Measuring Alexa Skill Privacy Practices across Three Years

Abstract

If citing, it is advised that you check and use the publisher's definitive version for pagination, volume/issue, and date of publication details. And where the final published version is provided on the Research Portal, if citing you are again advised to check the publisher's website for any subsequent corrections.

Legal Obligation and Ethical Best Practice: Towards Meaningful Verbal Consent for Voice Assistants

“…13). Relating the results to prior work, we note that S35 & S36 align with [9,10,15,51], and that S12, S15, S30, and S36 align with the changes to verbal consent suggested in [41] as well as the potential for multi-agent voice assistants that clearly differentiate between agents through voice [52] (particularly S15). These statements also hint at potential implementations that would mostly require superficial changes to current implementations (e.g., changing the speech prompts used at various stages of the verbal consent process)-we discuss these further in Section 6.…”

“…We see that they align closely with the principles of consent outlined by Im et al [18]: consent should be voluntary (S15, S16), informed (S32, S35, S36), revertible (S12), and unburdensome (S30). Many are also legally required in some form, such as the publishing of privacy policies by entities controlling personal data -although the lack of verification of those policies as in S36 in the voice assistant ecosystem has been the subject of recent research [9,10,15,51]. A clear affirmative action is a legal requirement for consent under the GDPR (Art.…”

“…Similar work examining the efficacy of skill certification showed that policy-violating skills were approved for public use in over 60% cases across the Alexa and Google Assistant skill stores [7]. Finally, others have studied data collection by skills, highlighting the prevalence of third-party software that collects personal data without using the mandatory permissions API and/or having privacy policies that are broken or deficient [9,10,15]. These works show that the number of available skills collecting personal data with broken or problematic privacy policies has been reducing year-on-year but still stands at over a third (36% in 2021).…”

“…Despite this, the GDPR does not forbid a third-party from giving consent on an individual's behalf provided that they have the authority to do so and that the above requirements for consent are met. Tools that allow people to make blanket decisions in advance already exist, such as the Global Privacy Control specification, 9 the EU Interactive Digital Advertising Alliance 'Your Online Choices' tool, 10 and the US Digital Advertising Alliance's 'Your Ad Choices' tool. 11 The key difference is that these tools process opt-outs rather than opt-ins (i.e., they are not concerned with the granting of consent).…”

“…A clear way that this issue manifests is with privacy policies. While Amazon mandates that skills using personal data publish a privacy policy and checks this during the certification process, research over a number of years has shown that in many cases these policies are not checked after certification and are now missing or defective [9,10,15,51]. While developers are and should be responsible for publishing privacy policies that comply with the law, platforms should also have a degree of responsibility for ensuring that the content they host is compliant.…”