When it thinks it hears it, it lights up and starts recording. A 2020 study found everyday dialogue sometimes triggers that by mistake. The good news: researchers found no evidence of constant recording, and UK law now sets basic security rules.
Pick a setting to see what the National Cyber Security Centre advises. The bar shows how much a step matters, in our reading of the guidance.
Based on NCSC guidance, Smart devices: using them safely in your home. The ordering is our own summary, not an official ranking.
TWO NUMBERS WORTH KNOWING
How often, how long.
From a 2020 study by Northeastern University and Imperial College London.
0.95 per hour
Highest rate for one speaker and one show
Across all shows, the most-triggered devices woke about 0.4 times an hour without the wake word. One speaker playing one dialogue-heavy drama averaged 0.95 an hour.
ACCIDENTAL WAKES · PETS 2020
10%
Activations lasting 8–10 seconds or more
For three of the speakers tested, 10% of accidental activations lasted at least 8 to 10 seconds, long enough to capture parts of a conversation.
RECORDING LENGTH · PETS 2020
The researchers found no evidence of constant recording or of secret, unrelated wake words. Unclear speech, foreign languages and dense dialogue made mistaken wakes more likely.
FOUR STEPS FROM THE NCSC
Set up smart, stay safe.
These apply to smart speakers and to other connected gadgets in the home, from cameras to kettles.
Create a strong password
Set your own password at first set-up, or change the default. Combining three random words works well.
Turn on 2-step verification
If the app offers it, 2SV double-checks that it is really you signing in.
Keep it updated
Switch on automatic updates so security fixes arrive without you having to remember.
Check the support date
Before buying, find out how long the maker will provide security updates. UK law now requires that date to be published.
AI-generated image, not a photograph of a real person or place.
WHAT UK LAW SAYS
Three rules since 2024.
AI-generated image, not a photograph of a real person or place.
The UK's product security regime came into effect on 29 April 2024. Passwords must be unique per product or set by the user, and must not be easily guessable or based on things like serial numbers.
Makers must also say how to report security issues, and publish the minimum period for which security updates will be provided, with an end date, in a clear and accessible way.
Questions
Questions people ask
Is my smart speaker recording everything?
The 2020 study found no evidence of constant recording. Devices did wake up by mistake fairly often, but usually only for short periods.
What makes a speaker wake by mistake?
Words that sound like the wake word. The researchers found unclear speech, foreign-language dialogue and dense conversation caused more mistaken wakes.
Are accidental recordings sent anywhere?
In the study, almost all activations detected on the device were also sent over the internet to the maker's cloud service.
What does the 2024 UK law change?
Smart products sold in the UK must not use guessable default passwords, must say how to report security issues, and must publish how long they will get security updates.
What is the easiest thing to do today?
The NCSC suggests checking the password is your own, switching on automatic updates and turning on 2-step verification if it is offered.
