  Smart speakers collect voice commands, which can be used to infer sensitive
information about users. Given the potential for privacy harms, there is a need
for greater transparency and control over the data collected, used, and shared
by smart speaker platforms as well as third party skills supported on them. To
bridge this gap, we build a framework to measure data collection, usage, and
sharing by the smart speaker platforms. We apply our framework to the Amazon
smart speaker ecosystem. Our results show that Amazon and third parties,
including advertising and tracking services that are unique to the smart
speaker ecosystem, collect smart speaker interaction data. We also find that
Amazon processes smart speaker interaction data to infer user interests and
uses those inferences to serve targeted ads to users. Smart speaker interaction
also leads to ad targeting and as much as 30X higher bids in ad auctions, from
third party advertisers. Finally, we find that Amazon's and third party skills'
data practices are often not clearly disclosed in their policy documents.

Cryptography and Security