Owners of smart home devices are asked to provide swaths of personal data which is then potentially shared with social media companies such as TikTok, according to a study.
The consumer champion Which one? It seems that companies collect far more data than is necessary for the operation of their products. This includes smart TVs that ask users’ viewing habits and a smart washing machine that asks for people’s date of birth.
Rocio Concha, Director of Policy and Advocacy at Which?, said: “Consumers have already paid for smart products, in some cases thousands of pounds, so it is excessive that they have to continue to ‘pay’ with their personal informations.
She said companies shouldn’t collect more data than necessary “to deliver the service offered, particularly if they want to bury this important information in lengthy terms and conditions”.
The consumer group analyzed the data collection practices of popular brands behind a range of smart devices. Experts looked at the information they need to create an account, the data permissions their apps request, and the activities marketing companies track on people’s products.
Each brand has considered the exact location data required as well as approximate data, although this is arguably not necessary for the product to function.
For smart cameras and doorbells, which one? found that Ezviz devices, sold by major retailers including Argos, had by far the most active tracking companies. This included the commercial marketing unit of TikTok, Pangle, Huawei, as well as Google and Meta.
Every brand of smart camera and doorbell. Which ? assessed the tracking services used by Google, while Blink and Ring also connected with parent company Amazon. Google’s Nest product requires a user’s full name, email address, date of birth, and gender.
Amazon said it “never sells” its customers’ personal data and “never stops working to keep their (customer) information secure.” He said the data was used responsibly to deliver products valued by customers.
Google said it complies with “applicable privacy laws” and “provides transparency” to users about the data it collects.
Smart speakers are supposed to listen only when you want to, but which one? discovered that Bose was sharing user data with Meta, Facebook’s parent company. Bose declined to comment.
Experts have found that companies ask for users’ date of birth, even though it’s optional on some machines.
Under the General Data Protection Regulation (known as GDPR), companies must be transparent about the data they collect and how it is processed. The data collected must also be relevant and limited to what is necessary to carry out the processing.
However, which one? argued that the reasons why information is collected are often too broad for consumers to comprehend, with companies citing “legitimate interests”. The Consumer Champion said that when consumers click Accept, unless they carefully analyze the fine print, they have little to no idea what will actually happen next with their data.