Smart speak­ers offer amaz­ing convenience—from play­ing your favorite tunes to re-order­ing toi­let paper—with only a sim­ple voice com­mand. But that con­ve­nience can come with a steep cost in pri­va­cy that many con­sumers aren’t even aware they’re pay­ing.

We’ve all had the uncan­ny expe­ri­ence of search­ing for some­thing on the inter­net and then sud­den­ly ads for that very thing are pop­ping up every­where we look online. It’s no coin­ci­dence, said Umar Iqbal, an assis­tant pro­fes­sor of com­put­er sci­ence and engi­neer­ing at the McK­elvey School of Engi­neer­ing at Wash­ing­ton Uni­ver­si­ty in St. Louis.

“My col­lab­o­ra­tors and I uncov­ered that Ama­zon uses smart speak­er inter­ac­tion data to infer user inter­ests and then uses those inter­ests to tar­get per­son­al­ized ads to the user,” Iqbal said. “That’s some­thing that Ama­zon was not upfront about before our research.”

The team pre­sent­ed its work Oct. 26 at the ACM Inter­net Mea­sure­ment Con­fer­ence in Mon­tre­al, where they received the best paper award. They aim to pro­vide vis­i­bil­i­ty into what infor­ma­tion is cap­tured by smart speak­ers, how it is shared with oth­er par­ties and how it is used by such par­ties, allow­ing con­sumers to bet­ter under­stand the pri­va­cy risks of these devices and the impact of data shar­ing on peo­ple’s online expe­ri­ences.

To crack open the black box around smart devices and the data they cap­ture, the research team built an audit­ing frame­work to mea­sure the col­lec­tion, usage and shar­ing of Ama­zon Echo inter­ac­tion data. First, they cre­at­ed sev­er­al per­sonas with inter­ests in spe­cif­ic cat­e­gories and one con­trol per­sona. Each per­sona inter­act­ed with a dif­fer­ent Echo device, then the researchers mea­sured data col­lec­tion by inter­cept­ing net­work traf­fic and inferred data usage by observ­ing ads tar­get­ed to each per­sona on the web and on Echo devices.

The team report­ed that as many as 41 adver­tis­ers sync or share their cookies—which are typ­i­cal­ly linked to per­son­al information—with Ama­zon, and then those adver­tis­ers fur­ther sync their cook­ies with 247 oth­er third par­ties, includ­ing adver­tis­ing ser­vices.

They also found that Ama­zon did not clear­ly dis­close that users’ smart speak­er inter­ac­tions are used for pro­fil­ing them for the pur­pos­es of ad tar­get­ing. Specif­i­cal­ly, Ama­zon’s gen­er­al pri­va­cy pol­i­cy and Alexa-spe­cif­ic pri­va­cy dis­clo­sures did not men­tion that smart speak­er inter­ac­tions are used for ad tar­get­ing. How­ev­er, after their work’s preprint was released and Ama­zon was made aware, Ama­zon updat­ed the Alexa Pri­va­cy Hub and Alexa Device FAQs to include that Alexa Echo inter­ac­tion data is used for ad tar­get­ing.

“Unfor­tu­nate­ly, sur­veil­lance is the busi­ness mod­el of the inter­net,” Iqbal said. “The issues we iden­ti­fied in our study seem to be part of the design of the smart speak­er ecosys­tem, and the pur­pose of our study is to bring pub­lic trans­paren­cy. In fact, after our work’s preprint was released, Ama­zon updat­ed its dis­clo­sure to include that it uses smart speak­er inter­ac­tion data for ad tar­get­ing.

“Con­sumer pro­tec­tion gov­ern­ment agen­cies, such as the Fed­er­al Trade Com­mis­sion (FTC) in the U.S. and the Euro­pean Con­sumer Orga­ni­za­tion in the E.U., have also shown sig­nif­i­cant inter­est in our find­ings,” Iqbal added.

Whether inter­ven­tions by law­mak­ers or con­sumer-pro­tec­tion agen­cies, includ­ing recent law­suits against Ama­zon by the FTC and con­sumers them­selves, will suc­ceed remains to be seen. Regard­less, Iqbal said it’s impor­tant for con­sumers to be aware of just how much data they’re giv­ing away when they invite smart devices into their homes and how that infor­ma­tion might be used.