Amazon and 3rd parties can keep Alexa records after customers delete them

[Delicieuxz]

US senator Chris Coons wrote Amazon some questions about how they handle Alexa customer data, and in a letter dated June 28, Amazon responded with some details about Alexa's behaviour.

 

I'm not sure that any of the information given by Amazon's Public Policy vice president, Brian Huseman, is very eventful, but one paragraph does mention that 3rd-party developers can retain records of Alexa user interactions:

Quote

When a customer deletes a voice recording, we delete the transcripts associated with the customer’s account of both of the customer’s request and Alexa’s response. We already delete those transcripts from all of Alexa’s primary storage systems, and we have an ongoing effort to ensure those transcripts do not remain in any of Alexa’s other storage systems. We do not store the audio of Alexa’s response. However, we may still retain other records of customers’ Alexa interactions, including records of actions Alexa took in response to the customer’s request. And when a customer interacts with an Alexa skill, that skill developer may also retain records of the interaction. For example, for many types of Alexa requests – such as when a customer subscribes to Amazon Music Unlimited, places an Amazon Fresh order, requests a car from Uber or Lyft, orders a pizza from Domino’s, or makes an in-skill purchase of premium digital content – Amazon and/or the applicable skill developer obviously need to keep a record of the transaction. And for other types of Alexa requests – for instance, setting a recurring alarm, asking Alexa to remind you of your anniversary, placing a meeting on your calendar, sending a message to a friend – customers would not want or expect deletion of the voice recording to delete the underlying data or prevent Alexa from performing the requested task.

 

An example of Amazon not deleting data relevant to a user-requested task might be this test, where Amazon's Echo Dot device for kids is asked to remember certain information, and then that information is instructed to be deleted, but the Echo Dot still remembers all of the remembered-and-then-deleted data afterwards:

 

 

If that is an example of what Amazon is talking about, then I think that the deliberate and wilful process of deleting that information from the device should overrule any other prerogative the device might have had over that data.

 

Also, while Amazon says, "customers would not want or expect deletion of the voice recording to delete the underlying data or prevent Alexa from performing the requested task", the fact is that if a customer deliberately asks for specific data to be deleted, then they obviously do want and expect that data to be deleted.

 

 

July 3rd, Chris Coons wrote on his website:

Quote

I appreciate that Amazon responded promptly to my concerns, and I’m encouraged that their answers demonstrate an understanding of the importance of and a commitment to protecting users’ personal information. However, Amazon’s response leaves open the possibility that transcripts of user voice interactions with Alexa are not deleted from all of Amazon’s servers, even after a user has deleted a recording of his or her voice,” said Senator Coons. “What’s more, the extent to which this data is shared with third parties, and how those third parties use and control that information, is still unclear.

Amazon's words in their response sound innocuous on their own, but when they're matched to the test video of an Echo Dot device not deleting the data it was asked to delete I think it's seen that Amazon's words could be more PR than straight-forward.

 

And with there having been various other customer-data incidents involving Amazon's listening devices, I think more scrutiny of what is actually going on needs to be done.

 

Amazon Workers Are Listening to What You Tell Alexa

Woman says her Amazon device recorded private conversation, sent it out to random contact

Alexa, what’s my neighbor doing? ‘Human error’ allows user to eavesdrop on stranger’s life

 

[RejZoR]

What's the point of delete function then? That's straight up deception. So, easiest way to get scott free from any responsibility is to shuffle the data to a "contractor" and you lose any obligation to the user data since it has been already "handed over". That's just straight up BS.

[HarryNyquist]

Wow, who would have guessed.

Keep in mind Prime Day is going on. Go look how heavily discounted these Alexa devices are. Think about how Amazon is about to get a MASSIVE injection of user data.

[Unixsystem]

6 hours ago, huilun02 said:

Its the internet. What goes up doesnt come down. I dont know why people still expect big corporations to ever go out of their way to respect privacy, when it is obvious that doing so means losing a huge money making opportunity.

 

The whole 'fight for privacy' move is so hopeless that even governments are against privacy. People need to take action and responsibility if they seriously want privacy. I'm talking about going to extremes to block online ads and scripts, and regain low level control over app permissions to stop tracking and telemetry.

 

Its a hopeless losing battle for anyone who expects some group or organisation to eventually hand their privacy back on a silver platter. 

So should everyone just give up and roll over? Yes, it's a losing battle (in many ways an already lost battle), but there's zero benefit to just taking a full nihilistic approach and saying "screw it, take it all". 

 

If there's even a 1% chance of motivating enough government officials to actually change the laws on the matter, it could be the beginning of a shift in the way people view their data and privacy. It won't change overnight and maybe not in our lifetimes, but I'll take a slim chance over none at all. 

[mr moose]

Whilst I don't trust amazon and will never have any of these devices,  because they are likely just lying,  what they have said is that they will delete everything except current active notifications and business requests.  Given that voice recordings is likely the only evidence they have of a chargeable service/product being requested that is a fair expectation. 

 

 

[mr moose]

31 minutes ago, valdyrgramr said:

They wouldn't do that.

I know, I said I don't trust them,  but it is important to not misrepresent what people are saying, especially if you are engaging in a public debate.     I see it so many times, a legitimate issue that should be denounced becomes the victim and defended because some public lobby group lied and misrepresented the issues in an effort to get it closed down.

 

 

And besides that, whenever I read "A US politician has questioned *insert public issues here*"  What I actually read is "US politician is paying lip service to an issue while he sets up the opposite in law when you are not watching"

 

 

[GOTSpectrum]

I honestly think if you get one of these devices then you are inviting the private corporations into your lives.

 

Honestly it is scary, I have recently been deleting as much data as I can using GDPR as my weapon. I can only hope they these corporations far the EU enough to follow through... 

[Tristerin]

This is my surprised face:

 

 

 ' '

 >

---

[orbitalbuzzsaw]

Excuse me as I fail to be surprised.

[Bananasplit_00]

I'm not surprised, Google probably does the same with their garbage "pay to install a bug" devices too.

 

One of these "smart speakers" or whatever is not staying in my home for more than a minute before it goes out the window or I stomp it. These devices should not exist and nobody should buy one.

[williamcll]

I wonder should I get a job as a Big data analyst when I graduate.