_Part 3 of 18 in the Digital privacy for board directors series._
The average UK home in 2023 contains about a dozen smart devices — voice assistants, smart speakers, smart TVs, doorbell cameras, smart thermostats, smart light bulbs, sometimes a smart fridge. The proposition has been that these devices add convenience for a small loss of privacy. The honest reality is that the convenience is real, the privacy loss is larger than the marketing suggests, and most households have not been told what they have signed up to.
This post is not an argument for ripping it all out. Some of these devices earn their keep. The argument is that you should know what each of them is actually doing, decide which ones you are happy to live with, and remove the ones you are not.
What the typical smart device is actually doing
Three things, simultaneously, all of which the marketing tends to underplay.
Listening or watching. A voice assistant has a microphone that is always on in some sense, waiting for the wake word. The manufacturer's claim is that audio is only sent to their servers after the wake word. The evidence is mostly consistent with this claim, with documented exceptions. A doorbell camera is always recording or always motion-triggered. A smart TV with voice search has a microphone too, and in some cases the smart TV is reporting back to the manufacturer what you watch, regardless of voice features.
Maintaining a cloud connection. Almost every smart device maintains a persistent connection to its manufacturer's cloud servers. That connection is the channel through which the manufacturer pushes updates, receives telemetry, and answers your phone app's turn on the lights command. If the manufacturer's servers go down or get sold to someone else, your device's behaviour changes. The classic warning is the smart lock or thermostat that becomes a paperweight because the manufacturer's business has changed direction.
Sharing data with third parties. Most smart devices share usage data with third parties. The categories vary: advertising networks, analytics platforms, voice-recognition cloud services, partner integrations. The detail is in the privacy policy, which almost nobody reads. The general direction is more data, more third parties, over time. The ICO has published guidance on Internet of Things privacy that is worth fifteen minutes of reading.
The category-by-category honest read
Voice assistants (Alexa, Google Home, HomePod). The convenience is real and the children love them. The privacy posture varies by manufacturer. Apple's HomePod processes more on-device and shares less with Apple than Amazon and Google share with themselves. If you keep a voice assistant, prefer Apple. If you keep Amazon or Google, review and delete your voice history regularly — both have settings for this — and turn off the contribute voice recordings to improve service option. Do not put a voice assistant in a bedroom or a study where confidential conversations happen.
Doorbell cameras (Ring, Nest, Arlo). The convenience is real (you know who is at the door, you have evidence if there is an incident). The privacy posture is generally poor — these devices record continuously or near-continuously, footage is stored in the manufacturer's cloud, and in several documented cases manufacturers have shared footage with law enforcement without warrant. Keep the doorbell. Be aware of what it captures of your neighbours and the street.
Smart TVs. Modern smart TVs from most brands collect viewing data by default. Look up Automatic Content Recognition (ACR) and how to disable it on your TV model. It is usually buried in privacy settings. Disabling it does not stop the TV being useful as a TV.
Smart thermostats (Nest, Hive, Tado). Generally well-behaved. The data they collect is mostly used to make the heating smarter and the cost savings are real. The thing to be aware of is that the manufacturer can infer your occupancy patterns from the thermostat data — when you are out, when you are in, when you go to bed.
Smart lighting (Hue, LIFX, IKEA). Generally fine. The most likely failure mode is the manufacturer changing direction or selling the business. If you make a large investment in smart lighting, prefer brands that support local control (Hue does, via the hub). Avoid brands that route every light command through their cloud.
Smart fridges, washing machines, ovens, kettles. The convenience is mostly theatrical. The privacy posture is mostly poor. The patch lifetime is mostly short. If you are about to buy one, the question to ask is what does this do that a non-smart version does not, and if the answer is send me a notification when the milk is low, decline.
Children's toys with internet connectivity. A separate post in the series; the short answer is that this market has been particularly poor at security and privacy and the default should be no.
The guest network for IoT
If you took the advice from the previous post and enabled the guest network, this is where it earns its keep. Put every smart device on the guest network. Your phones, laptops, and tablets stay on the main network. A compromised smart bulb cannot reach your work laptop, and vice versa.
What to do this month
Two things.
The audit. Walk around the house with the list you made for post one. For each smart device, ask three questions. What was the convenience I expected when I bought it? Am I still getting that convenience? Am I still happy with the data it is collecting in exchange? Remove the devices where the answer to any of the three has drifted from where you expected.
The relocation. For the devices you keep, move them onto the guest Wi-Fi. This is usually a matter of forgetting the network on the device and reconnecting to the guest one. Twenty minutes for the whole house. The protection it provides is durable.
One paragraph for households with children
A specific note. The first child-focused post in the series will go into detail, but on this topic: the bedroom is not a sensible location for any internet-connected camera, microphone, or voice assistant. Not for the parents, not for the children. The smart device in the kitchen is one trade-off. The smart device in a child's bedroom is a different trade-off and, in my view, almost never the right one. If your children have voice-controlled lights or speakers in their rooms, this is a good month to relocate them to a hallway or living space.
In two weeks: the first children-focused post in the series — the digital footprint we create for them before they can speak.