Regulators and lawmakers in the U.S. and Europe are examining whether Google, Apple, and Amazon are violating privacy by employing human reviewers to listen to voice commands recorded by digital assistants.
Apple and Google, which is currently being investigated by Hamburg’s data protection authority, have both suspended their programs; Amazon late Friday announced changes to its terms that let users opt out of human review of their recordings. Regulators from Ireland and the U.K. are now also looking into whether the tech giants have infringed European privacy regulations.
“We are aware of privacy concerns relating to voice assistant programs and will be assessing the available information,” said a spokeswoman for the Information Commissioner’s Office, the U.K.’s data protection regulator. She added the ICO would discuss the matter with the board of European data protection authorities “in order to ascertain the full facts and any possible risks to the rights of U.K. residents.”
Bloomberg first reported in April that Amazon had a team of thousands of workers around the world listening to Alexa audio requests with the goal of improving the software. Their tasks include listening to and transcribing voice recordings. Some of the workers reviewing customer recordings had access to certain personal data, including users’ first names and their location.
At the time, Amazon and people familiar with the program said only a small sample of recordings were manually reviewed. Bloomberg reported that similar human review is used for Alphabet’s Google Assistant and Apple’s Siri. Recent news reports elaborated on the extent of those companies’ review program.
The reports sparked concern among privacy advocates that the practice could violate users’ rights, particularly in cases where devices begin recording unintentionally or without the user’s knowledge.
The Irish regulator that oversees Apple and Google in Europe said that it is in talks with both companies over obtaining further details about voice assistants.
“We will be making our assessments and conclusions,” said a spokeswoman. “We note that both companies have ceased this processing, Google from mid-July and Apple in recent days.”
Siri Grading
Luxembourg’s data protection commission, Amazon’s main privacy regulator in Europe, didn’t immediately comment.
Apple on Monday pointed to previous statements, in which it said it is suspending Siri grading globally as it conducts a thorough review. It has also said that, as part of a future software update, users will have the ability to choose to participate in grading.
Amazon, Google didn’t immediately respond to requests for comment on Monday. In a statement last week, Amazon said “we take customer privacy seriously and continuously review our practices and procedures,” adding that it would update information it provides to customers to make practices more clear. Google said it is “assessing how we conduct audio reviews and help our users understand how data is used.”
In the U.S., Congressman Seth Moulton in late July introduced a bill called the Automatic Listening Exploitation Act that would grant the Federal Trade Commission the power to issue fines of up to $40,000 per infraction when digital assistants and smart doorbells violate terms of agreements. The proposed legislation aims to provide consumers recourse when assistants and doorbells record conversations where users haven’t uttered the device’s wake word or activated the device.
Strict Rules
In Europe, data protection authorities already have strict fining powers. They were strengthened under the bloc’s strict new General Data Protection Regulation that entered into force last May and they can levy fines as high as 4% of a company’s annual revenue. In its annual report published this July, the European Data Protection Board said authorities this year and next would focus on data subjects’ rights and consider technologies including artificial intelligence and digital assistants.
European lawmakers are urging authorities to avail of their powers with respect to digital assistants.
“Regulators should control and monitor AI development to avoid further future scandals and the potential negative impact on people’s lives,” said Carmen Avram, a center-left member of European Parliament from Romania.
The Hamburg Commissioner for Data Protection and Freedom of Information last week announced it was investigating Google’s practice of having employees and contractors transcribe home assistant voice recordings to see if the program complies with the EU’s privacy rules. Commissioner Johannes Caspar at the time also urged Apple and Amazon to review their procedures.
Amazon Changes
Amazon since then has changed its policy. It now allows customers with access to the Alexa smartphone app to remove their recordings from a pool that could be analyzed by Amazon employees and contract workers.
“We doubt that such a move is sufficient to put the processing on a lawful basis,” Martin Schemm, a press officer at the Hamburg authority, said of Amazon’s opt-out approach. He said some categories of sensitive data require a user’s unambiguous consent to be processed but with the opt-out, a user still can’t decide what type of data is recorded and what isn’t.
Schemm said the Hamburg authority was in touch with colleagues in Germany who oversee Amazon and Apple and that it would keep them informed of their measures in the Google case.
More must-read stories from Fortune:
—What you need to know about 8chan, the controversial site tied to the El Paso shooting
—Verizon’s unlimited plans are getting cheaper. Here’s what you should know
—What CEOs, bankers, and tech execs think about a coming recession
—How an alleged Amazon theft ring got the goods
—Boeing adds a second flight control computer to the 737 Max
Catch up with Data Sheet, Fortune‘s daily digest on the business of tech.
