No security researcher has ever found proof that they are "always on" and recording everything people say. If they were, it would be front-page news and Amazon would have government investigations.
The devices listen for their wake word before ever transmitting data to the cloud. (This is also because the sheer amount of bandwidth needed for always-on would be un-economical even for Amazon).
This is not strictly true. I examined a master's degree thesis last semester where the student proved conclusively that Alexa devices are periodically spamming bursts of data back to Amazon HQ even when not woken. Beyond a heartbeat, too - MBs of data, not KBs.
No clear idea what that data is, though. There's at least a small chance it isn't benign.
Scope of his work didn't go that far, he looked at several devices and Alexa was notably chatty. He was measuring for abnormal data bursts from IoT home devices - included things like smart bulbs etc.
Do sample recordings, reduce bitrate (you can have good voice recording and playback at less than 3kb/sec) and upload only if the device detects something worthy of notification.
Hell, don't even send the sound, just send a weekly report of events.
