Tech companies stand accused of making “excessive” requests for access to users’ personal data, with smart devices such as TVs, speakers, air fryers and smartwatches collecting details such as customer’s exact location with “reckless abandon”.
So says a new highly critical report from Which?, which has triggered calls for much stricter rules around smart product devices and data collection.
For the report, Which? tested and rated a range of popular smart devices to give them a privacy score based on what data access requests they made and found that data collection often went well beyond what was necessary for the functionality of a product.
The organisation even claimed that personal data could be being shared with third parties for marketing purposes in some cases.
According to the report, all three air fryer products tested wanted to know a user’s exact location and wanted permission to record audio on a user’s phone, for no specified reason.
Which? said one of the air fryers – made by Chinese firm Xiaomi – used a connected app which linked to trackers from Facebook, an ad network linked to TikTok and, depending on location, Chinese tech giant Tencent.
The air fryer, and another from rival Chinese firm Aigostar, also sent personal data to servers in China, Which? said, although this was mentioned in a privacy notice.
In addition, Which? said the Huawei Ultimate smartwatch it tested asked for a range of phone permissions the study classified as “risky”, including precise location, the ability to record audio, access to stored files and the ability to see all other installed apps.
However, Huawei insisted that these permissions were justified and that no user data was used for marketing or advertising purposes.
Which? said it had found similar issues in the smart TVs it tested, made by Hisense, LG and Samsung, with all three asking for a postcode at set up, and while the Hisense did not connect to any trackers Which? researchers could detect, Samsung and LG’s TVs did, including Facebook and Google.
It said the Samsung TV app also made a number of “risky” phone permission requests.
In its test of smart speakers, Which? highlighted the Bose Home Portable speaker as being “stuffed” with trackers, including Facebook, Google and digital marketing firm Urbanairship.
Which? magazine editor Harry Rose said: “Our research shows how smart tech manufacturers and the firms they work with are currently able to collect data from consumers, seemingly with reckless abandon, and this is often done with little or no transparency.
“Which? has been calling for proper guidelines outlining what is expected of smart product manufacturers and the Information Commissioner’s Office has confirmed a code is being introduced in spring 2025 – this must be backed by effective enforcement, including against companies that operate abroad.”
Which? has also urged consumers to improve their data privacy by taking care to opt out of data collection requests they are not comfortable with, to check permission requests on apps before downloading them and deny or limit app data access via their phone settings, and delete voice recordings of interactions with voice-based assistants.
In response to the Which? research, Samsung and Huawei said they took the security and privacy of customers “incredibly seriously”, while Hisense insisted it values its relationships with its customers and “respects their data privacy rights”.
Meanwhile, Xiaomi claimed that “respecting user privacy” has always been among its core values; LG declined to comment, while Aigostar and Bose did not respond.
Related stories
Which? exposes shady festive deals in Christmas blitz
Retailers face huge fines for selling unsecure IoT tech
Firms urged to show they care to 30m breach victims
Cock-up culture: Staff guilty of 90% of data breaches
Data breaches, not rogues, are ICO Public Enemy No. 1
Ransomware victims who pay up are nearly all hit again