All articles 7 min read

Smart Speakers and Connected Devices: Controlling Data Access

This guide presents selected U.S. government consumer education from Federal Trade Commission. References to “we” or “us” in the source material refer to the issuing agency. Source dates and links appear below.

How To Secure Your Voice Assistant and Protect Your Privacy

Your wish is their command. Voice assistants — like Alexa, Google Assistant, Siri, and others — can do cool things like tell you the weather, order your favorite pizza, or turn your lights off before bed. And, depending on the voice assistant and which permissions you give, voice assistants might read your emails out loud and access your calendar and contacts. Here’s what to do to keep your voice assistant secure. 

Know How It Works

Voice assistants operate through stand-alone smart speakers or on your computer, tablet, or phone. To be ready to respond to your commands, some of these devices can listen for certain sound patterns — for example, they may be activated by a “wake word” (like “Alexa” or “OK, Google”). But they might mishear you, causing them to start recording when you least expect it. Voice assistants usually send recordings to the manufacturer’s servers, so take steps to be sure your interactions with your voice assistant — and your conversations with other people — remain private and secure.

Know When It’s Listening

Each time you interact with it, your voice assistant records what you say. It might also do that when you say something that sounds like the wake word. If you want to be sure that sensitive information isn’t picked up by your smart speaker, check for a physical setting (like a button or a switch) that stops the device from listening. You might also be able to activate light or sound alerts that tell you when your voice assistant is actively listening. Check your voice assistant’s settings options or the manufacturer’s website to learn more.

Check the Privacy Policy

Some voice assistant manufacturers have had employees listen to audio recordings in certain circumstances — say, to make their products work better. Check the privacy policy for your voice assistant to understand how your audio recordings are handled and who can listen to them. You may be able to change your settings to opt out of human review of recordings.

Delete Old Recordings

Review your default settings to check whether your voice recordings are automatically stored permanently. Usually, you’re able to set the length of time the manufacturer stores your voice recordings, and even delete old recordings. Go to the voice assistant app or log into your account on the manufacturer’s website to find out how. You might also have the option to set your voice assistant to auto-delete your recordings. 

Lock Down Your Login

Create a strong password for the app or online account that controls your voice assistant. Make sure your password is long — at least 15 characters. Making a password longer is generally the easiest way to make it stronger. Consider using a passphrase of random words so that your password is more memorable, but avoid using common words or phrases. If the service you use doesn’t allow long passwords, make your password stronger by mixing uppercase and lowercase letters, numbers, and symbols. And don’t reuse existing passwords from other accounts. If one of those accounts gets hacked, a hacker could try that same password to get into your voice assistant.

Know Which Accounts Are Connected To Your Voice Assistant

It might be convenient to enable shopping, or to link your email account so your voice assistant can read your emails out loud. But do you want everyone who uses your voice assistant to be able to shop, or get your emails? If not

  • add a PIN or turn off voice ordering to control whether others (like your visitors or kids) can use voice commands to buy things. You may also be able to limit your guests’ ability to access your information or make purchases by enabling “guest mode.” Check the manufacturer’s website to find out what features your voice assistant’s “guest mode” can disable
  • check to see if your system allows a passcode to give an extra layer of protection for your emails

Check your settings options or the manufacturer’s website to find out how to make these changes on your voice assistant. 

Use Multi-Factor Authentication, When Available

This makes it harder to hack into your account, even if a hacker gets your password. To use multi-factor authentication, you need two or more pieces of information to access your account — for example, a password and a random number generated by an authentication app. Check the security settings on your account to find out how to add this layer of protection.

Secure Your Router

Think of your router as home base for all your devices. The more secure your router, the more secure your connected devices will be.

Securing Your Internet-Connected Devices at Home

Our homes are filled with internet-connected devices. They let us see what’s happening at our homes from wherever we are, get our favorite music and shows with a voice command, or change the temperature on the thermostat from our phone. Here are some steps that can help protect your internet-connected devices from malicious hackers.

Start With Your Router

The key to privacy in the Internet-of-Things (IoT) world is your router. All your connected devices likely connect to the internet through your router.

  • Change the default settings. Start by changing the default administrative username, password, and network name to something unique. Don’t use login names or passwords with your name, your address, or your router brand.
  • Enable encryption. You can enable encryption by going to your administrative settings, then to your wireless security settings.
  • Check for updates. Remember to keep checking for hardware and software updates.

For more advice, including how to set up a guest network, see How To Secure Your Home Wi-Fi Network.

Protect Each Device 

  • Once your router is secure, search for each device connected to your router. To make sure you know which devices are connected, go to your router’s web interface and look for connected devices, wireless clients, or DHCP clients.

    Here are steps to take to protect each device connected to your router:

    • Change the default username and password. If your device came with a default username and password out of the box, change them. When you set a new password, don’t reuse one from another account. Hackers sometimes use stolen usernames and passwords from data breaches to hack your other accounts.
    • Use two-factor authentication. If a device offers two-factor authentication (a password plus something else, like a code sent to your phone or a thumbprint scan), use it.
    • Set up the security features on your device. Take advantage of your device’s security features, like enabling encryption or setting up a passcode lockout to add another layer of protection to your device.
    • Update your device regularly. Check for updates to the firmware (the software on the device). You may need to do this on the manufacturer’s website. Also, if your device is accessible through an app on your phone, use the most up-to-date version of the app.
    • Disable or disconnect what you don’t use. Disable features you won’t use. If you won’t use remote management, it’s best to disable it. Also, disconnect older devices you no longer use from the network. Their security may be out of date, creating a weak point on your network.

    Here are other steps to take for some of the most common connected devices you may have in your home.

    Smart TVs

    Are you worried about your smart TV watching you? Find your TV’s tracking settings and change them to match your privacy preferences. Also make sure to remove apps you don’t use. They can collect data on your behavior even when you’re not using them.

    IP cameras

    What about IP cameras (like baby, pet, or security cams) that offer live video and audio feeds you can see remotely over the internet? Many IP cameras are vulnerable to digital snooping. So, in addition to changing the default settings, check the camera’s access logs regularly for unauthorized access. Look for things like IP addresses you don’t recognize or odd access times that don’t fit your normal patterns. You can check the logs through your administrative settings. For more advice, read Using IP Cameras Safely.

    Voice assistants

    Voice assistants can respond to your every command. But they can also listen all the time and even send recordings to the manufacturer. For advice about privacy and voice assistants, read How To Secure Your Voice Assistant and Protect Your Privacy.

Sources and publication details

The federal agency source text is U.S. government work in the public domain. Fynoptic selected, adapted, and formatted it for this guide. No agency endorsement is implied. Follow the linked sources for current program details and the rules applicable to your circumstances.

Back to all articles