> It's fairly easy to tell that these devices do not send data until woken up by their keywords. Indeed, we can confirm that they don't upload until woken. N

> It's fairly easy to tell that these devices do not send data until woken up by their keywords. Indeed, we can confirm that they don't upload until woken. Now, can we determine what they do upload at that point? Perhaps the previous two minutes of conversation, recorded for context to 'improve the consumer experience'? We just don't know. Back in the early days of HTML forms on the Web, we were told to double-check the domain and SSL status before pressing 'submit'. Then JavaScript arrived and websites gained the ability to stream the data from text fields before the user had even submitted the form. I see a parallel with these in-house devices, they have a great deal of privacy-violating potential that runs contrary to people's expectations that a device only starts to perform a function when commanded to do so.