Echo Look Revives Debate on Privacy Concerns

If you were told you could purchase a device which listens to everything you say throughout the day, and occasionally records what you say, you’d understandably be less than excited to buy now.  However, when that device comes with enormous potential for convenience–like the Amazon Echo or the Google Home–many have decided that the privacy concerns are not so bad as to put them off the device.

For those unfamiliar, the Amazon Echo (commonly referred to by the name it answers to-Alexa) and the Google Home are very similar to the Cortana or Siri devices on your phone-they take verbal commands and quickly send your request to a server which attempts to find an answer which is as responsive to your query as possible.  The main difference between the products is that while Siri is a tool you activate on your phone, the Echo and the Home are devices you place in your home and essentially leave on to respond to you whenever needed.

While on, these devices are always listening to what you say in order to listen for a “wake word” or command to start paying attention to whatever you say next.  Always listening does not mean always recording, both the Home and Alexa begin recording whatever you say as soon as you say a wake word-this recorded audio is sent to a server, associated with your personal account, and stored.

This obviously created enormous privacy concerns when these devices were initially released.  However, some but not all of the concerns were abated by the fact that you can mute the microphone when the devices are not in use-rendering the device useless until unmuted but keeping it from listening in general.  You can also disable audio recording and data sharing altogether for the Home but not the Echo.  However, doing so makes the Home completely inoperable.  Finally, you can delete your history of recorded requests online for both products-although both Google and Amazon recommend against it and neither are clear as to what data is stored after deletion.

These provisions, along with the privacy policies of both companies, have helped alleviate some-but not all of the privacy concerns since the products were released.  However, just recently, Amazon has announced the Echo Look-a product which adds a whole new layer of privacy concerns to the mix.

The Echo Look

The Echo Look is essentially the Echo but with a camera which records and takes pictures of your outfits at your request.  At the moment, Amazon has said that the Echo Look is limited to pictures of fashion and the room you’re in.  However, they have made no assurances that this will continue to be the case.

As you might imagine, an enormous amount of information can be gleaned from any given picture and a company with as developed a machine learning algorithm for identifying what’s what in a picture as Amazon could parse the information in any given picture with great ease-then likely use that information to employ more targeted advertising for you.

Amazon Echo Look seems to be fairly secure, with numerous encryptions and security measures protecting the pictures you take and the camera itself.  This is good, cameras of this sort have a bit of history of poor security.  It was not so long ago that a search engine called Shodan was launched which allowed users to search and browse unsecured webcams.

You can see the privacy concerns raised by the Echo, Home, and Echo Look.  However, what does this mean from a legal standpoint?  The truth is, privacy law-beyond a few federal statutes-is primarily a matter of state by state legislation.  This is especially true in California where the state constitution explicitly includes a right to privacy.  However, no matter where you are, there are a few issues which could always come up as part of or as cause for a legal action.  Where your private data is breached by an outside party, an increasingly common occurrence, that can give rise to a lawsuit.  What’s more, companies are generally bound to their own privacy policies.  Where they ignore their own policy or mislead a consumer as to their privacy policies this can lead to legal hot water.    Finally, you have to ask how the data collected by these companies may be used by law enforcement.

Privacy Policies of the Echo and the Home

Both the Home and the Echo follow the privacy policies of the companies that made them-Google and Amazon respectively.  These are two companies with that gather and employ an enormous amount of data on their users.  Thus, they both have fairly robust privacy policies.  However, this does not mean that they will not and do not use or sell the data they collect about you.

Google’s privacy policy for the Home specifically states: “Google will share your information with companies, organizations, and individuals outside of Google if Google has a good-faith belief that access, use, preservation, or disclosure of the information is reasonably necessary to meet applicable law, regulation, legal process, or enforceable government request.” In short, it appears that Google doesn’t ask for your permission to share your voice recordings.”  They do promise not to share your personal information with anyone.  However, in a legal context this likely applies to personally identifiable information-information that can be used to identify you.  Other data, such as commonly sold aggregate data (information stripped of identifiers and sold to advertisers) is still fair game.  What’s more, they also do not limit their own uses of your data and likely use the information for targeted advertising purposes.

The Amazon Echo privacy policies are similar-allowing them the same leeway as Google’s policy.   However, both the Echo and the Echo Look policies promise explicitly not to use the data they collect to provide targeting advertising opportunities to  third-party companies.  They even give you the option to opt out of Amazon targeted advertising at this link.

One thing you’ll note in the Google policy, which is shared by the Amazon policy, is that it leaves the door open to share your data with law enforcement where required by law.  This makes sense, neither Amazon nor Google are looking to defy a valid court order.  However, the idea that the police might make use of all the data recorded on your device might be a bit concerning to some-and it’s a concern that has already come up in court.

Will Your Data Be Shared?

Just a few months back, Arkansas police sought a warrant demanding that Amazon turn over all the information recorded from the Amazon Echo of a murder suspect out of Bentonville by the name of James Andrew Bates.  After one Victor Collins was found dead in Mr. Bates’ hot tub, the police noted his Amazon Echo and sought the data from it.

Amazon initially resisted the demand for the evidence, arguing that the First Amendment protected the information recorded from the Echo and, because of this, the police needed to show a compelling need to access the information and no other way to get it.

At a minimum, a valid warrant requires probable cause (a fairly low standard requiring only a reasonable basis for believing evidence could be contained in the thing or place to be searched) and it must describe with particularity what the search would seek to find.

Searching through data to find evidence of a crime is nothing new, police have searched everything from cell phones to World of Warcraft chat logs.  These often require subpoenas or warrants to gather this information from a third party such as Amazon.  Here, there were a few potential issues with receiving a warrant-even beyond Amazon’s First Amendment arguments.  First, probable cause is a low bar-but it isn’t nothing.  The theory that an always-on recording device might have recorded information related to the crime is likely enough to meet the standard where it recorded near the crime.  However, the basis is a bit thin when you consider the device only records when a “wake word” is spoken.  Second, the warrant just asked for everything Amazon had ever recorded.  This in no way describes with particularity what is to be produced.  The police are very unlikely to need the times Mr. Bates asked Alexa how many feet are in a mile or for a good recipe for pork shoulder.

However, despite these issues, Amazon did end up producing the requested searches.  This was not because a court ruled against them, but rather because Mr. Bates ultimately consented to release the recordings of his own volition.  This left the issue without a satisfying conclusion as to legal precedent.  However, in the right circumstances, law enforcement could almost certainly obtain the data recorded from a Home, Echo, or Echo Look.

Is It Worth It?

As it is, trading privacy for convenience is so common in today’s online world as to be nearly unavoidable.  When it comes to the Echo or the Home, you have to ask yourself whether that trade off is worth it to use these devices.  Ultimately, all you can do is know your rights and make that decision for yourself.