Smart device brands must put privacy over profits

While you may worry that your phone is listening to you, it probably isn’t. You should be more concerned that your smart TV wants to know your postcode, your smart speaker is happily chatting away to marketing firms, and your air fryer shares data with TikTok. 

Over a year ago, we exposed mass surveillance in smart homes. Now, using a brand new privacy framework we’ve rated products from big brands, such as Amazon, Huawei and Samsung, on how they handle your data. 

As you’ll see ahead, no product received a privacy score much higher than 50%, showing just how far the industry needs to go to better protect your privacy. 

News, deals and stuff the manuals don't tell you. Sign up for our Tech newsletter, it's free monthly.

Privacy is your legal right

Under laws such as the Privacy and Electronic Communication Regulations (PECR) and General Data Protection Regulations (GDPR), smart device brands have a responsibility to consider privacy when handling your data. However, rules are often so broad that exactly how they should do this is left to interpretation. 

It’s a bit as if you lent someone your car and said, ‘Drive carefully’. A more aggressive driver may think one thing, a cautious one another. Neither might fully understand what you meant. For the past year, we’ve worked with data protection specialists to develop a more defined framework of what good looks like when it comes to smart devices and privacy. 

Alongside cybersecurity experts at Hexiosec, our snapshot test looked at 12 smart products across four categories – air fryers, smartwatches, smart speakers and smart TVs. Each has been given a privacy score and star ratings, revealing major differences in how they do – and don’t – protect your privacy.

Smart devices privacy – key themes

Smart devices can collect data in a range of ways – and while there's often nothing you can do about this, there are ways you can claw back control.

Consent

Consent to allow a smart brand to process your data must be ‘freely given, specific, informed and unambiguous’. However, while you can, in theory, deny your consent, that rarely comes without consequences. 

Smart products are marketed as having internet-based functionality, but you’ll have already bought the product before you realise – if, indeed, you ever do – that this requires sharing your data to actually work. We found mixed results in our testing. The Bose speaker fared poorly on how it secured consent for data tracking. By contrast, Amazon Echo gives you useful options to skip various requests to share your data.

• Tip: Check to see if you can 'opt out' of any data sharing you don't want. If not, at least skim over the privacy notice so you're aware of what you're consenting to.

Data minimisation

Companies should only take data about you that they truly need, but our testing showed this is rarely the case. For example, the Hisense and Samsung TVs we tested require a postcode at set up (though both brands said you can use a partial postcode). The LG asks for it, but it isn’t mandatory, so is it really essential? 

We also checked permissions for access to aspects of your smartphone, such as camera, contacts or photos. Which? designated some of these as 'risky', meaning they give invasive access to parts of your phone, such as your precise location, the ability to record audio, or see other apps you have installed. A Bose speaker asked for only three risky permissions, but three of the 12 tested brands wanted more than six: the Samsung TV, Aigostar air fryer, and Huawei watch – which demanded a staggering nine. 

Lots of products connected to trackers that process data for a number of reasons, including analytics and marketing. For example, the Xiaomi air fryer connected to trackers from Facebook, Pangle (the ad network of TikTok for Business), and Chinese tech giant Tencent (depending on your location). 

• Tip: You can’t decline permissions before downloading an app, but can remove or reduce access in your phone's settings on both Android and iOS devices. 

Data portability

In theory you should be able to transfer your data from one smart device to another. So in the case of a smart thermostat that’s been learning for years how you like your home heated, you could upload this information to a new model – even from another brand – to get it up to speed more quickly. In reality, no device we assessed made this possible. So, we’re left generating data to help make smart devices work more effectively – and potentially boost a company’s profits – but as soon as we move on, the benefit to us simply ends.

• Tip: You can occasionally port data to a new device, as long as it is from the same brand as your old one. However, that does mean you're locked into a company or group's products. 

Data security

Which? has campaigned for years to get baseline security regulations introduced in the PSTI (Product Security and Telecommunications Infrastructure Act). However, GDPR also puts obligations on companies to secure our data when they handle it, and that includes smart device brands. Only one brand on test (LG) scored higher than three stars for security, showing that standards are still very mixed. We didn’t find any major security vulnerabilities, but important hygiene factors were missed. For example, the Kuzil and WeurGhy did not have any legally required information on how long they’d be supported with security updates.  

• Tip: Always choose a brand that has taken cyber security seriously (we check for this in our testing). Following that, always choose secure passwords and run software updates when available. 

Data deletion

If you want to pass on a smart product, sell it, or dispose of it responsibly, then you’ll want to ensure all your data is deleted first. All devices had fairly effective controls for deleting data, but there were issues. 

For example, with the Echo Pop, the option to deregister the device was in the app, but we had to search online for factory reset instructions. With the Cosori air fryer, it was clear from the app about our data being deleted, but we could not tell if it had also been removed from the company servers, thereby erased completely.

• Tip: When you want to dispose of a smart product, always check carefully and follow the manufacturer's instructions. Ensure any linked accounts are also deleted in the process. 

Smart device privacy results table

Time for action on smart product privacy

Our research shows that, when it comes to smart products, it’s doubtful you’ll have any concrete understanding of what happens to your data – let alone any real control. It would be easy for manufacturers and developers to more clearly signpost important information on privacy, and give you more control over what you share (ideally before you purchase). In most cases, though, they don’t. 

And overly broad data protection rules don’t do enough to force them to pay more attention. It’s time for data protection regulation to bare its teeth and start rebalancing this situation more in favour of the consumer.

Ever since we published our first story in September 2023, we have been in contact with the Information Commissioner's Office (ICO), the UK's data regulator. It plans to publish new guidance for smart product manufacturers in spring 2025. According to the watchdog, this will 'outline clear expectations as to what they need to do to comply with data protection laws and, in turn, protect people’s privacy when using smart products'.

Harry Rose, Which? magazine editor, said: 'Our research shows how smart tech manufacturers and the firms they work with are currently able to collect data from consumers with what seems to be reckless abandon, and this is often done with little or no transparency. 

'Which? has been calling for proper guidelines outlining what is expected of smart product manufacturers and the ICO has confirmed a code is being introduced in Spring 2025 – this must be backed by effective enforcement. The government also needs to use the Product Regulation and Metrology Bill to prevent online marketplaces selling dangerous, insecure and intrusive products.'

What the brands had to say of our findings

Samsung told us: 'At Samsung, the security and privacy of our customers’ data is of the utmost importance. And we employ industry-standard security safeguards and practices to ensure that the data are secured. Customers are also given the option to view, download or delete any personal data through their Samsung account. Customers can find more information about our privacy policies at www.samsung.com/uk/info/privacy.'

Hisense said: 'Hisense UK values its relationships with its customers and respects their data privacy rights. We are compliant with all UK data privacy laws and only capture the postcodes of our customers to enable them to receive regional specific content, enhancing their user experience. If users are concerned, then many of our TVs will accept a partial postcode.'

An Amazon spokesperson said: 'We design our products to protect our customers’ privacy and security and to put them in control of their experience. For example, we build easy-to-use controls for our customers—these include physical buttons or shutters, simple in-app controls and prompts within the device setup experience—and have created resources that explain how our devices and services work and the options available to customers.'

Google said: 'Our customers’ privacy is very important to us and Google fully complies with applicable privacy laws and provides transparency to our users regarding the data we collect and how we use it. For those moments when users want additional privacy controls on Google Nest smart speakers and displays, users can use Google Assistant in Guest Mode. When in Guest Mode, Google Assistant won’t say or show personal results or personal contacts, and automatically deletes audio recordings and Google Assistant activity.'

Huawei told us: 'Huawei takes consumers’ privacy incredibly seriously. Clearly, to be useful lifestyle and health/fitness partners, smartwatches require permissions to access a number of personal data; we are very clear both on the devices at setup, and on the companion app Huawei Health, which permissions are required and why, and users have full control over turning them on or off at any time.'

In a lengthy statement Xiaomi said that 'respecting user privacy has always been among Xiaomi's core values, which includes transparency, accountability, user control, security and legal compliance'. It said that it adheres to all UK data protection laws, and 'we do not sell any personal information to third parties', and certain functions are only active in select global markets, such as Tencent services only used in China. 

'The permission to record audio on Xiaomi Home app is not applicable to Xiaomi Smart Air Fryer, which does not operate directly through voice commands and video chat,' it added. 

Cosori said: 'We prioritise privacy, and subject to our internal compliance requirements, the smart products must comply with GDPR. However, without specific test reports from your firm or the test lab, we cannot comment further.'

LG declined to comment. Aigostar and Bose didn’t respond. WeurGhy and Kuzil were uncontactable.