Are your smart devices spying on you?

New research from Which? raises concerns over ‘excessive’ surveillance in everyday smart devices gathering and sharing your data

Many smart devices including TVs, speakers, air fryers and smartwatches are making ‘excessive’ requests for access to user data, a new study from Which? has said.

The UK consumer group rated a range of everyday smart devices to give them a privacy score based on what data access requests they made.

It found that data collection often went well beyond what was necessary for the functionality of a product, which it argued suggests personal data could be being shared with third parties for marketing purposes in some cases.

Which? has called for stricter privacy guidelines to stop smart device firms collecting data with ‘reckless abandon’. 

Harry Rose, Which? magazine editor, said: 

‘Our research shows how smart tech manufacturers and the firms they work with are currently able to collect data from consumers, seemingly with reckless abandon, and this is often done with little or no transparency.

“Which? has been calling for proper guidelines outlining what is expected of smart product manufacturers and the ICO has confirmed a code is being introduced in spring 2025 – this must be backed by effective enforcement, including against companies that operate abroad.’

The UK’s data protection watchdog, the Information Commissioner’s Office (ICO), is due to publish new guidance for smart product manufacturers in Spring 2025.

The air fryers linking to Facebook and TikTok

All three air fryers reviewed by Which? wanted to know a user’s precise location and wanted permission to record audio on a user’s phone, for no specified reason.

Which? said one of the air fryers – made by Chinese firm Xiaomi – used a connected app that linked to trackers from Facebook, an ad network linked to TikTok and, depending on location, Chinese tech giant Tencent.

This air fryer, from Chinese firm Aigostar, wanted to know gender and date of birth when setting up an owner account. Which? said this was again for no clear reason, but was optional.

The Aigostar and Xiaomi fryers both sent people’s personal data to servers in China, although Which? said this was flagged in a privacy notice.

Smartwatches requesting ‘risky’ phone permissions

The Huawei Ultimate smartwatch – as with all the products on test – required privacy consent to work properly. Which? said it requested nine ‘risky’ phone permissions – the most of all devices on test.

Which? defined ‘risky’ as giving invasive access to parts of someone’s phone – including precise location, the ability to record audio, access to stored files and the ability to see all other installed apps.

Huawei told Which? all had a justified need and that no user data is used for marketing or advertising purposes. A spokesperson for the company said:

‘Clearly, to be useful lifestyle and health/fitness partners, smartwatches require permissions to access a number of personal data; we are very clear both on the devices at set-up, and on the companion app Huawei Health, which permissions are required and why, and users have full control over turning them on or off at any time.’

Which? found some trackers active on the Huawei watch, but Huawei said they are active only in certain regions. 

Smart TVs and speakers connecting to Facebook and Google

Which? said it found similar issues in the smart TVs it tested, which were made by Hisense, LG and Samsung.

The study said all three asked for a postcode at set up, and while the Hisense did not connect to any trackers Which? researchers could detect, Samsung and LG’s TVs did, including Facebook and Google.

It said the Samsung TV app also requested eight ‘risky’ phone permissions, including being able to see all the other apps on the phone.

In its test of smart speakers, Which? highlighted the Bose Home Portable speaker as being ‘stuffed’ with trackers, including Facebook, Google and digital marketing firm Urbanairship. It also fared poorly on how it secured consent for data tracking.

It praised Amazon’s Echo device for giving useful options to skip various requests to share data. Consumers need an Amazon or Google account to use the Echo Pop or Nest Mini, respectively. 

Which? said they use trackers that Which?’s researchers expected to see, mostly their own – but did criticise them for not allowing users to selectively opt out.

An Amazon spokesperson said: ‘We design our products to protect our customers’ privacy and security and to put them in control of their experience. For example, we build easy-to-use controls for our customers—these include physical buttons or shutters, simple in-app controls, and prompts within the device set up experience—and have created resources that explain how our devices and services work and the options available to customers.’

A Google spokesperson said: ‘Our customers’ privacy is very important to us and Google fully complies with applicable privacy laws and provides transparency to our users regarding the data we collect and how we use it. For those moments when users want additional privacy controls on Google Nest smart speakers and displays, users can use Google Assistant in Guest Mode. When in Guest Mode, Google Assistant won’t say or show personal results, personal contacts, and automatically deletes audio recordings and Google Assistant activity.’

Five ways to improve your data privacy

Which? has also encouraged consumers to improve their data privacy by taking care to opt out of data collection requests they are not comfortable with, to check permission requests on apps before downloading them and deny or limit app data access via their phone settings, and delete voice recordings of interactions with voice-based assistants.

Follow its five recommendations for improving data privacy:

1. Care about what you share. Some data collection is optional during setup, and that means you can opt out (although potentially with consequences in terms of functionality). Only share what you are comfortable with.
2. Check permissions. On iOS and Android, you can review permission requests before downloading an app, and check what each app has access to in your settings.
3. Deny access. Also in your phone settings, you can potentially deny or limit access to data such as location, contacts, and so on. Although, that might stop or limit aspects of the app.
4. Delete recordings. Using the Alexa and Google Assistant settings, you can set your voice recordings to be deleted automatically rather than stored after a period of time.
5. Read the privacy notice. Do at least browse the policy, particularly the data collection sections. You have the right to object to a company processing your data.

You can also follow our tips on how to take control of how Facebook uses your data.

Better guidance on how consumers’ data can be used

Which? said its research highlights how manufacturers are currently able to collect excessive data from consumers, often with little transparency about what it will be used for. 

It said the new ICO guidance – due to be published in Spring 2025 – must include really clear advice on how consumers’ data can be used and the transparency required of businesses. 

Slavka Bielikova, principal policy adviser at the ICO, said: ‘The results from Which?’s testing of smart products show that many products not only fail to meet our expectations for data protection but also consumer expectations.

‘Smart products know a lot about us – who we live with, what music we like, what medication we are taking and much more. That’s why it’s vital that consumers trust smart product manufacturers to use their information safely and in the ways they expect.

‘Earlier this year, we asked consumers how they feel about smart products. They told us that their products collect too much information about them and that they feel powerless to control how their information is used and shared.

‘That’s why the ICO is working on new guidance for manufacturers of smart products which will be published in spring 2025.

‘The guidance will outline clear expectations for what they need to do to comply with data protection laws and, in turn, protect people using smart products.

‘Our guidance will allow manufacturers to plan and invest in the use of information responsibly. We want to help organisations get it right, however where they don’t we will be ready to act to ensure consumers are protected from harm.’

However, Which? is Which? is concerned that manufacturers based abroad could take advantage of the challenges of enforcing compliance with guidelines. 

In response to the Which? research, Samsung said: ‘At Samsung, the security and privacy of our customers’ data is of the utmost importance.

‘And we employ industry-standard security safeguards and practices to ensure that the data are secured.

“Customers are also given the option to view, download or delete any personal data through their Samsung accounts. Customers can find more information about our privacy policies at samsung.com/uk/info/privacy.”

Hisense said: ‘Hisense UK values its relationships with its customers and respects their data privacy rights.

‘We are compliant with all UK data privacy laws and only capture the postcodes of our customers to enable them to receive regional-specific content, enhancing their user experience.

‘If users are concerned, then many of our TVs will accept a partial postcode.’

In a statement, a Xiaomi UK spokesperson said: ‘We are aware of the recent press release by Which? and some information in it including ‘Xiaomi fryer sent people’s personal information to servers in China’ is inaccurate and misleading, which could be resulted from some misunderstandings.

‘We are in the process of clarifying with Which?.

‘Our privacy policy is developed to comply with applicable regulations such as the UK GDPR and the DPA 2018. By complying with local applicable laws and regulations in markets where Xiaomi operates, user data are stored in compliance with local laws.

‘We reserve the right to take legal actions to protect our reputation.’

Which? said LG declined to comment, while Aigostar and Bose did not respond.