The 15-second commercial caused the voice-activated Google Home device to read the Wikipedia entry for the Whopper. In TV spots that aired nationally on Wednesday, a Burger King employee asked, “OK, Google. What is the Whopper burger?” and the phrase acted as a trigger for the device, until Google took steps to disable the command on Wednesday.

Lawyers and regulators say the stunt, although it may be an effective piece of advertising, could put both the burger chain and Google at risk of legal recourse and consumer backlash.

“It’s unreasonable for Google not to have appropriate mechanisms in place so that the device couldn’t be activated by a third party,” said intellectual property lawyer Faith D. Kasparian, from Morse, Barnes-Brown & Pendleton. “On the part of Burger King, I don’t know what they’re thinking. A reasonable person would probably not expect that a third party could activate a device like this in their home.”

The FTC could have a claim against Google for the spot, on the grounds that consumers didn’t receive adequate disclosures, Kasparian said. Google has “a history with the FTC,” she said, with several consent orders issued against the company. Google could also take legal action against Burger King for “inappropriately leveraging that device,” Kasparian added.

“FTC investigations are non-public, and we do not comment on an investigation or the existence of an investigation,” Juliana Gruenwald Henderson, a spokeswoman for the Federal Trade Commission, said in an emailed statement.

Google declined to comment.

Google Home does not distinguish between different voices speaking in its proximity. This means the device will obey any voice it hears, whether it originates from its owner or an opportunistic television commercial. A feature to identify different voices is rumored to be in development.

The company specifies the current limitations in one of the printed user guides that ships with the product. “If you make your Google Home available for others to use, please be sure to let them know that their interactions may be stored by Google,” it reads, along with a web link for further information about how guests’ speech may be picked up by the gadget’s microphone.

In Europe, Google Home could face increased scrutiny. European regulators have introduced new privacy rules meant to curb Google and its U.S. tech peers over their collection of data on computers and mobile phones. Voice-activated devices, like the speakers Google and Amazon sell, are likely to face additional obstacles there.

Google Home is not available in Germany yet, and one of Germany’s most outspoken data protection commissioners said the regulator would “look very closely into Google Home when it comes to the German market,” following the ad controversy. “If an ‘OK Google’ is enough to send the privately spoken word across the internet to global data centers, abuses and surprises are difficult to avoid,” Johannes Caspar said in an email.

The Information Commissioner’s office, a U.K. agency that oversees consumer privacy, declined to comment on Google Home. “Any organization processing personal information must comply with data protection law,” an ICO spokeswoman said in a statement.

Christopher Coughlan, a lawyer specializing in data protection issues at Ashfords LLP, said U.K. regulators would “have a dim view of it.” Since the ICO named Elizabeth Denham as commissioner in July, it has issued the biggest fines in its history. Artificial intelligence and profiling in advertising is “something they are going to focus on over the next few years,” Coughlan said.