ID when selling someone alcohol. You have people indicate that they're 13 or 18 when using your website. If you don't do these simple things, you can be on the hook.

The Alexa version of this is that Amazon says they won't record children without consent. The lawsuit is about whether they're doing this.

The allegation is that Amazon has the ability to differentiate from children vs adults, but still records children and saves the recordings indefinitely without the parents permission if a child says the word "Alexa". I call it an allegation because it's not entirely provable from outside of Amazon.

Did you read the article? That is not what the lawsuit is saying at all. And it would be pretty trivial to figure out if Alexa was recording all the time by putting a sniffer on your network and seeing how much data is being transmitted to the cloud when Alex is on vs. when Alexa is listening to you. Alexa on board does not have the tech to convert speech to text, it sends all the audio to the cloud for that.

I think you misread my comment.

Reply on news.ycombinator.com