Smart speakers are surveillance devices that happen to play music. They record audio constantly, analyze it for wake words, store transcripts indefinitely, and create detailed profiles of your behavior. The privacy risks extend beyond Amazon and Google to include device manufacturers, ISPs, and anyone on your network.
This guide explains what smart speakers actually collect, how to audit them, and what privacy-respecting alternatives exist.
What Smart Speakers Collect
Audio and Transcripts
Continuous recording:
- Alexa and Google Home maintain a local audio buffer (10-60 seconds)
- When you say the wake word (“Alexa” or “Hey Google”), they upload the preceding audio and all subsequent audio until the command ends
- This audio is stored indefinitely
Example capture:
User says: "Alexa, what's the weather?"
Captured audio: [5 seconds before "Alexa"] + "Alexa, what's the weather?"
Transcript stored: "what's the weather"
Audio file kept: Yes (encrypted, but Amazon controls decryption key)
Retention: Indefinite by default; you can delete manually but must opt-in to auto-delete
Wake word false positives:
- “Alexa” triggers on similar sounds (“taxi,” “next,” background conversations)
- False positive uploads happen dozens of times daily in households
- Your private conversations are uploaded because Alexa mistakenly heard its wake word
Location Data
Smart speakers collect:
- WiFi network names (SSID) and MAC addresses (used to triangulate location)
- Your public IP address (reveals approximate city)
- GPS data if paired with a mobile device
- Zip code you provide during setup
Why it matters:
- Amazon/Google build location profiles across all your devices (phone, speaker, Fire tablets)
- This is sold to advertisers, shared with marketers, used for targeted ads
- Law enforcement can subpoena this data
Device Usage Patterns
What they track:
- Wake word frequency (when you ask questions, rough times)
- Skills/actions used (shopping, music streaming, smart home control)
- Query topics (health, financial, political searches through Alexa)
- Response times and errors (diagnostic data)
Aggregated profiles:
- “This household is interested in health and fitness” (frequent weather/gym questions)
- “Two-income household, 8-5 work schedule” (usage patterns show when home)
- “Lives with elderly parent” (frequent caregiver-related queries)
Shopping and Financial Data
Direct capture:
- Everything you order through Alexa (“Alexa, order dog food”)
- Amazon account linked to speaker (your purchase history)
- Payment methods (Amazon Pay)
Inference:
- Diet patterns (food orders)
- Health conditions (health product searches)
- Income level (brand preferences)
- Political affiliation (news/podcast consumption)
Smart Home Device Network Topology
When you connect smart home devices (Philips Hue, Nest, August locks):
- Google/Amazon know your home layout (“Kitchen light,” “Front door lock”)
- They know your devices, brands, and configurations
- This reveals security vulnerabilities (type of lock, camera models)
Network Traffic Analysis: What Leaves Your Home
Passive Monitoring Setup
To audit what your speaker sends, capture network traffic:
# On macOS/Linux with Wireshark installed
# Or use Charles Proxy for HTTP/HTTPS traffic
# Monitor all traffic from your smart speaker's IP
# 1. Find speaker IP: Router → Connected Devices → Find "Echo" or "Google Home"
# 2. Use Wireshark: Capture → Options → Interface selection
# 3. Filter by speaker IP: ip.addr == 192.168.1.100
# What you'll see:
# - Outbound connections to Amazon/Google servers
# - DNS queries (what domains are contacted)
# - Periodic "heartbeat" packets (always-on connection)
# - Data volume transferred
Common Outbound Connections
Amazon Alexa:
Primary servers:
- alexa-comms-service.amazon.com (command processing)
- metering.prod.us-east-1.amazonaws.com (usage metrics)
- cognito-idp.us-east-1.amazonaws.com (authentication)
- s3.amazonaws.com (downloading updates)
Frequency:
- Every 5 seconds: "heartbeat" keep-alive packet (confirms speaker is alive)
- Every 60 seconds: metrics upload (what you asked, when)
- Every 24 hours: device telemetry (usage patterns)
Data volume:
- Average: 150MB/month (mostly updates, some audio uploads)
- Spike hours: 2-4 AM (scheduled data sync)
Google Home:
Primary servers:
- googlemsyncd.clients.google.com (sync service)
- mcs.gstatic.com (message service)
- assistant.google.com (AI processing)
Frequency:
- Every 10 seconds: heartbeat
- On wake word: full upload of audio + metadata
Data volume:
- Average: 100MB/month (less than Alexa)
- Usage spikes: During music streaming (up to 500MB if playing music)
DNS Queries (Even More Revealing)
DNS queries show what you’re trying to access without needing to decrypt HTTPS:
Observed DNS queries from Echo device:
- bbc.co.uk (you asked about BBC news)
- weather.com (weather queries)
- aol.com (you own an AOL email)
- myfitnesspal.com (you linked fitness app)
- grubhub.com (you searched for food delivery)
Why this matters:
- ISP can see these queries
- ISP sells DNS query patterns to advertisers
- Law enforcement can subpoena DNS logs
Mute: Hardware vs. Software
The Mute Button Problem
What people think:
- Press the mute button (red ring on Alexa)
- Speaker stops listening
- Privacy protected
What actually happens:
Muted: Microphone is disabled
✓ Local voice processing stops
✗ Uplink to Amazon still active (heartbeat)
✗ You can no longer give commands (device is non-functional)
Problem: You cannot tell if Amazon is still recording through software
- Hardware mute only disables local mic
- If there's a software vulnerability, Amazon could re-enable recording
- No way to verify the mute works without technical analysis
Safer Approach: Unplug Entirely
Physically disconnected:
✓ No heartbeat packets sent
✓ No possibility of remote re-activation
✓ Complete privacy guarantee
✗ Device is non-functional (requires replug for voice commands)
Practical compromise:
- Keep speaker plugged in (for normal use)
- Unplug during private conversations (therapy calls, medical appointments, intimate moments)
- Use wired headphones for sensitive queries (reduces ambient audio capture)
Verify Mute Actually Works (Technical)
# While speaker is "muted," capture network traffic
# Command: tcpdump -i en0 -c 100 host 192.168.1.100
# If you see regular packets to Amazon, the mute may not be working
# If no packets appear, the network connection is actually disabled
# Safe assumption: Always assume the speaker is listening until physically disconnected
Privacy-Hardened Configurations
Amazon Alexa
If you insist on using Alexa, harden it:
1. Disable Voice Purchase
- Settings → Alexa Account → Login & Security
- Disable “Purchase by Voice”
- Require 4-digit code for all purchases
- Prevents accidental/fraudulent orders
2. Auto-Delete Audio
- Settings → Alexa Privacy → Manage Your Alexa Data
- Choose “Delete recordings automatically”
- Set to: Delete every 3 months (or ASAP option if available)
- By default, Amazon keeps audio forever
3. Disable Skills You Don’t Use
- Settings → Skills & Games → Your Skills
- Uninstall any skills you didn’t explicitly enable
- Reduces data collection pathways
4. Disable Drop In / Alexa Calling
- Settings → Communication
- Disable “Drop in” (allows other people to listen through your speaker)
- Disable “Calling” (links speaker to your phone number)
5. Disable Smart Home Integration
- Settings → Smart Home Devices
- Delete any smart home device integrations
- Reduces topology data Amazon collects
6. Create Separate Amazon Account
- Use a separate Amazon account for Alexa (not your main one)
- Don’t link your shopping/financial account
- Limits cross-profile tracking
7. Disable Device Analytics
- Settings → Alexa Privacy
- Disable “Help Improve Alexa”
- Prevents diagnostic data upload (minimal but helpful)
Google Home
1. Turn Off Web & App Activity
- settings.google.com → Security → Manage your Google Account
- Go to “Data & Privacy”
- Disable “Web & App Activity”
- Prevents linking searches to your account
2. Delete Search History Regularly
- settings.google.com → Data & Privacy
- Choose auto-delete options (set to 3 months)
- Manually delete weekly
3. Disable Personalization
- Google Home app → Settings → Personal Results
- Toggle “Off”
- Speaker won’t build profile about you
4. Restrict Smart Home Access
- Similar to Alexa: delete unused devices
5. Use a VPN on Home WiFi
- Route all home traffic through VPN
- VPN encrypts even network traffic, preventing ISP tracking
- Example: Mullvad VPN (no logs, €5/month)
Privacy-Respecting Alternatives
Option 1: Privacy-Hardened Smart Speaker (Recommended)
Snips (Self-Hosted)
- Runs entirely locally (no cloud uploading)
- No always-on internet connection required
- Works offline (useful for voice control without revealing queries)
- Open source (code auditable)
Setup:
# Requires Raspberry Pi (4GB RAM minimum) + microphone
# 1. Install Snips OS on Raspberry Pi
# 2. Configure offline voice models
# 3. Can control smart home devices locally
# No cloud = No privacy risk
Limitations:
- Setup requires technical skill (Raspberry Pi, Linux)
- Less feature-rich than Alexa/Google (limited skills/integrations)
- Voice recognition is less accurate
Cost: ~$150 (Raspberry Pi + microphone + speaker)
Option 2: Open-Source Home Assistant
Home Assistant
- Self-hosted smart home hub
- Includes voice control with Wyoming protocol (local voice processing)
- No cloud dependency
- Fully privacy-respecting
Setup:
# 1. Install Home Assistant on Raspberry Pi or NUC
# 2. Add STT (speech-to-text) module: Wyoming Faster Whisper
# 3. Add TTS (text-to-speech): Piper TTS
# 4. Voice commands process locally, never leave your network
# Result: Full voice control, zero cloud tracking
Advantages:
- Complete privacy (all processing local)
- Highly customizable
- Active open-source community
- Works with 3000+ smart home devices
Limitations:
- Steeper learning curve
- Requires comfortable with YAML configuration
- Ongoing maintenance
Cost: ~$200-400 (hardware + no recurring fees)
Option 3: Minimal Use of Cloud Speaker
Compromise approach:
- Use Google Home / Alexa only for music and timers
- Disable all skills and integrations
- Don’t link shopping/financial accounts
- Treat it as dumb speaker with voice input
This works if:
- You want convenience without the privacy cost
- You accept some data collection in exchange
- You minimize sensitive queries (ask your phone privately instead)
Realistic privacy level: 60% reduction in tracking vs. default setup
Option 4: No Smart Speaker
Most private option:
- Use your smartphone for voice commands (when you choose)
- Use a regular Bluetooth speaker (no microphone, only speaker)
- No always-on listening devices
- Complete privacy (your phone is already tracking you; at least it’s your device)
When this works:
- You don’t need hands-free voice control
- You’re willing to pick up phone to ask questions
- Privacy is more important than convenience
Household Strategy: Reducing Smart Speaker Risk
If multiple people in your household use smart speakers:
1. Segregate on separate WiFi network
- Create guest network (2.4GHz only, separate from main network)
- Put smart speakers on guest network only
- Rest of devices on main network
- Limits what speaker can access (your computers, phones, NAS storage)
2. Use WireGuard VPN for main devices
- Encrypt all traffic from personal devices
- Smart speaker traffic remains unencrypted (easy to monitor)
- Reduces ISP tracking on everything except the speaker
3. Disable microphones physically
- Open speaker enclosure
- Locate microphone (small black cylinder)
- Desolder or tape over it (if you only want speaker functionality)
- Prevents any possibility of listening
4. Disable WiFi when away
- Unplug speaker overnight or during vacations
- Reduces daily data exfiltration
- Prevents someone else from accessing your speaker remotely
Legal Protections (Limited)
What the law does NOT protect:
- Amazon/Google can collect audio under their terms of service
- You agreed to this in the user agreement (even if you didn’t read it)
- They can change privacy terms with 30 days notice
- Law enforcement can subpoena your audio without your knowledge
What you CAN do:
- Request deletion of your data under GDPR (if in Europe)
- Request deletion under CCPA (if in California)
- File complaint with FTC if practices violate their privacy promise
Reality: Large tech companies have legal teams that defend their practices. Individual complaints rarely result in action.
Practical Recommendation
If you own a smart speaker:
- Change the wake word to something less commonly spoken (reduces false positives)
- Auto-delete audio every month (Settings → Alexa Privacy)
- Disable skills and smart home integration you don’t actively use
- Unplug during private conversations
- Monitor network traffic monthly using Wireshark to verify what’s being sent
If you’re considering buying:
- Buy Home Assistant + Raspberry Pi setup (~$300) instead
- Or accept the privacy cost and use default hardened settings
- Or skip smart speakers entirely
If you’re privacy-conscious: Smart speakers are fundamentally incompatible with privacy. They exist to create data profiles about you. Any speaker with always-on microphone and internet connection is a potential surveillance device, regardless of manufacturer claims about local processing.
The most honest assessment: Smart speakers are conveniences you purchase by surrendering privacy. Some people accept this trade-off. Others don’t. That choice is valid either way, but it should be informed.
Related Articles
- Browser Fingerprinting How It Works and How to Prevent It Guide
- Chrome Privacy Sandbox Explained What It Means for Tracking
- Best Privacy DNS Resolvers Cloudflare Quad9 NextDNS Adguard
- Cloud DLP for Google Workspace Guide 2026
- Anonymous Browsing Mobile Devices Guide 2026
Built by Privacy Tools Guide — More at zovo.one