Study Shows Alexa Invades Privacy, Collects User Data for Ad-Targeting
Computer science researchers at the University of California, Davis, have published a collaborative study investigating the extent to which interactions with smart speakers, like Amazon's Echo devices, are being used for ad targeting. The resulting paper titled "Tracking, Profiling, and Ad Targeting in the Alexa Echo Smart Speaker Ecosystem," was recognized last month with a Best Paper Award at the Association for Computing Machinery's 2023 Internet Measurement Conference, the industry's top conference in network measurement.
Zubair Shafiq, an associate professor of computer science whose research focuses on internet privacy and security, and Alexander Gamero-Garrido, an assistant professor of computer science working at the intersection of online privacy and public policy, collaborated with researchers from UC Davis, University of California, Irvine, Northeastern University and the University of Washington to conduct experiments on Alexa Echo smart speakers.
The paper describes the researchers' experimental methods, in which they devised nine different "identities," named for their interest profiles, like Fashion & Style, Health & Fitness, and Pets & Animals. The researchers gave Alexa commands and asked questions pertaining to the different identities' interests, except for their baseline "Vanilla" identity, which had no interests and acted as the control, only collecting data. They then captured network traffic going to and from the devices and collected web ads and bids from web advertisers to infer data usage and sharing.
Not only did this study reveal that Amazon processes user interactions to derive user interests — for instance, Amazon concluded that the Fashion & Style persona was interested in beauty, personal care and clothing — but also that the inferred interests are, in fact, used for ad targeting. Some of the personas, like Health & Fitness and Fashion & Style, received up to 30 times higher advertising bids than the baseline persona.
The research also showed that Amazon did not clearly state these practices anywhere in its privacy policy, and Shafiq pointed out that after the paper's preprint was released in April 2022, Amazon updated its privacy policy to include that Alexa Echo device interaction data is used for ad targeting. The team's research has also been shared with the Federal Trade Commission and the European consumer organization BEUC, been cited in a class-action lawsuit against Amazon, and featured in such news outlets as the Los Angeles Times, The Verge and Axios.
