Smart Speakers, Cameras and Your Privacy

Most connected devices in a home collect more than they need to, and nearly all of them let you cut that back in a few minutes. (Use a unique password and two-step sign-in on each app too, since a stolen login undoes every setting below.) The catch is that each type of device collects something different, so the settings worth checking on a speaker are not the ones that matter on a television.

Smart speakers

A speaker such as an Amazon Echo or Google Nest listens locally for its wake word and only then starts sending audio to the company's servers. False wakes happen, so a word on the radio can trigger a short recording. Those clips, plus transcripts of your requests, are tied to your account and can be kept until you delete them.

That retention became a legal matter in 2023. The Federal Trade Commission and the Department of Justice charged that Amazon had kept children's Alexa recordings even after parents asked for them to be deleted, in violation of the Children's Online Privacy Protection Act. Amazon agreed to a $25 million civil penalty and to change its deletion practices, without admitting wrongdoing.

• The recording history page in the Alexa or Google Home app, where you can listen to and delete past clips.
• Auto-delete: both companies let you set recordings to be removed after a fixed period, and Alexa also offers an option not to save them at all.
• Whether human review of recordings is switched on.
• The physical microphone button, which on most models cuts the microphone and shows a red light.

Video doorbells and indoor cameras

Cameras collect the most sensitive material in the house: video of the people who live there, their visitors, and often a slice of the street or a neighbor's yard. Most brands upload clips to the cloud by default, so the company's internal access rules matter.

Those rules were the subject of the FTC's other 2023 case against Amazon. The agency said that Ring employees and contractors had been able to view customers' private videos, including footage from bedrooms and bathrooms, and that weak security had let attackers take over some accounts. Ring agreed to pay $5.8 million, which the FTC used for customer refunds, and to run a stronger privacy and security program.

• End-to-end encryption, if your model supports it. Only your enrolled phones can then view clips, though some cloud features stop working.
• Privacy zones, which black out part of the frame such as a neighbor's window, and motion zones, which limit what triggers a recording.
• The list of shared users and signed-in devices.
• Whether the app lets local police or other agencies request footage from you, and whether you have opted in.
• For indoor cameras, a schedule or "home mode" that turns the camera off while people are at home.

Robot vacuums with cameras or lidar maps

Mid-range and premium robot vacuums build a floor plan of your home, either with a spinning lidar sensor or with a front camera that also identifies cords and socks. The map shows the size and layout of every room the vacuum reaches. Camera models capture images to recognize obstacles, and some offer a live video view, which makes the vacuum a camera on wheels.

The risk is not hypothetical. In 2022, MIT Technology Review reported that images taken by test units of a Roomba model, including one of a person on a toilet, had been labeled by outside contractors and posted in private online groups. Those were development machines used by paid testers, not retail units, but the episode showed how far an image can travel.

• Whether maps are stored in the cloud, and the option to delete a saved map.
• Whether obstacle photos are uploaded to "improve recognition", and the opt-out if there is one.
• Remote video or camera viewing features, which are worth turning off if you never use them.

Smart TVs and automatic content recognition

Most smart TVs sold in the US use automatic content recognition, or ACR. The set takes small samples of whatever is on screen, including input from a cable box, game console or streaming stick, and matches them against a database to learn what you are watching. That viewing record is used for recommendations and sold or shared for advertising. In 2017, Vizio paid $2.2 million to settle charges from the FTC and the New Jersey attorney general that it had collected viewing data from millions of TVs without telling owners.

• The ACR setting itself, which each brand names differently: Viewing Information Services on Samsung, Live Plus on LG, Viewing Data on Vizio, and "Use info from TV inputs" on Roku TVs.
• Ad personalization and the advertising ID, which you can usually limit or reset.
• Voice search microphones in the remote or the set.

Expect some of these settings to switch back on after a major software update, so it is worth checking the menu again every few months.

A wider fix is to choose devices that do more of their work inside the house. Apple's HomeKit Secure Video, for example, analyzes camera footage on a home hub before an encrypted copy reaches the cloud. Matter, a standard run by the Connectivity Standards Alliance and backed by Apple, Amazon, Google and Samsung, lets devices such as plugs, lights, locks and sensors be controlled over your home network rather than through each maker's servers. Matter does not make a device private on its own, since the brand's app may still collect data. When shopping, look for the Matter logo on the box and read the maker's privacy page for one specific answer: whether the device still works when your internet connection is down.