Hey Google, is the government spying on me?

Smart speakers are some of the newest and hottest products in smart home technology. A good smart speaker like Google Home can be an all-in-one solution to home automation, communication, and entertainment. But, is there a nefarious side to the smart speaker world we didn’t even realize existed and should we examine Google Gome privacy?

If you hadn’t heard (pun intended) our sister site SoundGuys has a new podcast. The first three episodes just hit iTunes and Google Play Music, and we’re all really excited about it. Now, I don’t want to turn this into an ad for the podcast, but there is a reason why I’m writing this feature. You see, the second episode of the SoundGuys Podcast is titled “Smart Speakers: A New Legal Frontier” and it’s that new legal frontier that I want to talk about today. You can (and should) listen to the whole episode here — it’s only 16 minutes long — but I’ll give a short summary below.

A little legal history

I’m not a lawyer, nor do I play one on TV, so my legal opinions don’t mean a whole lot. Fortunately, you don’t need to take my word for all of this. SoundGuys had Jay Stanley of the ACLU on the show to explain a lot of what I’m going to cover. I should also clarify that much of the first part of the episode revolves around the U.S. Constitution. If you don’t live in the United States, this won’t be as relevant to you. However, there are still legal concepts in the show that you should be aware of.

The Fourth Amendment of the United States Constitution protects citizens from what it calls “unreasonable search and seizure.” If you’ve ever watched a cop show, you know that police need a warrant to search people’s homes. That’s the Fourth Amendment. It also prohibits things like wiretaps, drug sniffing dogs, thermal imagers, and other creepy stuff.

Android Authority‘s own Adam Sinicki already delved into this topic a little bit last summer. However, SoundGuys, along with Mr. Stanley, looked at something Adam didn’t touch upon.

Third-Party Doctrine

Fortunately, for the U.S. government, a lot of us have been wiretapping our own homes for the bargain price of $39.95. This is where we start stepping in the legal poop that smart speakers have caused. There’s a concept in law called the “Third-Party Doctrine” which allows law enforcement access to data that originated inside your home, but no longer exists there (like the cloud). I’ll let Mr. Stanley explain:

That started off as a common sense thing where, if you’re having a loud conversation on a sidewalk, you can’t expect to require a warrant for the police to overhear you. But that got extended to your information that’s being held by a bank, or the electric company or the telephone company. And so with the internet of things, and smart speakers, and smart electric beaters, a lot of very personal information that is inside the home is streaming to third parties and their servers. So, it should be protected because it’s inside the home, on the other hand, under the third party doctrine[…] that information does not receive protection under the Fourth Amendment.

In cop shows they talk about pulling bank records, phone records, and the like. Soon enough, they’ll start pulling Google Assistant conversations as well.

But that’s not all for Google Home privacy . . .

Basically, since our smart speakers transmit everything we say to a third party, authorities claim they should have access to that data under third-party doctrine. So not only is third-party doctrine not protecting our civil liberties, it might actually be facilitating government intrusion into our homes. Stanley isn’t talking hypothetically here. This is actually happening. Isn’t that fun?

Plus, to execute the commands we give to Assistant, Google first has to transcribe those commands to text. Not only are our personal conversations recorded — they’re in text and completely searchable, CTRL-F style. Law enforcement officials could write a 30-second python script to search reams and reams of our data in seconds for any reference from porn to peanut butter sandwiches (or both, no judging).

So, what does that all mean?

So, should we “office space our Google Home” as SoundGuys’ Chris Thomas says? Well, maybe not. The SoundGuys episode goes on to point out a worst case scenario for where this could lead with Google Home privacy, and also references GDPR as a potential way to fix the problem. Regardless, it’s unnerving that there’s a legal means for law enforcement to learn your deepest darkest secrets.

Trust me, I’m one of the most “Who cares about Google Home privacy” people I know. My life is an open book and all that, but this episode gave me pause. What I do in the privacy of my own home is my business. I started wondering if I should press the old mute button on my Google Home. At least until I remembered two things.

It’s your data. Mostly.

First of all, privacy is my primary example here — we are Android Authority after all. Amazon has some similar policies in most regards, but for the sake of simplicity, we’re going to discuss Google and Google Home privacy. Google’s conveniently laid out exactly what it collects from you in its help sections, quoted below:

Is Google Home recording all of my conversations?
No. Google Home listens in short (a few seconds) snippets for the hotword. Those snippets are deleted if the hotword is not detected, and none of that information leaves your device until the hotword is heard. When Google Home detects that you’ve said “Ok Google” or that you’ve physically long pressed the top of your Google Home device, the LEDs on top of the device light up to tell you that recording is happening, Google Home records what you say, and sends that recording (including the few-second hotword recording) to Google in order to fulfill your request. You can delete those recordings through My Activity anytime.

Can I look at what I’ve asked Google Home? / What Google Home has heard?
You can go to Assistant history in My Activity (myactivity.google.com) or the My Activity link in the setup app to view what you’ve asked and delete it if you want.

If I delete my location / search / conversation history, does Google still save a copy?
When you delete items from My Activity, they are permanently deleted from your Google Account. However, Google may keep service-related information about your account, like which Google products you used and when, to prevent spam and abuse and to improve our services.

Does Google Home sell my information with anyone / my contacts / Google / other apps / advertisers / other companies?
We do not sell your personal information to anyone. There are some circumstances where we share information with third parties, which are listed in Google’s Privacy Policy. On Google Home, if you request a service from a business like Uber, we will send information you’ve provided to that service to complete a booking or confirm a ride. In these cases, we will have previously asked you to give us permission to share that information with that service.

So, long story short (and taken at face value — put away the tin foil hats), Google records all the time but deletes anything that doesn’t contain a hotword. You can see what Google has recorded from Google Home, and even delete it yourself. Furthermore, you can see everything Google knows about you by checking it out here.

But what about law enforcement?

But bro, we’re talking about the government. Which means we need to delve into the Google’s Privacy Policy, which includes Google Home privacy. It is long (an understatement). I’ll sum up what it says on the subject here. How and when Google shares your data falls under four different categories:

• With your consent – Sure Google, share this with Uber so they know where to come get me.
• With domain admins – If your job uses Google apps, your employer basically owns your account anyway.
• For external processing – Basically if Google isn’t big enough, and needs to use a third party to help you in some way (like customer support — yay outsourcing!) it shares your data as long as that service honors the Privacy Policy as well.
• For legal reasons – There it is!

This is where the Google Home privacy policy gets a little creepy:

Google regularly receives requests from governments and courts around the world to disclose user data. Respect for the privacy and security of data you store with Google underpins our approach to complying with these legal requests. Our legal team reviews each and every request, regardless of type, and we frequently push back when a request appears to be overly broad or doesn’t follow the correct process.

That means if officials get a warrant, Google reviews the documentation to make sure it falls within the constraints of the warrant before handing anything over. That sounds good, but according to Google’s Transparency report, between 60 and 75 percent of data requests dating back to 2010 resulted in the “production of some data.” I don’t know what you’re feeling about this, but I’m guessing it’s not relief.

Maybe, you know, push back a little harder there, Google.

Wrapping it all up

Some of this stuff about Google Home privacy seems alarming, and it should, but we’re not quite looking down the barrel of a dystopian society. It’s not like we’re about to implement a social merit system to mark you for life without due process. But then, Google’s hardly pushing back much against The Man.

Here’s the thing about the internet — it’s forever. Once you put data out into the world, even if it’s monitored and maintained by a service you trust — or at least one providing you enough convenience so  you don’t care anyway (though maybe you should) — it’s out there forever. Data breaches, privacy violations, and even a dramatic shift in the government or Google’s business strategy can change everything. It’s not comforting at all.

I for one am keeping Google and Alexa in my house. I’m not planning anything nefarious, and personally, I don’t think my government should care about what I’m doing. There are 65-year old grandmothers out there probably more threatening to public safety than me. If the government really wants to know I asked what time the Aldi closes (FYI: 9 p.m.), I guess there’s little I can do to stop it. I will sleep better knowing Jay Stanley and the ACLU are fighting on my behalf, at the very least.

Check out the podcast

Ok, fine, one more plug. This really is an interesting episode. I only covered a little of the legal arguments Chris Thomas and Jay Stanley discussed, so go check out the podcast episode.

What do you think about smart speakers and Google Home privacy issues today? Are you nervous now, or as confident as ever that your data is safe in Google’s clutches hands?

Let us know in the comments what you think of the show, your thoughts in Google Home privacy, and while you’re at it leave a review, too!