Amazon Alexa keeps your data with no expiration date, and shares it too

A US senator asked questions, and Amazon provided answers you might not want to hear.

Alfred Ng Senior Reporter / CNET News
Alfred Ng was a senior reporter for CNET News. He was raised in Brooklyn and previously worked on the New York Daily News's social media and breaking news teams.
Alfred Ng
3 min read
Amazon Echo Plus

In a letter to Sen. Chris Coons, Amazon explains who can hold onto records of your conversations with Alexa.

Chris Monroe/CNET

If you have hangups about Amazon and privacy on its smart assistant, Alexa, you're not alone. Even after Amazon sent answers to a US senator who had questions about how the tech giant retains voice data and transcripts, the lawmaker remains concerned about Alexa's privacy practices.

Sen. Chris Coons, a Democrat from Delaware, sent a letter to Amazon CEO Jeff Bezos in May, demanding answers on Alexa and how long it kept voice recordings and transcripts, as well as what the data gets used for. The letter came after CNET's report that Amazon kept transcripts of interactions with Alexa, even after people deleted the voice recordings. 

The deadline for answers was June 30, and Amazon's vice president of public policy, Brian Huseman, sent a response on June 28. In the letter, Huseman tells Coons that Amazon keeps transcripts and voice recordings indefinitely, and only removes them if they're manually deleted by users.

Huseman also noted that Amazon had an "ongoing effort to ensure those transcripts do not remain in any of Alexa's other storage systems." But there are still records from some conversations with Alexa that Amazon won't delete, even if people remove the audio, the letter revealed.

Watch this: Here's what Amazon revealed about Alexa privacy to a US senator

Privacy concerns aren't just limited to voice assistants, not with smart technology finding its way into more household items like doorbells and locks. And tech companies aren't always up front about what kind of data they collect or how much control you have over it. 

"The American people deserve to understand how their personal data is being used by tech companies, and I will continue to work with both consumers and companies to identify how to best protect Americans' personal information," Coons said in a statement.

When reached for comment, Amazon referred to the letter for details.

In the letter to Coons, Amazon noted that for Alexa requests that involve a transaction, like ordering a pizza or hailing a rideshare, Amazon and the skill's developers can keep a record of that transaction. That means that there's a record of nearly every purchase you make on Amazon's Alexa, which can be considered personal information. 

Other requests, including setting reminders and alarms, would also remain saved, Huseman noted, saying that this was a feature customers wanted.

"Customers would not want or expect deletion of the voice recording to delete the underlying data or prevent Alexa from performing the requested task," Huseman said in his letter.

All of Amazon's Alexa smart speakers

See all photos

That feature raised concerns among privacy advocacy groups, which discovered that Alexa's "Remember" feature didn't delete information stored unless people called Amazon's customer service to delete the entire profile. Amazon said it's since fixed the issue and called it a bug.  

The answers didn't exactly inspire confidence in Amazon for Coons.

"Amazon's response leaves open the possibility that transcripts of user voice interactions with Alexa are not deleted from all of Amazon's servers, even after a user has deleted a recording of his or her voice," the lawmaker said in a statement. "What's more, the extent to which this data is shared with third parties, and how those third parties use and control that information, is still unclear." 

Amazon said it uses the transcripts for training its voice assistant, and also so customers can know what Alexa thought it heard for voice commands. Those transcripts aren't anonymized --  Amazon explained that they're associated with every user's account.

You can read the letter here: 

Originally published at 12:54 p.m. PT. 
Updated at 2:20 p.m. PT: Adds that Amazon fixed an issue with data retention on the Echo Dot Kids Edition.