DOI: 10.47743/jss-2025-71-5-2

Faculty of Law, Babeș-Bolyai University, Cluj-Napoca; Faculty of Law, Bogdan-Vodă University, Cluj-Napoca.

Abstract: Voice assistants are now a focus point of how customers consume and interact with music streaming platforms. Through voice-based processing and behavioral analysis, these systems create complex overlaps of entertainment tech, data privacy, and communication practice. While privacy laws provide a regulatory framework, how much the consumer is aware and able to manage their data is low, especially where there are several parties involved, such as device manufacturers and streaming services. This paper will discuss the collection, processing, and dissemination of data by voice assistants, specifically in the areas of privacy policies, legal regulations, and communication practices. It will be focused on certain areas of transparency, accountability, and security practices related to voice data, as well as the challenges in exercising consent. The result will be the integration of the law, communication, and security aspects in voice-based music streaming services, as well as recommendations on the understanding and exercising of consent. In this work, the relationship between the law and communication, as well as security, is important so that there is no intrusion and trust is built in order to obtain consent.

Keywords: voice assistants, music streaming, privacy law, communication, consent, smart devices

References:

ANSPDCP, New General Data Protection Regulation (GDPR) – resources, available online at: https://www.dataprotection.ro/?page=noua+_pagina_regulamentul_GDPR, accessed on 2 February 2026.

Article 29 Data Protection Working Party, Opinion 3/2012 on developments in biometric technologies (WP193, adopted 27 April 2012), available online at: https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/fil es/2012/wp193_en.pdf, accessed on 11 July 2026.

Article 29 Data Protection Working Party, Guidelines on transparency under Regulation (EU) 2016/679 (WP260 rev.01, as last revised and adopted 11 April 2018), European Data Protection Board, available online at: https://www.edpb.europa.eu/ system/files/ 2023-09/wp260rev01_en.pdf, accessed on 11 July 2026.

Associated Press, Amazon ends little-used privacy feature that let Echo users opt out of sending recordings to company, in AP News, 19 March 2025, available online at: https://apnews.com/article/amazon-privacy-echo-7fb3c19fa7f664bde5c5be259f8b23 ee, accessed on 11 July 2026.

Alchekov S. S., Al-Absi M. A., Al-Absi A. A., Lee H. J., Inaudible Attack on AI Speakers, in Electronics, vol. 12, no. 8, 2023, art. 1928, DOI: https://doi.org/10.3390/ electronics12081928.

Court of Justice of the European Union, Judgment of 19 October 2016, Patrick Breyer v. Bundesrepublik Deutschland, Case C-582/14, available online at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62014CJ0582, accessed on 11 July 2026.

Court of Justice of the European Union, Judgment of 5 June 2018, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v. Wirtschaftsakademie Schleswig-Holstein GmbH, Case C-210/16, available online at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62016CJ0210, accessed on 11 July 2026.

Court of Justice of the European Union, Judgment of 29 July 2019, Fashion ID GmbH & Co. KG v. Verbraucherzentrale NRW eV, Case C-40/17, available online at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62017CJ0040, accessed on 11 July 2026.

Cranor L. F., Necessary but Not Sufficient: Standardized Mechanisms for Privacy Notice and Choice, in Journal on Telecommunications and High Technology Law, vol. 10, no. 2, 2012, pp. 273–308, available online at: https://scholar.law.colorado.edu/ ctlj/vol10/iss2/7/, accessed on 11 July 2026.  online

European Data Protection Board, Guidelines 02/2021 on virtual voice assistants (Version 2.0), available at: https://www.edpb.europa.eu/system/files/2021-07/edpb_ guidelines_202102_on_vva_v2.0_adopted_en.pdf, accessed on 11 July 2026.

European Data Protection Board, Guidelines 07/2020 on the concepts of controller and processor in the GDPR (Version 2.1, adopted 7 July 2021), available online at: https://www.edpb.europa.eu/system/files/2023-10/EDPB_guidelines_202007_contr ollerprocessor_final_en.pdf, accessed on 11 July 2026.

European Parliament and Council of the European Union, Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), available online at: https://eur-lex.europa.eu/ eli/reg/2016/679/oj, accessed on 11 July 2026.

Federal Trade Commission, FTC and DOJ Charge Amazon with Violating Children’s Privacy Law by Keeping Kids’ Alexa Voice Recordings Forever and Undermining Parents’ Deletion Requests, 31 May 2023, available online at: https://www.ftc.gov/ news-events/news/press-releases/2023/05/ftc-doj-charge-amazon-violating-childre ns-privacy-law-keeping-kids-alexa-voice-recordings-forever, accessed on 11 July 2026.

Hernández Acosta L., Reinhardt D., „Alexa, how do you protect my privacy?” A quantitative study of user preferences and requirements about smart speaker privacy settings, in Computers & Security, vol. 151, 2025, art. 104302, DOI: https://doi.org/ 10.1016/j.cose.2024.104302.

HmbBfDI – Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Sprachassistenzsysteme auf dem Prüfstand – Datenschutzbehörde eröffnet Verwaltungsverfahren gegen Google (press release), 1 August 2019, available online at: https://datenschutz-hamburg.de/fileadmin/user_upload/HmbBfDI/ Pressemitteilungen/2019/2019-08-01_Google-Assistant.pdf, accessed on 11 July 2026.

Khezresmaeilzadeh T., Zhu E., Grieco K., Dubois D. J., Psounis K., Choffnes D., Echoes of Privacy: Uncovering the Profiling Practices of Voice Assistants, in Proceedings on Privacy Enhancing Technologies, vol. 2025, no. 2, 2025, pp. 71–87, DOI: https://doi.org/10.56553/popets-2025-0050.

Lau J., Zimmerman B., Schaub F., Alexa, are you listening?, in Proceedings of the ACM on Human-Computer Interaction, vol. 2 (CSCW), art. 102, 2018, pp. 1–31, DOI: https://doi.org/10.1145/3274371.

Malkin N., Deatrick J., Tong A., Wijesekera P., Egelman S., Wagner D., Privacy Attitudes of Smart Speaker Users, in Proceedings on Privacy Enhancing Technologies, vol. 2019, no. 4, 2019, pp. 250–271, DOI: https://doi.org/10.2478/popets-2019-0068.

Romanian Parliament, Law no. 190 of 18 July 2018 on measures for the implementation of Regulation (EU) 2016/679, available online at: https://legislatie.just.ro/Public/ DetaliiDocument/203151, accessed on 11 July 2026.

Terzopoulos G., Satratzemi M., Voice assistants and smart speakers, in Informatics in Education, vol. 19, no. 3, 2020, pp. 473–490, available online at: https://files.eric.ed.gov/fulltext/EJ1267812.pdf, accessed on 11 July 2026.

Uyar L., Clement M., Veseli B., Kandziora M., The rise of smart speakers: A comparative analysis of music streaming service adoption and platform interdependencies, in Journal of Media Economics, vol. 37, no. 3, 2025, pp. 129–147, DOI: https://doi.org/10.1080/08997764.2025.2494994.

van Mil J., Quintais J. P., A matter of (joint) control? Virtual assistants and the General Data Protection Regulation, in Computer Law & Security Review, vol. 45, 2022, art. 105689, DOI: https://doi.org/10.1016/j.clsr.2022.105689.

Zhang G., Yan C., Ji X., Zhang T., Zhang T., Xu W., DolphinAttack: Inaudible voice commands, in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS '17), 2017, DOI: https://doi.org/10.1145/3133956.3134052.