The smart device brands harvesting your data

Our smart home devices are watching us – and so are a host of marketing companies. Many brands appear to collate far more data than is needed for the product to function, from smart speakers that share customer data with TikTok and Meta, to smart TVs that insist on knowing viewing habits.

We analysed data collection practices of major brands across smart speakers, washing machines, TVs, video doorbells and security cameras. Every brand required exact location data, despite this arguably not being necessary for the product's functionality, and some even want to track where you are when you aren't using the app. But that is just the tip of this iceberg. 

Read on to find out what brands demand when using their products, and how to improve your data privacy at home.

News, deals and stuff the manuals don't tell you. Sign up for our Tech newsletter, it's free monthly.

What can smart device brands do with my data? 

Data collection isn’t inherently a bad thing – it can help companies make appliances run more efficiently, optimise them to your needs and develop better products.

However, the vast amounts of data that smart devices generate on us can also be funnelled into the global marketing industry.

• Smart speaker voice assistants can be used for asking questions about things you’re interested in or might want to buy.
• TV brands may track what you watch and use it to serve you ads or personalised marketing when you're trying to enjoy entertainment in peace. 
• Washing machine firms could know how frequently you wash and at what temperatures – valuable data to detergent companies and energy suppliers.
• Smart security cameras may know where you live, the size of home and if you have a fancy car, and can use this to build a profile of how affluent you are. 

Knowing how you live your life has never been more valuable, so you should be fully in control of, or at least aware of, what you share and for what reasons.

Are smart speakers listening to you?

Smart speakers are only supposed to listen when you want them to, but this isn't always the extent of data collection. We found that Bose smart speakers share user data with Meta, the parent company of Facebook. Google Nest products request contacts and location on Android, but not on Apple’s iOS, despite the app functioning the same on both operating systems.

As you can see in the table below, there is a stark difference in the volume of data requested by smart speakers if you own an Android phone versus an Apple iOS device. 

We've been unable to ascertain why this additional data is collected. However, Google’s primary business is advertising and marketing, whereas Apple currently focuses on selling hardware.

Browse our smart speaker reviews to see which models come out on top in our tests.

Security camera and smart doorbell brands tracking your data

Based on our testing, Chinese brand Ezviz's devices, sold by major high-street retailers including Argos, had by far the most tracking firms active. These included Pangle (TikTok’s business marketing unit), Huawei, as well as Google and Meta.

Every single brand we assessed used tracking services from Google, while Blink and Ring also connected to parent company Amazon. Google’s Nest product demands the user's full name, email, date of birth and gender. 

On Android apps, Arlo, Eufy and Ring also want permission for people’s background location, meaning they could track users even when they aren't using the app. All permissions are activated by default. Consumers can opt out, but this requires changing the settings and could lead to aspects of the device or app no longer fully working.

Our security camera reviews and smart doorbell reviews include in-depth tests to ensure each model is secure and protected from hackers. 

Smart TVs – who’s watching who?

Smart TV menus are now flooded with adverts, some of them personalised based on your data. Most TV brands use a system called automatic content recognition (ACR) to track what you watch. Alongside linear TV, it can track you via an app on the system or even through a connected device, such as a Blu-ray player or games console. 

Most TV tracking is optional, so you have to agree to it before the brand will do anything. However, LG, Samsung and Sony bundle this up into an ‘accept all’ button. While it's tempting to just click this, in doing so you could end up sharing your cosy nights in front of the telly with a host of marketing companies.

The table below shows whether a brand gives you control with an opt in/out option, but data collection could still happen without offering a choice of consent.

Check our TV reviews for the latest test results from the biggest TV brands. 

Smart washing machines – your data in a spin cycle

Data tracking is as programmed into smart washing machines as a 40°C wash cycle. For smart washing machines, we were surprised to find companies needing users' date of birth – although this is optional on Beko machines, LG and Hoover will not allow use of the app without knowing when customers were born.

LG wants the most data of all the washing machine brands – the company asks for the customer’s name, date of birth, email, phone contact book, precise location and phone number.  Hoover wants users’ contacts and phone numbers on Android devices. With Miele, tracking of precise location is enabled by default, and is required to use the app.

With washing machines on average lasting 11 years or even longer, that is a long time for your data to be potentially tracked. It is rarely 100% clear what a company would do with this data, and we don’t have evidence that it is being sold off to the highest bidder by any of these companies. 

Our reviews of smart washing machines reveal whether it's worth paying extra. 

Are data collection practices in the 'small print'?

To get a rough idea what a smart device and its app will do with your data, you predominantly have to read the privacy policy and parts of the Terms and Conditions that cover data. However, a third of the Which? members surveyed admitted to not reading any of the privacy policy when downloading the app, while two thirds said that they merely skimmed it. 

To fully consume all policies and T&Cs for the 23 brands we researched would mean ploughing through 199,905 words. At an average reading rate of around 250 words per minute, that would take 13 hours and 30 minutes to complete – longer than driving from London to John O'Groats or a non-stop flight from London to Singapore. Staggeringly, a Google Nest owner would need to plough through 20,000 words on their own to get to grips with what was being done with their data.

What protections are there for data collection?

Under the General Data Protection Regulations (GDPR), companies must be transparent about the data they collect and how it’s processed. The data gathered must be relevant and limited to what is necessary for the processing to take place.

However, the reasons for taking information are often broad, such as in companies’ ‘legitimate interests’. While it all should be listed in a privacy policy, the reality is that when you come to click ‘accept’, unless you closely analyse the fine print, you have little to no idea what will actually happen next with your data.

We believe greater consideration around these 'legitimate interests' is necessary, and that a better standard to improve transparency for consumers is long overdue.

Rocio Concha, Which? director of policy and advocacy, said: 'Consumers have already paid for smart products, in some cases thousands of pounds, so it is excessive that they have to continue to "pay" with their personal information.

'Firms should not collect more data than they need to provide the service that’s on offer, particularly if they are going to bury this important information in lengthy terms and conditions.

'The Information Commissioner’s Office should crack down on data collection by manufacturers and marketing firms that appears to go beyond "legitimate interests". A proper standard or code of practice should also be put in place to make the rules clearer.'

How to improve your data privacy

While it's rarely possible to take full control of what data you share and how it's used, there are often ways to tailor device settings to shore things up. Consider the following when setting up and using a new smart device.

• Care what you share: Some data collection is optional during setup, and that means you can opt out. Only share what you’re comfortable with.
• Check permissions: On iOS and Android, you can review permission requests before downloading an app, and check what each app has access to in your settings.
• Deny access: Also in your phone settings, you can potentially deny or limit access to data such as location and contacts. Although, that might stop or limit some of the app's functions.
• Delete recordings: Using the Alexa and Google Assistant settings, you can set your voice recordings to be deleted automatically after a specific period.
• Read the privacy policy: Do at least browse the privacy policy, particularly the data collection sections. You have the right to object to a company processing your data.

Smart device brands respond to Which? findings

Amazon (Echo, Blink and Ring): 'We design our products to protect our customers’ privacy and security and to put our customers in control of their experience. We never sell their personal data, and we never stop working to keep their information safe. We use data responsibly to deliver what our customers expect: products that they love and are always getting better. 

'We are thoughtful and transparent about the information needed to develop, provide, and improve the products and services that we offer our customers, allowing us to deliver a more personalized experience, and to analyse and improve the performance of our devices and services.'

Google: 'Google fully complies with applicable privacy laws and provides transparency to our users regarding the data we collect and how we use it.'

Miele: 'Miele is transparent with its customers about the use of data. The data is collected to optimise appliance usage and to offer customers additional features and functionalities. Our digital services vary from country to country. By specifying the location, we ensure that we can provide customers with the relevant services.'

Samsung: 'We design our products with security and privacy top-of mind and our customers are given the option to view, download or delete any personal data that Samsung has stored across any product or app that requires a Samsung account. Customers can find more information about our privacy policies at www.samsung.com/uk/info/privacy' 

LG said it provides customers with a choice and flexibility on how they use their products and appliances, and that all LG products can be used manually without the need to share personal details. Customers also have the opportunity to control their devices via their mobile phone utilising LG’s ThinQ app, which requests details about the user to help tailor the product experience, learn habits and anticipate needs, enabling customers to manage their smart appliance on the go.

AEG/Electrolux, Bose and Hoover/Haier declined to comment. 

Apple, Arlo, Beko, Ezviz, Hisense, Panasonic, Philips, Sonos and Sony didn't reply by our publication deadline. 

We were unable to contact Eufy and TP-Link.