So, you've invested in a smart doorbell to feel more secure, a robot vacuum to claw back a couple of hours on the weekend, and a smart thermostat because frankly, heating an empty house at full whack feels ridiculous. Well done – that all seems very sensible and futuristic of you.
But a small detail you may have overlooked is that every one of those devices could be silently collecting data about how you live: when you leave the house, when you come back, who visits, and what your daily routine looks like. That's not to say that anything sinister is going on, but it's simply how a lot of smart technology works.
The question worth asking isn't whether your smart home is watching you (it probably isn't, certainly not in the way the scarier corners of the internet would have you believe), but who has legitimate access to the data it generates. It's about what they're entitled to do with it, and whether you have any say in the matter. Spoiler: you have more control than you might think, but only if you know where to look.
What information is your smart home collecting?
It's tempting to think of smart devices as single-purpose tools: the best home security systems record visitors, smart thermostats control the heating, and your robot vacuum cleans the floor. But in practice, this tech collects considerably more information than the single action you think you're triggering.
Take your video doorbell. According to Jack Charman, private investigator at National Private Investigators, it isn't just storing clips. "It's logging motion events, timestamps, audio, device IDs and account links that tie everything back to a specific home."
Because it's rare to find a video doorbell without a subscription, you'll likely need to create an account to use it, and in doing so, you may be agreeing to share considerably more information than you realise.
Similarly, your smart thermostat can infer occupancy patterns from temperature adjustments and home or away modes. Your robot vacuum generates a detailed floor map of your property, and even smart plugs or bulbs can reveal which rooms are being used and when. "Individually these signals seem harmless," says Jack, "but combined they can form a surprisingly accurate behavioural timeline."
But it goes further than the devices themselves. Paul Bischoff, a consumer privacy advocate at Comparitech, notes that even relatively basic data can reveal more about you than you'd expect. "Using just an IP address and a timestamp, an observer could infer when you are home, when you go to work, how many people live in your house." Any device connected to your home Wi-Fi is capable of logging exactly that.
"The apps that control your devices are often the worst privacy offenders, though," adds Paul, "because they are on your phone, which probably holds a lot of your personal data." Depending on the permissions you've granted, a smart home app could be accessing your camera, microphone, stored files, contact lists and advertising identifiers on top of everything the device itself records.
Jack Charman is the founder and director of National Private Investigators, the highest-rated private investigation agency in London. Specialising in intelligence-led investigations for private clients and businesses, he has extensive experience in surveillance, behavioural analysis and data intelligence.
Paul is a regular commentator on cyber security and privacy topics in national and international media, including the New York Times, BBC, Forbes, The Guardian and many others. He has an in-depth knowledge of VPNs, having been an early adopter while looking to access the open internet during his time in China. He previously worked in Beijing as an editor for Tech in Asia.
Who can see your data and what are they allowed to do with it?
If you've ever clicked "I agree" on a smart home app without reading the small print, you're certainly not alone. But, under a legal basis called "legitimate interests" those terms and conditions often grant companies far more access to your data than you might expect. As Dray Agha, senior manager of security operations at Huntress, explains: "Legitimate interests is essentially a flexible legal justification that allows companies to process or share your data without your explicit consent, provided they can argue it is necessary for their business goals and doesn't severely infringe upon your fundamental privacy rights."
According to the ICO's guidance some examples of potential "legitimate interest" include:
- Improving their products or services : For example, your smart thermostat manufacturer may analyse how you adjust your heating schedule to inform future software updates
- Sharing data within a group of companies for internal administrative purposes: Amazon may pass your Ring doorbell usage data to its broader advertising division
- IT and network security monitoring: Your smart home platform may log device activity to detect unusual access patterns or potential account breaches
- Direct marketing based on your behaviour and preferences: Your energy app may use your consumption data to target you with offers for solar panels or EV chargers, though companies must also meet separate consent requirements under UK marketing rules
But it isn't a free pass. As Jack Charman explains: "The organisation has to show that the data use is necessary for a specific purpose, and then it has to balance its own interest against the impact on you as an individual. So if the impact on privacy is too high or unexpected, it shouldn't be allowed under this basis."
Legitimate interests also doesn't automatically cover everything a company might want to do with your data. "Under UK rules like PECR, many tracking technologies still require consent, even if a company tries to justify broader data use under legitimate interests," says Jack.
You have the right to object to processing under legitimate interests, and companies are required to be transparent about what they're doing with your data. But exercising those rights means knowing where to start.
Dray Agha is senior manager of security operations at Huntress, a cybersecurity company specialising in threat detection and response. With a background spanning digital forensics, incident response and threat hunting, he is an active contributor to the security community through research and public speaking, and holds a number of industry certifications including CISM and OSCP.
How can you protect yourself and your home?
Thankfully, limiting what your smart home shares doesn't mean sacrificing the convenience that made installing it worthwhile. A few straightforward changes to how your devices are set up can significantly reduce the amount of behavioural data that gets stored and passed on.
Adjust what gets captured
If you're wondering whether home security cameras are safe, the short answer is yes, provided you're in control of what they capture and who can access it. Jack Charman recommends thinking carefully about where to put security cameras, adjusting angles and using privacy zones so you're not recording the street or neighbouring properties unnecessarily – something that also keeps you on the right side of home CCTV laws.
Turning down motion sensitivity reduces constant activity logging, and switching off audio recording removes one of the most sensitive data streams entirely. "These steps don't reduce core functionality, but they do cut down the amount of behavioural data that gets stored and shared over time," he says.
Review your app settings
Another top tip from the experts is to go into the settings of each device app and turn off anything that isn't essential to how you actually use it. For example, Dray Agha recommends opting out of "analytics" or "product improvement" data sharing, routinely deleting voice assistant command histories, and enabling auto-delete for activity data so old records don't accumulate indefinitely. It's also worth auditing any third-party connections you've enabled and revoking access for services you no longer use.
Isolate your devices on the network
Dray Agha also recommends moving all smart devices onto a dedicated guest Wi-Fi network. Doing so isolates them from your personal computers and smartphones, limiting how much data they can hoover up from the rest of your household.
Moving house? Don't forget to reset
If you're moving house, don't overlook the devices you're leaving behind. Jack Charman's advice is clear: fully reset every smart device and revoke cloud access before you hand over the keys. "You don't want old accounts carrying over into a new owner's home," and equally, you don't want your behavioural data going with it.
Shop smart home security
This camera works with any wi-fi router. Set up custom activity zones and receive real-time notification when motion is detected. Choose from local storage, for which you’ll need a microSD card, or subscribe for cloud storage
This solar-powered camera requires no subscription. Set up custom activity zones and receive instant alerts when motion is detected. Free 24-hour cloud storage is included from day one
This plug-in indoor camera works with any standard electrical socket. Place it on a flat surface or mount it to a wall using the included bracket. Compatible with Alexa for hands-free control
For more advice on keeping your home secure, see our guides to how much home security systems cost and the best ways to protect your home from burglars.
