Smart Speaker and Voice Assistant Privacy Guide: Control Recordings, Purchases and Kids’ Use

Smart speakers are microphones that sit in kitchens and bedrooms, and most people have never looked at the settings that decide what they record, keep and share. Smart speaker privacy means controlling when a voice assistant listens, what happens to the recordings and transcripts, who in the house can use it to buy things or reach your accounts, and how children's voices are handled. This guide explains how Amazon Alexa, Apple Siri and Google Assistant handle audio, where the controls are, and which beliefs about "always listening" are wrong. Platforms are listed alphabetically; the order is not a ranking. It is written in plain English for households, and for IT and security staff who field these questions or manage speakers in offices and rented homes.

Key takeaways

• The speaker listens locally for its wake word. Google says standby audio snippets of a few seconds are used only to detect "Hey Google" and are not sent or saved unless it hears the wake phrase; the other assistants work on the same wake-word principle.
• Defaults differ on audio storage. Google says it does not keep audio recordings on its servers by default, Apple does not store Siri audio unless you opt in to Improve Siri and Dictation, and Alexa offers a "Don't save recordings" option you have to choose.
• Delete by voice, then automate it. "Alexa, delete everything I said today" and "Hey Google, delete what I said this week" clear recent audio; set automatic deletion so you do not have to remember.
• Anyone in the room can talk to it. Voice purchasing, personal results and messaging work for whoever is speaking unless you add voice recognition, a purchase code or turn the feature off.
• Children's voices are regulated data. In 2023 the US FTC and Department of Justice charged Amazon with keeping children's Alexa recordings indefinitely, with a proposed US$25 million civil penalty, a reminder to review kids' profiles and history.

What it is

A voice assistant is software that turns speech into requests: play music, set a timer, control lights, read messages or order shopping. A smart speaker or smart display is the hardware it runs on, such as an Amazon Echo, an Apple HomePod or a Google Nest speaker. The privacy questions are the same across brands:

• Capture: when does the microphone send audio off the device?
• Retention: are recordings and transcripts kept, for how long, and who can review them?
• Access: who in the house, or visiting, can use it to reach your calendar, contacts, messages or payment methods?
• Use: is your data used to improve speech recognition or personalise ads?

The microphone itself is the same kind of risk discussed in the Webcam and Microphone Privacy Guide; the speaker adds a cloud account, a household of users and a payment method.

How it works

All three assistants rely on a wake word. The device keeps a short rolling buffer of sound and checks it locally for "Alexa", "Hey Siri" or "Hey Google". Google describes this explicitly: snippets of a few seconds are processed only to detect activation, and if no activation is detected they are not sent or saved. Once the wake word is heard, the request is processed, either on the device or in the provider's cloud, and a light or on-screen indicator shows that audio is being sent. Google notes one exception: some audio can be sent after the indicator turns off, for example when a request was handled faster on the device.

What each assistant keeps

Availability

• Amazon Alexa: settings names and auto-delete options are from Amazon's 2020 privacy announcement; the removal of "Do Not Send Voice Recordings" was reported in March 2025 as linked to Amazon's generative AI features, which rely on cloud processing.
• Apple Siri: Apple notes that Siri on devices such as HomePod may require extra server processing of audio and transcripts; personalised speech recognition (Recognize My Voice) runs on the device.
• Google Assistant: the text of voice interactions may be used for ad personalisation depending on your settings, and Google says partners receive transcribed text, not audio.

Why it matters

Most of the real-world risk is not secret surveillance. It is the ordinary features doing exactly what they were built to do, for the wrong person:

• Household and guests: Google states plainly that anyone near the device can ask it questions; personal results and Voice Match settings decide whether they can get information from your accounts.
• Voice purchasing: a speaker linked to a shopping account can place orders by voice. Turn purchasing off, or require a voice code, so children and visitors cannot buy things.
• Drop In and calling: Alexa's Drop In lets approved contacts connect to a device and start talking without the call being answered. Review who has permission, or switch it off.
• Location: Siri sends device location with requests if Location Services is on for Siri; set it to Never in Settings > Privacy & Security > Location Services > Siri if you do not want that.
• Children: the FTC alleged that Amazon kept children's voice recordings indefinitely unless a parent asked for deletion, that transcripts survived some deletion requests, and that retained recordings were used to train speech recognition. The proposed order required deletion of inactive child accounts and certain recordings. See the COPPA and Children's Privacy Guide.
• Account takeover: whoever controls the linked Amazon, Apple or Google account controls the speaker, its history and its purchases. Protect that account with a strong password and two-step verification, as the UK NCSC advises for all smart devices. See the Securing Your Apple ID and Google Account Guide.

Settings to change first

Common misconceptions

• "It records everything I say." All three providers describe wake-word detection on the device. False activations do happen, which is why reviewing history and setting auto-delete matters.
• "Muting the app is the same as muting the speaker." The reliable control is the physical microphone switch or button on the device; Google says you can always turn the microphone off.
• "Deleting history deletes everything." Apple says some request data may be kept for up to two years, Alexa keeps transcripts of unsaved requests for 30 days, and the FTC case shows deletion can fail. Assume deletion is best effort.
• "Local processing is a permanent setting." Amazon withdrew its local-only option in 2025. Features change with software updates, so recheck your settings after major updates.
• "Factory reset is optional when I sell it." The NCSC advises a factory reset before selling or giving away a device, and also removing it from your account.
• "A voice is proof of identity." Voice profiles personalise results; they are not strong authentication, and cloned voices are now a scam tool. See the Voice Cloning and Family Emergency Scams Guide.

Related concepts

• Audio capture as an attack technique: MITRE ATT&CK records microphone misuse by malware as T1123 Audio Capture. On speakers, the more common risk is a compromised cloud account rather than device malware.
• Smart home security: speakers usually act as the hub for lights, locks and cameras, so the same account and network controls apply. See the Smart Home Security Guide.
• Support lifetime: the NCSC suggests treating the manufacturer's support end date as a "use by" date for the device.
• Remote access: if you do not need to control a device when away from home, the NCSC suggests switching remote access off.
• Shopping accounts: purchasing by voice inherits the security of the linked shopping account. See the Amazon Account Security and Scams Guide.

For IT teams managing speakers

• Offices and meeting rooms: decide whether speakers are allowed where confidential conversations happen; if allowed, use a dedicated organisational account, not a personal one, and keep audio saving off.
• Rentals and shared housing: reset and remove devices from the previous account between occupants.
• Measure: track the number of speakers on the network, the share with audio saving off and auto-delete on, the share with purchasing disabled, and devices past their support end date.

Practitioner checklist

• Choose not to save audio recordings on each assistant you use, and set automatic deletion for what is kept.
• Delete existing history once, by voice or in the app or My Activity.
• Turn voice purchasing off, or require a purchase code.
• Set up voice recognition so only recognised adults get personal results, messages and calendar access.
• Review Drop In, calling and messaging permissions and remove contacts you do not want.
• Check children's profiles, their history and any linked services, and delete what is not needed.
• Protect the linked account with a strong unique password and two-step verification.
• Use the physical microphone switch during private conversations, and factory reset and unlink before selling.

Standards and references

• Google: Data security and privacy on Google Nest devices with Google Assistant
• Google Safety Center: Google Nest privacy commitments
• Apple: Siri, Dictation and Privacy
• Amazon: Alexa makes privacy even easier
• US Federal Trade Commission: FTC and DOJ charge Amazon with violating children's privacy law
• UK NCSC: Smart devices in the home
• The Star (AP): Amazon ends little-used privacy feature for Echo users

Related NHI Mgmt Group resources: Smart Home Security Guide · Webcam and Microphone Privacy Guide · Parental Controls Guide · iPhone Security and Privacy Settings Guide