Alexa is listening.

Capital One was famously the first major bank to integrate with Alexa, Amazon‘s virtual assistant that resides in Echo smart speakers as well as a growing array of other devices.

Voice banking — operating one’s bank account by voice — is a hot topic in the industry today, but many questions remain. One problem is no one is quite sure what data Alexa is collecting, or what Amazon is doing with it.

A New Hampshire judge recently subpoenaed recordings from an Echo device in a murder case. Why? Because the judge had reason to believe the speaker was recording at the time of the crime, because the speaker may always be recording.

True or not, this perception presents a problem for banks, which go to great lengths to safeguard customer information. A Capital One spokeswoman told Bank Innovation it had protections against data leakage in its Amazon contract: “Protecting customer information is a top priority. Our contract with Amazon has stringent restrictions on data access and use.”

Regarding what information the bank receives from Alexa/Amazon, the Capital One spokeswoman said,

When a customer invokes the Capital One skill (e.g., by saying “Alexa, open Capital One” or “Alexa, ask Capital One”) and asks a question, we subsequently receive information about the customer’s question in the form of the requested “intent” (e.g., “balance”, “recent transactions”, etc.). We do not receive audio files of the customer’s question. We also do not receive customer data from Amazon about a customer’s general interactions with Alexa or their interactions with other non-Capital One Alexa skills.

James Wester, research director for IDC Worldwide, told Bank Innovation that worries about an “always-on” Alexa are overblown, primarily because it is “not physically possible” for Amazon to store all of that data. That said, there is plenty to worry about in “surveillance commerce,” Wester said. Searches at retailers, Wester said, give Amazon and others “an interesting insight into some very personal stuff. That’s data we choose to give away. In a voice commerce world — or something similar where devices proactively shop on our behalf — that data is collected without our say so. Convenient? Yes. Disconcerting? Also, yes.”

Insurance providers like the Amazon/Berkshire Hathaway/JPMorgan Chase venture could conceivably use signals and data from Alexa to set rates, to use what Wester described as a dystopian example. “The concern is that AI thrives on data, and all of that data comes from somewhere,” Wester said. “We create data all the time, and the connected devices we’re populating our world with are very effective nets to capture all of that data, usually without our thinking about it.”

There are things people don’t want companies that thrive on data to know. The most prominent companies offering smart speakers today are Amazon, Google, Facebook, and Apple. Banks that operate on these devices will need to set strict boundaries. It appears Capital One has done so, but transparency for consumers is woefully lacking and should improve over time. Are privileged conversations within range of these listening devices possible? Tech does not face anywhere near the regulation that financial services does, so for now there is no way to know.

Bank Innovation reached out to Amazon for its side of what Alexa hears and retains from bank-related conversations, but Amazon had not responded by presstime.