The short answer
The microphone in a voice assistant is on most of the time, but the network transmission is not. A small piece of software called a wake-word detector listens for a specific phrase ("Alexa," "Hey Google," "Siri") and discards everything else without sending it anywhere. When the wake word is heard, the device starts streaming audio to the provider’s servers for processing. That is the model. It is also, importantly, not the whole story.
How wake words actually work
A wake-word detector is a small neural network running entirely on the local device. It listens to a rolling buffer of one to two seconds of audio. It does not transcribe; it pattern-matches against the trained wake phrase. When it fires, the device begins transmitting subsequent audio to the cloud for full speech-to-text processing. The buffer immediately before the wake word is also typically transmitted, which is why your assistant can hear "Alexa, turn off the lights" rather than dropping the word "Alexa." That pre-roll is small, on the order of a half second.
The honest part: every major manufacturer has at some point shipped a device that wake-fired on something other than the official wake word, or that left the microphone hot in scenarios that violated the documented model. Apple, Google, and Amazon have all settled or addressed reported incidents. The frequency is low. The risk is non-zero.
What "always listening" really means and does not
"Always listening" is technically accurate at the microphone level. The microphone is sampling audio continuously to feed the wake-word detector. "Always transmitting" is what people usually mean when they ask the question, and the answer to that is no, with caveats: only after wake-word fire, only to the manufacturer’s servers, and (in some cases, depending on settings) recordings may be retained for product improvement. You can opt out of that retention on most platforms but it is rarely the default.
Amazon, Google, and Apple compared
- Amazon Echo: Wake word detected locally. Audio after wake word sent to AWS. Recordings retained by default; opt-out available. New "Alexa+" agentic tier expands what data the platform processes.
- Google Nest: Same general model. Tighter integration with the broader Google ad and account graph, which is the privacy concern most often raised.
- Apple HomePod: Wake word detected locally. Most processing now on-device with Apple Intelligence on M-series and A17 Pro and later. Server-side processing falls back to Private Cloud Compute, which Apple architects to make queries non-attributable to a user.
Of the three, Apple is structurally the best privacy story. None of the three is as private as a local stack you control.
How local voice eliminates the question
The Restrepo local voice stack runs a wake-word detector (openWakeWord), a speech-to-text model (Whisper or Voxtral), and an intent processor (a small Llama or Phi model) on a Mac Mini or NVIDIA box on your home network. The microphone is local. The wake-word detector is local. The transcription is local. The intent dispatch is local. No audio leaves your premises at any point in the chain. The router pattern around it can still call cloud models for non-voice tasks, but the listening question goes away entirely.
FIELD NOTE
The right answer to "is it always listening" is "you decide." We will deploy the cloud version, the local version, or a hybrid. The choice is the client’s. The default we recommend for a luxury residence is local.
The Crestron and Sonos integration patterns
For Crestron Home, we wire the local voice stack as a virtual room source. The Crestron processor sees voice commands as documented API calls, not as audio. For Sonos, we use the local stack to interpret the voice command and then drive Sonos via its standard API. Sonos still hears its own room audio for the duration of a query if the user is using Sonos Voice Control, but the kitchen-microphone-to-cloud loop does not exist in our installs.
What we configure and why
For most clients, the configuration we deploy is: wake word "Restrepo" or a custom phrase chosen by the client; Whisper running on a Mac Mini or Mac Studio; Home Assistant Assist as the intent router; documented bridge to Crestron Home, Lutron, and Sonos. The microphone hardware is hardwired and PoE-powered so the client can pull the cable and verify silence. Total install is two to four days of work for a competent integrator.
If you want to verify it yourself
Two methods we have used in client demos. First, monitor the network: with a UniFi gateway you can watch outbound traffic from the device’s MAC address and see exactly what it transmits. Second, pull the ethernet cable: a properly designed local stack should keep functioning. A cloud stack will go silent immediately. If your "private" voice assistant fails the cable test, it is not private.