A privacy-conscious Year 11 student from Kāpiti College has launched a petition to stop companies from selling consumers’ smart appliance data.
The story behind the petition to parliament
Liam Martin was inspired to launch the petition while researching appliances that could turn his house into a “smart home”. He was particularly interested in an energy-efficient fridge that could hook up to a smartphone. When he started to dig deeper, Liam found that the fridge used artificial intelligence to optimise its temperature based on when, and how often, the fridge was used.
“The fridge temperature optimisation required data collection from WiFi, which would be fine, but I discovered companies collect and sell the data,” said Liam.
What kinds of data can be collected?
Smart fridges, washing machines and other internet-enabled appliances can collect:
device and account data (e.g. your name, email address and home address)
usage and behavioural data (e.g. how often you use your washing machine and which cycles you use)
voice data (e.g. voice commands and recordings from your smart speaker)
video and image data (e.g. recordings from your video doorbell).
Depending on the manufacturer's privacy settings and policies, some of this information may be shared with advertising, analytics or marketing partners to help profile consumers, target advertising or develop new products and services.
Liam was concerned by the level of data collection and sharing, and that most users probably aren’t aware it’s happening – even if it’s in the terms and conditions.
What are the risks of data collection?
This isn't new. In The Age of Surveillance Capitalism, released in 2019, Shoshana Zuboff observed that forecasts were predicting strong growth in the market for internet-enabled appliances. The book noted that Samsung was among the market leaders at the time.
Samsung's smart TVs came under scrutiny in 2015, when privacy advocates raised concerns that conversations recorded by the TVs could be transmitted to a third-party speech-recognition provider for transcription.
More recently, The New York Times’ Wirecutter reported: “Yes, your TV is probably spying on you. Your fridge, too.” It said many home devices collect information about people nearby, and that some of that data may be shared, analysed and sold to the highest bidder – hundreds of times a day, by organisations you've never heard of.
Is an air fryer spying on you?
Consumer's sister organisation in the UK, Which?, assessed four popular home appliance categories to determine what data was gathered, and where it was being sent.
The team at Which? found data collection often went far beyond what products needed to function, and that data could, in some cases, be shared with third parties for marketing purposes.
For example, Which? reviewed three air fryers and found they all “wanted permission to record audio on the user's phone”. Two of the air fryers sent people's personal data to servers in China, although this was flagged in the privacy notice.
Closer to home, Liam has reason to believe his devices are listening to him.
“I was talking about a virtual reality headset with my mum; she then started seeing adverts for a virtual reality game.
“I think this is hard evidence that devices are constantly collecting data even when privacy settings are applied, which feels like a breach of consumer trust.”
Should you be worried about where your data ends up?
Consumer NZ chief executive Jon Duffy says the concerns raised by our advocacy colleagues in the UK and US apply here too.
"Smart appliances will be hoovering up our data and sending it back to the manufacturer. The manufacturer could be based in China, the United States, or closer to home. Regardless of where the manufacturer is based they can use the data they hold about you to provide you with services, to inform their business, and potentially to remarket products to you."
In short, Consumer shares Liam's concerns.
The risk of data breaches
Data-sharing is concerning enough for some consumers, but there's an even bigger risk: the possibility that hackers could gain access to your data and use it in harmful ways. For example, a robot vacuum could produce a detailed floor plan of your home, which would be very handy for a thief if it got into their hands. While that is an extreme example, the reality is once an appliance is connected to the internet it can collect information about your household and send it to cloud servers, where it may be vulnerable to hacking or data breaches.
Where is smart appliance user data going?
While New Zealand law covers companies storing data here, many appliance manufacturers are based overseas – which means your data could be stored anywhere in the world. So potentially, foreign government agencies could legally access data about your household.
The review of smart air fryer activity in the UK by advocacy group Which? found user data was being sent to China; there's nothing to stop that happening here too.
“Most of us are sharing more information than we realise, and we don’t know who it’s shared with. Currently there’s very little in the way of safeguards to protect us from organisations collecting and selling that information on,” says Jon Duffy.
“While businesses generally need our consent to collect and use our personal information, we know that consent is a farce in many instances, with privacy policies unread by end users. Many people would be unaware they have consented to their data being on-sold”.
Liam’s petition is fighting for our privacy
Liam recognises that modern appliances around the home increasingly require internet connectivity and gather users’ data. He says that this data is currently heavily commodified and sold to third-party brokers. The petition’s stated rationale is that the “unregulated ecosystem fuels malicious cybercrime, identity theft, and hyper-targeted phishing campaigns.”
Liam’s petition calls for an amendment to the Privacy Act 2020 to “explicitly prohibit companies from selling, trading, or sharing consumer smart appliance and Internet of Things device data with third-party data brokers, and to include a strict ‘opt-in’ requirement for all telemetry data collection.”
Consumer fully supports this petition and encourages readers to get behind this student’s mission to protect consumers from the sale of their smart appliance data.
The petition is available on the Parliament of New Zealand website and closes on 20 December.
