Smart home devices a privacy nightmare, Amazon Alexa, Google Home worst offenders, finds study

The smart home market has seen consistent growth over the past decade, with the number of users worldwide expected to reach 785.16 million by 2028, according to Statista. While these devices offer convenience, they also raise significant privacy concerns. Are our homes still our private sanctuaries?

A recent study by Surfshark’s research hub, “Smart Home Privacy Checker,” found that 1 in 10 smart home apps collects data for tracking purposes. The study highlighted that apps from tech giants like Amazon and Google are the most data-hungry, being used by millions of people every day.

“In today’s world, where convenience often trumps privacy, our research reveals a worrying trend in smart home device apps, especially from major companies like Amazon and Google. This issue goes beyond mere data collection; it intrudes into users’ private lives, potentially leading to data theft, security breaches, and the uncontrolled sharing of personal information,” said Goda Sukackaite, Privacy Counsel at Surfshark.

Sukackaite advises users to actively manage their privacy settings, review app permissions, and stay informed about the data policies of their smart home devices.

The study analyzed 290 apps connected to over 400 Internet of Things (IoT) devices, focusing on the most popular ones. Surfshark examined 32 potential data points in each app, looking at user uniqueness, tracking, and data linkage. The apps were ranked based on the amount and type of data they collected.

Amazon and Google are the worst offenders
The study found that Amazon’s Alexa app collects 28 out of 32 possible data points, more than three times the average for smart home devices. All collected data is linked to individual user profiles, including precise location, contact information, and health-related data.

Google’s smart home devices collect 22 out of 32 data points, also well above average. Notable data points include address, location, photos, videos, audio data, and browsing history.

This extensive data collection poses risks to user privacy and can be exploited for targeted advertising or, if mishandled, for malicious purposes.

You pay twice, first with your wallet, then with data
Users often pay twice for their smart devices: once with their money and again with their data. These apps may track users to show targeted ads or share information with third parties and data brokers.

About one-third of the apps focus on collecting data points like device ID, email address, and product interactions, with some even tracking precise locations. Examples include Canary-Smart Home Security and NuWave Connect.

Outdoor security cameras are particularly data-hungry, collecting 12 data points on average, 50 per cent more than other devices. Apps like Deep Sentinel and Lorex contribute to this high data collection.

“Consumers need to think about the personal information they’re giving up before purchasing a smart device, especially when data is shared with third parties,” said Darius Belejevas, a cybersecurity expert from Incogni. “Our study shows that one in ten smart home apps track user data, which can lead to loss of control over personal information, increased risk of security breaches, and unwanted targeted ads.”

Outdated Privacy Practices
The study also found that 12 out of the 290 analyzed apps have not updated their data collection practices in over a year, raising concerns about transparency and compliance with privacy laws.

Notably, apps like MekaMon and Cozmo, which control children’s toys, collect sensitive information such as precise location, photos, and audio recordings.

As smart home devices become more integrated into our daily lives, users must remain vigilant about their privacy and the potential risks involved with these technologies.