前陣子看到的研究報告，證實 Amazon Echo 會聽取資訊並且將這些資料送到第三方的廣告平台上 (會送到 Amazon 自家應該不算新聞)：「Your Echos are Heard: Tracking, Profiling, and Ad Targeting in the Amazon Smart Speaker Ecosystem」。
先從 abstract 開始看，主要是目前這些 smart speaker 基本上沒有透明度，所以十位作者群們建立了一套評估用的 framework 用來測試各家 smart speaker 資訊蒐集已經影響的情況：
Smart speakers collect voice input that can be used to infer sensitive information about users. Given a number of egregious privacy breaches, there is a clear unmet need for greater transparency and control over data collection, sharing, and use by smart speaker platforms as well as third party skills supported on them. To bridge the gap, we build an auditing framework that leverages online advertising to measure data collection, its usage, and its sharing by the smart speaker platforms.
這次論文裡面提到的目標就是 Amazon Echo 會將聽到的東西分享給第三方的廣告平台，並且讓廣告平台可以調整競價 (賺更多的錢)，而且這些資訊並沒有被揭露在 privacy policy 裡面：
We evaluate our framework on the Amazon smart speaker ecosystem. Our results show that Amazon and third parties (including advertising and tracking services) collect smart speaker interaction data. We find that Amazon processes voice data to infer user interests and uses it to serve targeted ads on-platform (Echo devices) as well as off-platform (web). Smart speaker interaction leads to as much as 30X higher ad bids from advertisers. Finally, we find that Amazon's and skills' operational practices are often not clearly disclosed in their privacy policies.
幾個比較重要的資訊，其中一個是「Network traffic distribution by persona, domain name, purpose, and organization」：
另外一個重點是哪些 3rd-party：
就心裡有個底，然後隔壁棚也有類似產品 (主業是做廣告的那家)，大概要跑不掉...
