They ain't doing shit. Voice assistants only listen for their built in trigger words, if you even turn that on, and they do what they say with the conversation afterwards.

4A doesn't matter anyway, what matters is GDPR, it's not worth building a system that is not GDPR compliant even if you're outside the EU.