What did security researchers conclude when they tested whether Amazon Echo permanently surveils users — and what limited their analysis?

No evidence of permanent surveillance: data is sent only on explicit wake-word activation. SSL encryption and certificate pinning blocked content analysis and MITM, so researchers could only measure traffic metadata.

Independent researchers used physical hacking, legitimate "online shopping by voice" tests, and man-in-the-middle interception to check whether Echo continuously sends data.

Technical limits to the analysis:

• SSL encryption: end-to-end encryption prevents content analysis.
• Certificate pinning: the device verifies certificates, making MITM attacks much harder.

Despite encryption, the data throughput can still be measured — connection timing, data volume, communication frequency, target servers and ports.

Conclusion: no indication of permanent surveillance — data is sent only on explicit wake-word activation; continuous streaming was not observed.

Tip: Certificate pinning is why you can't just run a MITM proxy on a smart device — the device refuses any certificate that isn't the exact one it expects, even a "valid" one from a trusted CA.