Owners of smart home devices are being asked for swathes of personal data that is then potentially shared with social media firms such as TikTok, research has found.
The consumer champion Which? found companies appear to be gathering far more data than is needed for products to function. This includes smart TVs that ask for users’ viewing habits and a smart washing machine that requires people’s date of birth.
Rocio Concha, director of policy and advocacy at Which?, said: “Consumers have already paid for smart products, in some cases thousands of pounds, so it is excessive that they have to continue to ‘pay’ with their personal information.”
She said that firms should not collect more data than they need “to provide the service that’s on offer, particularly if they are going to bury this important information in lengthy terms and conditions.”
The consumer group analysed the data collection practices of popular brands behind a range of smart devices. Experts looked at what information they require to set up an account, what data permissions their apps request and what activity marketing companies are tracking on people’s products.
Every brand looked at required exact location data as well as an approximate one, despite this arguably not being necessary for the functionality of the product.
For smart cameras and doorbells, Which? found Ezviz devices, sold by major high-street retailers including Argos, had by far the most tracking firms active. This included TikTok’s business marketing unit, Pangle, Huawei, as well as Google and Meta.
Every single smart camera and doorbell brand Which? assessed used tracking services from Google, while Blink and Ring also connected to parent company Amazon. Google’s Nest product demands a user’s full name, email, date of birth and gender.
Amazon said it “never” sells customers’ personal data, and “never stop working to keep their [customer] information safe”. It said data was used responsibly to deliver products customers love.
Google said that it complies with “applicable privacy laws” and “provides transparency” to users regarding the data it collects.
Smart speakers are only supposed to listen when you want them to, but Which? found that Bose share user data with Meta, the parent company of Facebook. Bose declined to comment.
Experts found that companies were asking for the users’ date of birth – although this was optional on some machines.
Under the General Data Protection Regulations (known as GDPR), companies must be transparent about the data they collect and how it is processed. The data collected must also be relevant and limited to what is necessary for the processing to take place.
However, Which? argued that the reasons for taking information are often too broad for consumers to appreciate, with companies claiming “legitimate interests”. The consumer champion said that when consumers come to click accept, unless they closely analyse the fine print, they have little to no idea what will actually happen next with their data.