Google Home recording private conversations, finds VRT
Flemish public broadcaster VRT has broken a story that has gone international, when it discovered that Google Home and Assistant are recording private discussions and setting employees about transcribing them
Not OK, Google
Google Home (pictured) and Google Assistant are voice-activated systems that work like internet browsers, but speak the results rather than show them on a screen. If you ask the device, for instance, who Guy Verhofstadt is, it will give you a verbal run-down on the Flemish MEP. You can ask the device to tell you a joke or the app to call the nearest Delhaize.
Google Home is quite useful for hands-free internet use, popular for checking the weather or traffic, or to provide people with the latest headlines while they’re doing something else.
VRT spoke to an anonymous employee who works for a Google subcontractor. He came to the broadcaster himself out of concern for people’s privacy, following last month’s revelations that employees of retail giant Amazon were tasked with listening to users of its smart speakers.
Beyond privacy policy
His face was blurred out on camera as he described how Google, just like Amazon, trains some employees to listen to questions or commands that have been recorded after a user uses the “OK Google” voice command to activate the device.
Google does this to improve the devices’ responses. Employees around the world work in their own language to transcribe what the person has said and give other information about the voice – such as is it a man, woman or child. This way Google can make adjustments to the technology taking into account dialects and intonations in all languages.
Google does mention in its privacy policy that your commands to the devices can be recorded and stored. But what it does not tell you is that the device and app record fragments of conversations not meant for them.
I remember one longer fragment where I was concerned about physical violence
This happens when Google thinks it’s getting a demand for information but isn’t. The system can sometimes mistake other words for “OK Google” and start recording. It can even mistake someone else’s voice from a metre or two away as a command to start listening.
The employee handed over 1,000 voice fragments to VRT, of which about 150 were such ‘accidental’ recordings. They included people talking on the phone, kids fighting with each other and the occasional exclamations of love.
While Google says that the employees do not know the identity of the fragments to which they are listening, VRT was able to track down several households just by listening to fragments – such as when they tell someone on the phone their address, and Google picks it up. Or even if they use the app to navigate them home via GPS.
“Clearly in distress”
The employee said that Google records more fragments in language territories where it needs more work – like Flanders. “For the Flemish market, where the system is much less well trained because fewer transcriptions have been made,” he said, “it records things that are not purposely said to the device.”
VRT heard fragments with sensitive information, like calls to doctors. “I remember one longer fragment where I was concerned about physical violence,” said the employee. “There was a female voice, and you could hear that she was clearly in distress. And then you realize these are people you are listening to, not just voices.” Google, he said, doesn’t provide any guidelines for when employees hear sensitive information.
VRT asked Google for a response and received one immediately. “We work with language experts worldwide to improve language technology by making transcriptions of a small amount of audio recordings. This work is essential if we want to develop technologies that enables us to make products like the Google Assistant.”
Experts, however, are convinced that the recordings are in breach of EU privacy laws. “The European GDPR privacy legislation has two clear demands for the use of consumer data,” said federal privacy minister Philippe De Backer. “The consumer must provide explicit permission for the use of data and must also be fully aware of what that data is used for.”
Belgium’s Privacy Commission told VRT that it would likely launch an investigation.
