No security researcher has ever found proof that they are "always on" and recording everything people say. If they were, it would be front-page news and Amazon would have government investigations.

The devices listen for their wake word before ever transmitting data to the cloud. (This is also because the sheer amount of bandwidth needed for always-on would be un-economical even for Amazon).

This is not strictly true. I examined a master's degree thesis last semester where the student proved conclusively that Alexa devices are periodically spamming bursts of data back to Amazon HQ even when not woken. Beyond a heartbeat, too - MBs of data, not KBs.

No clear idea what that data is, though. There's at least a small chance it isn't benign.

So, mitmproxy that traffic and see what it is?

Scope of his work didn't go that far, he looked at several devices and Alexa was notably chatty. He was measuring for abnormal data bursts from IoT home devices - included things like smart bulbs etc.

isn't the point of SSL that you can't do that (assuming the client is verifying certs, etc)?

link?

Unpublished. It's still going through board approval.

As/when it's put on my institution's open repository I'll post a link. Might be a few weeks though.

Interested to hear more, once it's through! :)

Be sure to put as a submit :)

Amazon is surely aware of the aftermath of Google's accidental Wireless network war-driving.

While absence is hard to prove, an intentional or unintentional data collection beyond what is stated in their policies is highly unlikely.

I also don't think any insiders at any of these companies have leaked that they passively listen to what people say.

Do sample recordings, reduce bitrate (you can have good voice recording and playback at less than 3kb/sec) and upload only if the device detects something worthy of notification.

Hell, don't even send the sound, just send a weekly report of events.

What behavior do they hope to collect that is not a huge privacy liability with the effort? They already know where millions of people spend their money (not say they will buy, but actually follow through).

Smartphones and laptops are already that.

Is it collecting that data when not spoken to?

No.