Many smart devices collect ‘excessive’ amounts of personal data, says Which?

Many smart devices, including TVs, speakers, air fryers and smartwatches, are making ‘excessive’ requests to access user data, a new study from Which? has found. has said.

The consumer group tested and rated a range of popular smart devices to give them a privacy score based on the data access requests they made.

Research shows that data collection often goes far beyond what is necessary for a product’s functionality, which the company says suggests that personal data may in some cases be shared with third parties for marketing purposes.

The consumer champion said its research found companies were collecting data with “reckless abandon” and called for stricter guidelines around smart product devices and data collection.

The UK’s data protection watchdog, the Information Commissioner’s Office (ICO), will publish such guidance next year.

According to the report, all three Airfryer products tested wanted to know a user’s exact location and request permission to record audio on the user’s phone, for no specific reason.

Which one? said one of the air fryers – made by China’s Xiaomi – used a connected app that linked to trackers from Facebook, an ad network linked to TikTok and, depending on location, Chinese tech giant Tencent.

This air fryer, and another from fellow Chinese company Aigostar, also sent personal data to servers in China. Which one? said, although this was highlighted in a privacy statement.

Moreover: Which one? said the Huawei Ultimate smartwatch it tested asked for a set of phone permissions that the study classified as “risky,” including precise location, the ability to record audio, access to saved files, and the ability to disable all other installed apps to see.

Which one? said Huawei had been advised that these permissions were a legitimate need and that no user data was used for marketing or advertising purposes.

Elsewhere, which one? said it found similar problems with the smart TVs it tested, which were made by Hisense, LG and Samsung.

According to the research, all three asked for a zip code when setting up, and while the Hisense didn’t connect to trackers. Which one? researchers could detect, so did Samsung and LG TVs, including Facebook and Google.

It said the Samsung TV app also made some “risky” telephone consent requests.

In the test of smart speakers, Which one? highlighted that the Bose Home Portable speaker is “packed” with trackers from the likes of Facebook, Google and digital marketing company Urbanairship.

Harry Rose, which one? magazine editor: “Our research shows how smart technology manufacturers and the companies they partner with are currently able to collect consumer data with seemingly reckless abandon, and often do so with little or no transparency.

“Which? has called for proper guidance setting out what is expected of manufacturers of smart products and the ICO has confirmed that a code will be introduced in spring 2025 – this must be backed by effective enforcement, including against companies found in operate abroad.

Which one? has also encouraged consumers to improve their data privacy by ensuring they opt out of data collection requests they are not comfortable with, reviewing permission requests for apps before downloading them, and denying access to app data or through their phone settings, and to delete voice recordings of interactions with voice-based assistants.

Slavka Bielikova, chief policy adviser at the ICO, said: “The results of Which?’s testing of smart products show that many products not only fail to meet our data protection expectations, but also consumer expectations.

“Smart products know a lot about us: who we live with, what music we like, what medications we take and much more. That’s why it’s critical that consumers trust smart product manufacturers to use their information securely in the way they expect.

“Earlier this year we asked consumers what they think about smart products. They told us that their products collect too much information about them and that they feel powerless to control how their information is used and shared.

“That is why the ICO is working on new guidance for manufacturers of smart products, which will be published in spring 2025.

“The guidelines will set clear expectations about what they need to do to comply with data protection legislation and, in turn, protect people using smart products.

“Our guidelines will enable manufacturers to plan and invest responsibly in the use of information. We want to help organizations get it right, but where that is not the case, we will be prepared to take action to ensure consumers are protected from harm.”

In response to the Which? research, Samsung said: “At Samsung, the security and privacy of our customers’ data is of the utmost importance.

“And we use industry-standard security measures and practices to ensure the data is safe.

“Customers will also have the option to view, download or delete personal data via their Samsung accounts. Customers can find more information about our privacy policy at www.samsung.com/uk/info/privacy.”

Hisense said: “Hisense UK values ​​its relationships with its customers and respects their data privacy rights.

“We comply with all UK data privacy laws and only record our customers’ postcodes to enable them to receive region-specific content, improving their user experience.

“If users are concerned, many of our TVs accept a partial zip code.”

Huawei said: “Huawei takes consumer privacy incredibly seriously. Clearly, to be useful lifestyle and health/fitness partners, smartwatches need permission to access some personal data; we are very clear both on the devices upon setup and on the companion app Huawei Health, which permissions are required and why, and users have full control over enabling or disabling them at any time.

Which one? said Xiaomi was told that “respecting user privacy has always been one of Xiaomi’s core values, including transparency, responsibility, user control, security and legal compliance” and “we do not sell personal information to third parties”.

“The permission to record audio in the Xiaomi Home app does not apply to the Xiaomi Smart Air Fryer, which does not work directly via voice commands and video chat,” the company added.

Which one? said LG declined to comment, while Aigostar and Bose did not respond.