Smart home device owners are being asked to provide swathes of data to manufacturers, which could compromise their privacy and potentially result in them handing their personal information to social media and marketing firms, Which? research has found. The consumer champion found companies appear to gather far more data than is needed for the product to function. This includes smart speakers and security cameras that share customer data with Meta and TikTok, and smart washing machines that require people’s date of birth.
Which? analysed the data collection practices of popular brands behind a range of smart devices. Experts looked at what information they require to set up an account, what data permissions their apps request and what activity marketing companies are tracking on people’s products. Every brand looked at required exact location data as well as an approximate one, despite this arguably not being necessary for the functionality of the product.
For smart washing machines, experts were surprised to find companies needing the date of birth of users – although this is optional on Beko machines, LG and Hoover will not allow use of the app without knowing when customers were born. LG wants the most data of all the washing machine brands – the company will know the customer’s name, date of birth, email, phone contact book, precise location and phone number. Hoover wants users’ contacts and phone numbers on Android devices. With Miele, tracking of precise location is enabled by default, and required to use the app.
Under the General Data Protection Regulations (GDPR), companies must be transparent about the data they collect and how it is processed. The data collected must also be relevant and limited to what is necessary for the processing to take place.
However, according to Which?, the reasons for taking information are often too broad for consumers to appreciate, with companies claiming ‘legitimate interests’. While it all should be listed in a privacy policy, Which? says the reality is that when consumers come to click ‘accept’, unless they closely analyse the fine print, they have little to no idea what will actually happen next with their data.
Rocio Concha, Which? director of policy and advocacy, said: “Consumers have already paid for smart products, in some cases thousands of pounds, so it is excessive that they have to continue to ‘pay’ with their personal information. Firms should not collect more data than they need to provide the service that’s on offer, particularly if they are going to bury this important information in lengthy terms and conditions. The ICO should consider updating guidelines to better protect consumers from accidentally giving up huge swathes of their own data without realising.”
