Amazon’s new Bee AI devices ask the wrong person for consent, according to a privacy and security veteran who previously worked as a senior principal security engineer at Amazon Web Services.
In a LinkedIn article, Jeff Williams writes that Bee’s consent safeguards are aimed at the wearer, while the people being recorded have no practical way to say no.
Amazon unveiled the devices Thursday, the first new Bee hardware since it acquired the San Francisco startup last year. The $74.99 Bee Frontier goes on the wrist or clips to clothing, and the $99.99 Bee Eclipse snaps onto the back of a phone.
Both turn conversations into summaries and to-do lists, with connections to Amazon.com and Alexa+ for paid subscribers.
How Bee handles consent: Amazon says users are prompted to get permission from call participants each time they start a recording, and the devices show an indicator light while in use.
The problem, Williams says, is that neither one reliably tells the other people in a conversation that they’re being recorded. He writes that the prompt appears only on the wearer’s phone, and nothing enforces it.
“A prompt instructing the user to obtain permission is a liability allocation,” he wrote, arguing that Amazon is shifting responsibility for obtaining consent onto the wearer.
The light is easy to hide under a sleeve or in a pocket, he notes, and a device on the wrist or phone sits outside the frame on a video call.
Williams points to Meta’s Ray-Ban glasses as an example. In September, the data protection authority in Hamburg, Germany, found the glasses’ recording light hard to see outdoors and concluded that a recording indicator alone doesn’t establish informed consent under Europe’s GDPR.
In the U.S., about a dozen states, including Washington state and California, generally require consent from everyone before a private conversation can be recorded.
Whose data is protected: Williams gives Amazon credit for Bee Private Compute, which processes audio in an isolated, encrypted environment built on AWS Nitro and then deletes it. Amazon says only the customer can access the resulting data, not Amazon or Bee.
But that protects the wearer. The words of the people around the wearer still end up in transcripts and summaries they can’t see or remove. Amazon says those speakers aren’t identified by name unless they complete a voice training exercise with the device’s owner.
Williams notes that Amazon has changed comparable privacy commitments before, such as ending the “Do Not Send Voice Recordings” option on some Echo devices last year.
Williams also advises companies to keep the devices out of client meetings and privileged discussions, since the transcripts end up in an employee’s personal account, where the company can’t see or manage them.
A proposed fix: Williams says Bee should leave other people’s voices out of transcripts by default, unless they’ve enrolled their voices and agreed to be recorded. Before the acquisition, Bee indicated plans to record only the voices of people who had verbally consented, according to TechCrunch.
“I know first-hand that Amazon has the engineering talent to ship it,” he wrote.
Amazon’s response: The company didn’t comment directly on the critique but pointed to safeguards built into the devices.
One is an automatic shutoff: the devices turn off if they don’t detect the owner’s voice for 5, 15, 30 or 60 minutes, depending on the user’s setting. Amazon says that reinforces that Bee is “a personal AI assistant, not a device designed to passively pick up audio throughout the day.”
The company says it educates customers about responsible use in the Bee app, and that Eclipse will send push notifications encouraging users to let people around them know they’re using Bee and to ask for permission.
Williams, now chief information security officer at Sigma360, worked at AWS from 2023 to 2025 and spent more than 12 years at Microsoft before that, including as a privacy officer for its services business. Read his full article on LinkedIn. Read his full article on LinkedIn.
