Smart speaker work awarded Best Paper at IMC 2023
Congratulations to the ProperData team and collaborators, Umar Iqbal (Washington University in St. Louis), Pouneh Nikkhah Bahrami (UCD), Rahmadi Trimananda (UCI), Hao Cui (UCI), Alexander Gamero-Garrido (UCD), Daniel J. Dubois (NU), and PI’s David Choffnes (NU), Athina Markopoulou (UCI), Franziska Roesner (collaborator, University of Washington), and Zubair Shafiq (UCD) for being awarded the Best Paper Award at the Internet Measurement Conference (IMC) 2023 for “Tracking, Profiling, and Ad Targeting in the Alexa Echo Smart Speaker Ecosystem”. The paper is available at: https://dl.acm.org/doi/10.1145/3618257.3624803 and on our publications page. IMC is the top conference in network measurement. This work went viral as soon as it was released on arXiv in April 2022. News outlets that covered the work include: The Verge (April 2022), The Register (April 2022), Axios (June 2022), APNews, The Data Skeptic Podcast (Aug. 2022), Repubblica, Fox News (Aug. 2022), MuckRack TV report, LA Times (Aug. 2022), PCMag, Reddit, YCombinator News, Breitbart, ABP Live, News18 and more. It was also invited for presentation to the Federal Trade Commission (FTC)’s flagship PrivacyCon workshop in 2022.
Overview: This study focuses on smart speakers—specifically the Alexa ecosystem—and how they collect and use voice data, for purposes beyond providing essential functionality to the users. We are particularly concerned that data usage for non-essential purposes might not be disclosed to users or might violate users’ expectations of privacy. A key challenge for understanding how IoT devices collect and use user data is that they are opaque in nature, i.e., do not provide interfaces to monitor data practices of apps and the platform. In this research, we built a framework to uncover how the Alexa ecosystem and third-party Alexa skills use voice data, without relying on support from the platform vendors. Our key idea is to expose carefully crafted user data to a device (e.g., by interacting with it) and then to measure the statistically significant usage of the exposed data in the personalized content delivered to the user (e.g., personalized advertisements).
We found that all Alexa skills share data with Amazon, and 8.3% of Alexa Echo network traffic corresponds to advertising and tracking services. We found evidence from Amazon-reported data that they process users’ smart speaker interactions (e.g., metadata) to infer their interests, something Amazon was not upfront about before our research (Alexa Privacy Hub archived, Alexa Device FAQs archived). After our paper was released, Amazon updated their disclosures (Alexa Privacy Hub, Alexa Device FAQs) to now state clearly that they indeed use smart speaker interactions for ad targeting.
We also found that user data is used for ad targeting. Specifically, when we expose user data, advertisers bid higher (as much as 30x) as compared to when we do not expose data. Additionally, the ad content is also relevant to exposed data (i.e., related to skills). Third party skills also do not disclose their data collection and usage practices: nearly 58% of skills do not provide a privacy policy and the ones that do, do not specify that they are for Alexa Echos. Only a handful of skills (2% of tested) clearly disclose their data practices.
We shared our findings (publicly and privately) with regulatory bodies in the US (Federal Trade Commission) and in the EU (the European Consumer organization).
Selected Media Coverage:
Amazon keeps growing, and so does its cache of data on you, The Los Angeles Times, August 23, 2022.
Ad Targeting in Amazon Smart Speakers, Data Skeptic (Podcast), August 22, 2022.
Lawsuit claims Amazon using Alexa to target ads at customers, Axios, June 16, 2022.
Ad Targeting Segment, Fox 12 KPTV-TV, May 1, 2022.
Report Reveals How Amazon Uses Alexa Voice Data for Targeted Ads, PC Mag, April 29, 2022.
Researchers find Amazon uses Alexa voice data to target you with ads, The Verge, April 28, 2022.
Study: How Amazon uses Echo smart speaker conversations to target ads, The Register, April 27, 2022.
Selected Institutional coverage:
WashU Expert: Your smart speaker data is used in ways you might not expect, WUSTL The Source|Newsroom, October 26, 2023.
Study Shows Alexa Invades Privacy, Collects User Data for Ad-Targeting, UC Davis Computer Science News, November 16, 2023.
Alexa Smart Speaker Investigation Earns Privacy Researchers Best Paper Award, UC Irvine School of Engineering News|Samueli Shoutouts, Nov 20, 2023.