“Is my smart speaker spying on me?”

It’s a common enough concern that Which? investigated the data collection practices of popular household smart devices across the UK to find out if our smart devices actually eavesdropping on us, or if it’s just paranoia.

While smart devices may not be ‘spying’ on us in the traditional sense, a new consumer review from Which? shows that the data collection methods of top household device brands are arguably more intensive than they need to be.

Which? went through the data collection practices of multiple smart devices, ranging from speakers, to TVs, to washing machines, to analyse the data they collect.

Their findings show that while smart devices may not be spying on us, it is only because they don’t really need to – the data they collect every day is enough to track our location, our economic status, and our consumption practices.

Below are the data practices of some of the most common smart devices in UK homes.

Smart Speakers 

While smart speakers are supposed to only listen to you when you specifically want them to, this doesn’t mean that’s the only time they collect data.

Which? found an interesting pattern concerning the data collection differences between consumers with smart speakers attached to an Android or Apple device.

Those using an Android device were typically asked to provide more data — Amazon Echo, Google Next, Bose, and Sonos requested precise and coarse location data on Android devices, where as Apple users were only asked this same data by Amazon Echo.

Further, Which? found that Bose’s smart speakers share their user data with Meta.

Security Cameras and Doorbells 

Google Nest appeared to ask for the most information out of all the security cameras and doorbells Which? investigated, asking for users’ names, birth dates and addresses, email, and phone number.

For Android users, Amazon, Arlo, and Ezviz products wanted background location data, meaning that they could keep track of the user’s location when they were not using the app.

Which? also found that Ezviz devices have the biggest number of active tracking firms, including Google, Meta, Huawei, and Pangle, TikTok’s business marketing unit.

According to the consumer group, all the permissions among the cameras and doorbells are activated by default. While users can manually opt out, this requires settings changes that might compromise some working aspects of the device or its associated app.

Smart TVs

In order to keep track of what you watch, most smart TVs use a system called automatic content recognition (ACR) — this can track what you watch via an app, via traditional TV, or even though a DVD player of gaming device.

This is typically option, however some brands like LG, Sony, and Samsung bundle these permissions with other terms and conditions in an “accept all” button.

Most brands offer tracking options that can be opt-in/opt-out, like personalised ads, usage history, location services, and voice recognition.

Which? did not find any smart TV brands that offered behaviour tracking by default, with these services requiring an opt-in and can be adjusted in the TV menu.

Smart Washing Machines 

Which? said they were surprised by the amount of data tracking they identified from smart washing machines in the UK.

Every washing machine required users to create an account to use the smart settings – for LG and Hoover, users had to provide their date of birth to access the app.

Most washing machines requested location data of both Android and Apple users, and LG and Samsung even requested permission to access Photos from Apple users.

Miele went so far as to track users’ precise location as a default and required setting to use the app.

Recommended reading

• Smart Devices Leave UK Households Vulnerable
• The 12 Most Popular UK Smart Home Devices
• 70% of UK People Consider Data Collection ‘Immoral’

Data Collection – The Fine Print

As part of their research, Which? also investigated the practices of consumers concerning the terms and conditions of different smart devices, where the details on data collection would be contained.

The terms and conditions of all 23 brands they investigated totalled 199,905 words, which would take the average reader over 13 hours to get through. Google Nest’s T&Cs total to a staggering 20,000 words, which still may not be comprehensible to the average consumer.

Data Protection Concerns

With companies wanting location data just to do laundry, it is no surprise that some consumers are growing more concerned around data protection.

In the UK, companies do have to rationalise why they collect certain data points, but these can often be listed under a vague category of the company’s “legitimate interest.”

“Consumers have already paid for smart products, in some cases thousands of pounds, so it is excessive that they have to continue to “pay” with their personal information,” Rocio Concha, Which? director of policy and advocacy, said.

“Firms should not collect more data than they need to provide the service that’s on offer, particularly if they are going to bury this important information in lengthy terms and conditions.

“The Information Commissioner’s Office should crack down on data collection by manufacturers and marketing firms that appears to go beyond ‘legitimate interests’. A proper standard or code of practice should also be put in place to make the rules clearer.”

In response, Stephen Almond, the executive director of regulatory risk at the Information Commissioner’s Office said: “People should be able to enjoy the benefits of using their connected devices without having excessive amounts of their personal data gathered. This simply isn’t a price we expect to pay.

“To maintain trust in these products companies must be transparent about the data they collect and how they use it, and ensure that the data is not used or shared in ways that people would not expect. The ICO is developing guidance on data protection and Internet of Things devices and we will act where we don’t see the rules being followed.”