Smart home devices collect more data than necessary, according to a study by Which? that looked into the data collection practices of 23 major brands.
In the report published on Thursday, Which? researchers analyzed four types of smart devices, namely smart speakers, TVs, security cameras, and washing machines. They found that they’re all guilty of invasive data collection practices, and some share this data with others.
“Every brand required exact location data, despite this arguably not being necessary for the product’s functionality, and some even want to track where you are when you aren’t using the app,” the report said. “But this is just the tip of the iceberg.”
The report from Which? comes a day after the Mozilla Foundation published a report showing that modern connected cars collect more personal data than necessary.
‘Far More Data Than is Needed’
Which? said smart devices collect way more data than is necessary for their functionality, and sometimes the data collected varies on Apple’s iOS and Android devices.
For instance, Bose smart speakers were found to share users with Meta — Facebook’s parent company. And, while Google’s Nest smart speakers requested contacts and location data on Android devices, this data was not required on Apple’s iOS, despite identical app functionality on both platforms.
“We’ve been unable to ascertain why this additional data is collected. However, Google’s primary business is advertising and marketing, whereas Apple currently focuses on selling hardware,” Which? noted.
While all smart security brands are guilty of sharing user data, Chinese brand Ezviz was found to share more data with third-party companies than other smart camera and smart doorbell brands.
Furthermore, Chinese brand Ezviz’s security cameras, sold by major retailers, garnered the highest number of active tracking firms, including Google and Meta, the report said. The firms actively tracking users’ data on Ezviz devices include Meta, Google, Pangle (TikTok’s marketing arm), and Huawei.
Which? found that smart TVs also track users to deliver ads. “Most TV brands use a system called automatic content recognition (ACR) to track what you watch,” the report said.” Alongside linear TV, it can track you via an app on the system or even through a connected device, such as a Blu-ray player or games console.”
Which? also expressed surprise at the personal data smart washing machine brands request from users. LG is particularly notorious for this, requesting users’ names, dates of birth, email addresses, phone contacts, location data, and phone numbers.
Calls for Regulatory Crackdown
“Firms should not collect more data than they need to provide the service that’s on offer, particularly if they are going to bury this important information in lengthy terms and conditions,” Rocio Concha, Which? director of policy and advocacy, said.
Concha called on the Information Commissioner’s Office (UK ICO) to enforce stricter regulations on data collection practices that appear to go beyond “legitimate interests” and advocated for a standard or code of practice to improve transparency.
“Consumers have already paid for smart products, in some cases thousands of pounds, so it is excessive that they have to continue to “pay” with their personal information,” Concha noted.
While privacy laws like the GDPR require manufacturers to state why they’re collecting particular data, this information is usually buried in a product’s privacy policies and terms of service.
“To fully consume all policies and T&Cs for the 23 brands we researched would mean ploughing through 199,905 words. At an average reading rate of around 250 words per minute, that would take 13 hours and 30 minutes to complete – longer than driving from London to John O’Groats or a non-stop flight from London to Singapore,” the report said.
Unsurprisingly, a third of Which? members said they did not read the privacy policy before downloading an app, and there may be reasons for this.
Protecting Your Privacy
Responding to Which?’s investigation, tech giants like Amazon and Google insisted they comply with applicable privacy laws and use data responsibly.
To safeguard your privacy, Which? recommends reviewing permission requests before approving them, limiting devices’ access to certain data like your location and contacts, deleting recordings on smart speakers, and reading their privacy policies.
For more information about how smart devices violate your privacy and security tips, read our guide to the privacy risks of smart speakers.
For more user privacy insights, follow us on X (Twitter), Threads, and Mastodon!
