The Smart Home Is a Listening Post: Amazon, Google, and the Surveillance You Paid For

In March 2025, Amazon sent an update to millions of Echo devices. The notification buried in a support document said, "We are removing the Do Not Send Voice Recordings option." For years, a subset of Echo users had specifically enabled a feature that allowed their devices to process voice commands locally, keeping the audio on the device and sending only text to Amazon's cloud. They had made a deliberate privacy choice. They'd turned on a privacy-respecting setting, and Amazon turned it off, not for some users, for everyone. The company decided unilaterally that the local processing was no longer an option. Every interaction with an Alexa device now routes to Amazon's cloud servers by default. No opt-out, no appeal, no choice. The funny part is that most users never even knew that this feature existed. The ones who did had read the fine print of the support document to find out it was gone. Either way, the result is the same. The device still sits in your kitchen. It still listens, and now everything it hears belongs to Amazon first. You bought the device. You installed it. You put it in your bedroom or your living room or the room where you have conversations that you consider private and intimate. And in March 2025, without asking, Amazon reconfigured it into a full surveillance node on their infrastructure. Today, we're talking about the surveillance network that most people have voluntarily installed into their homes. I am Alan Pace, and this is the OpSec Podcast. Let's start with what the smart home actually is. Here is an accurate technical description of a smart home device: an Internet-connected sensor installed in your most private spaces operated by a company whose business model depends on the data that it collects and produces. The marketing language is convenience, automation, smart living. The operational reality is a network of always-on listening and watching devices that you own but don't control, connected to servers you don't operate, subject to policies that you don't write and many times don't vote for, are accessible to entities that you didn't approve or accept. This episode is not about whether these devices are useful. They are. It's about understanding what you're operating and what goes on inside of them when you use them and making deliberate decisions about what that means for your privacy posture. First, let's focus on Alexa and Echo. The way Alexa works is the device listens continuously for a wake word. When it hears one, it records what follows, transmits it to Amazon's cloud, processes the request, and returns a response. The microphone is always active. That's not a design flaw. It's simply how the product works. In March 2025, Amazon removed the option that allowed local audio processing on Echo devices. Every voice interaction now routes to Amazon's cloud by default. Amazon retains these recordings, voice audio, text transcripts, and typed request until you manually delete them or until a retention period you've set expires. The default retention is indefinite. There is a Do Not Save Recordings option, which automatically deletes recordings after processing. However, it requires you to know it exists in