Abstract — Smart speakers pose unique privacy concerns due to their always-on microphone, their limited user interface, collection of potentially sensitive data, and integration with third party skills. Given these concerns, there is a need for greater transparency and control over data collection, usage, and sharing by smart speaker platforms as well as third party skills supported on them. To bridge this gap, we build a framework to measure data collection, usage, and sharing by the smart speaker platforms. We apply our framework to the Amazon smart speaker ecosystem. Our results show that Amazon and third parties, including advertising and tracking services that are unique to the smart speaker ecosystem, collect smart speaker interaction data. We also find that Amazon processes smart speaker interaction data to infer user interests and uses those inferences to serve targeted ads to users. Smart speaker interaction also leads to ad targeting and as much as 30X higher bids in ad auctions, from third party advertisers. Finally, we find that Amazon's and third party skills' data practices are often not clearly disclosed in their policy documents.
@inproceedings{Iqbal23IMCAlexaEchos,
title = {Tracking, Profiling, and Ad Targeting in the Alexa Echo Smart Speaker Ecosystem},
author = {Umar Iqbal, Pouneh Nikkhah Bahrami, Rahmadi Trimananda, Hao Cui,
Alexander Gamero-Garrido, Daniel J. Dubois, David Choffnes, Athina Markopoulou,
Franziska Roesner, and Zubair Shafiq},
booktitle = {ACM Internet Measurement Conference (IMC)},
year = {2023}
}
Please contact Umar Iqbal and/or Hao Cui if you run into any problems running the code or if you have any questions about it.