Study Shows Alexa Invades Privacy, Collects User Data for Ad-Targeting

Two UC Noyce Initiative researchers are co-authors of a recently published a collaborative study investigating the extent to which interactions with smart speakers, like Amazon's Echo devices, are being used for ad targeting.

The resulting paper titled "Tracking, Profiling, and Ad Targeting in the Alexa Echo Smart Speaker Ecosystem," was recognized last month with a Best Paper Award at the Association for Computing Machinery's 2023 Internet Measurement Conference, the industry's top conference in network measurement. 

Zubair Shafiq, an associate professor of computer science at UC Davis College of Engineering, and Athina Markopoulou, a professor of electrical engineering and computer science at UC Irvine, collaborated with other researchers from UC Davis, UC Irvine, Northeastern University and the University of Washington to conduct experiments on Alexa Echo smart speakers.  

The paper describes the researchers' experimental methods, in which they devised nine different "identities," named for their interest profiles, like Fashion & Style, Health & Fitness, and Pets & Animals. The researchers gave Alexa commands and asked questions pertaining to the different identities' interests, except for their baseline "Vanilla" identity, which had no interests and acted as the control, only collecting data. They then captured network traffic going to and from the devices and collected web ads and bids from web advertisers to infer data usage and sharing.  

Not only did this study reveal that Amazon processes user interactions to derive user interests — for instance, Amazon concluded that the Fashion & Style persona was interested in beauty, personal care and clothing — but also that the inferred interests are, in fact, used for ad targeting. Some of the personas, like Health & Fitness and Fashion & Style, received up to 30 times higher advertising bids than the baseline persona.  

The research also showed that Amazon did not clearly state these practices anywhere in its privacy policy, and Shafiq pointed out that after the paper's preprint was released in April 2022, Amazon updated its privacy policy to include that Alexa Echo device interaction data is used for ad targeting.

The team's research has also been shared with the Federal Trade Commission and the European consumer organization BEUC, been cited in a class-action lawsuit against Amazon, and featured in such news outlets as the Los Angeles Times, Associated Press, The Verge and more.