We analysed data collection practices of major brands across smart speakers, washing machines, TVs, video doorbells and security cameras. Every brand required exact location data, despite this arguably not being necessary for the product's functionality, and some even want to track where you are when you aren't using the app. But that is just the tip of this iceberg.
Read on to find out what brands demand when using their products, and how to improve your data privacy at home.
News, deals and stuff the manuals don't tell you.What can smart device brands do with my data?
Data collection isn’t inherently a bad thing – it can help companies make appliances run more efficiently, optimise them to your needs and develop better products.
However, the vast amounts of data that smart devices generate on us can also be funnelled into the global marketing industry.
Smart speaker voice assistantsTV brandsWashing machine firmsSmart security camerasKnowing how you live your life has never been more valuable, so you should be fully in control of what you share and for what reasons, and what stays private.
Are smart speakers listening to you?
Smart speakers are only supposed to listen when you want them to, but this isn't always the extent of data collection. We found that Bose smart speakers share user data with Meta, the parent company of Facebook. Google Nest products request contacts and location on Android, but not on Apple’s iOS, despite the app functioning the same on both operating systems.
As you can see in the table below, there is a stark difference in the volume of data requested by smart speakers if you own an Android phone versus an Apple iOS device.
We've been unable to ascertain why this additional data is collected. However, Google’s primary business is advertising and marketing, whereas Apple currently focuses on selling hardware.
Security camera and smart doorbell brands tracking your data
Based on our testing, Chinese brand Ezviz's devices, sold by major high-street retailers including Argos, had by far the most tracking firms active. These included Pangle (TikTok’s business marketing unit), Huawei, as well as Google and Meta.
Every single brand we assessed used tracking services from Google, while Blink and Ring also connected to parent company Amazon. Google’s Nest product demands the user's full name, email, date of birth and gender.
On Android apps, Arlo, Eufy and Ring also want permission for people’s background location, meaning they could track users even when they aren't using the app. All permissions are activated by default. Consumers can opt out, but this requires changing the settings and could lead to aspects of the device or app no longer fully working.
Smart TVs – who’s watching who?
Smart TV menus are now flooded with adverts, some of them personalised based on your data. Most TV brands use a system called automatic content recognition (ACR) to track what you watch. Alongside linear TV, it can track you via an app on the system or even through a connected device, such as a Blu-ray player or games console.
Most TV tracking is optional, so you have to agree to it before the brand will do anything. However, LG, Samsung and Sony bundle this up into an ‘accept all’ button. While it's tempting to just click this, in doing so you could end up sharing your cosy nights in front of the telly with a host of marketing companies.
The table below shows whether a brand gives you control with an opt in/out option, but data collection could still happen without offering a choice of consent.
Smart washing machines – your data in a spin cycle
Data tracking is as programmed into smart washing machines as a 40°C wash cycle. For smart washing machines, we were surprised to find companies needing users' date of birth – although this is optional on Beko machines, LG and Hoover will not allow use of the app without knowing when customers were born.
LG wants the most data of all the washing machine brands – the company asks for the customer’s name, date of birth, email, phone contact book, precise location and phone number. Hoover wants users’ contacts and phone numbers on Android devices. With Miele, tracking of precise location is enabled by default, and is required to use the app.
With washing machines on average lasting 11 years or even longer, that is a long time for your data to be potentially tracked. It is rarely 100% clear what a company would do with this data, and we don’t have evidence that it is being sold off to the highest bidder by any of these companies.
Are data collection practices in the 'small print'?
To get a rough idea what a smart device and its app will do with your data, you predominantly have to read the privacy policy and parts of the Terms and Conditions that cover data. However, a third of the Which? members surveyed admitted to not reading any of the privacy policy when downloading the app, while two thirds said that they merely skimmed it.
199,905 wordsWhat protections are there for data collection?
Under the General Data Protection Regulations (GDPR), companies must be transparent about the data they collect and how it’s processed. The data gathered must be relevant and limited to what is necessary for the processing to take place.
However, the reasons for taking information are often broad, such as in companies’ ‘legitimate interests’. While it all should be listed in a privacy policy, the reality is that when you come to click ‘accept’, unless you closely analyse the fine print, you have little to no idea what will actually happen next with your data.
We believe greater consideration around these 'legitimate interests' is necessary, and that a better standard to improve transparency for consumers is long overdue.
Rocio Concha, Which? director of policy and advocacy, said:'Firms should not collect more data than they need to provide the service that’s on offer, particularly if they are going to bury this important information in lengthy terms and conditions.
'The Information Commissioner’s Office should crack down on data collection by manufacturers and marketing firms that appears to go beyond "legitimate interests". A proper standard or code of practice should also be put in place to make the rules clearer.'
How to improve your data privacy
While it's rarely possible to take full control of what data you share and how it's used, there are often ways to tailor device settings to shore things up. Consider the following when setting up and using a new smart device.
Care what you shareCheck permissionsDeny accessDelete recordingsRead the privacy policySmart device brands respond to Which? findings
Amazon (Echo, Blink and Ring):'We are thoughtful and transparent about the information needed to develop, provide, and improve the products and services that we offer our customers, allowing us to deliver a more personalized experience, and to analyse and improve the performance of our devices and services.'
Google: Miele: SamsungAEG/Electrolux, Bose Hoover/HaierApple, Arlo, Beko, Ezviz, Hisense, LG, Panasonic,Philips,Sonos Sony Eufy TP-Linksource https://www.which.co.uk/news/article/the-smart-device-brands-harvesting-your-data-al4vp6Z3ePDf