What Your Smart Home Devices Quietly Know About You

Voice assistants that order groceries, thermostats that learn when you wake up, doorbells that stream video to your phone while you are at work in the Sydney CBD. Connected home technology has moved from novelty to background fixture in a remarkably short span of years, and the convenience is genuinely appealing. For many households, the first smart speaker arrived as a Christmas gift or a Bunnings end-of-aisle impulse buy, and the rest followed almost without thinking.

Each new gadget quietly adds another channel through which information about your daily life leaves the house. Audio snippets, presence patterns, energy use, even the times your fridge door opens can travel to servers overseas, where the legal protections that apply in Australia may not reach. The technology itself is rarely the problem. It is the volume and granularity of data these devices generate, combined with a privacy framework that was never designed for a fridge that talks to the cloud.

Australians have adopted connected home gear faster than the conversation about its risks. The NBN rollout brought reliable broadband to suburbs that previously struggled with basic streaming, and retailers from JB Hi-Fi to Officeworks now devote entire wall displays to smart lighting, security kits, and energy monitors. Before adding another device to the network, it is worth pausing to ask what is being recorded, who can see it, and what happens when the company behind the product changes hands or gets breached.

What Connected Devices Actually Collect

A smart light bulb sounds innocuous, and at the level of a single switch it mostly is. The picture changes once a household assembles a dozen of these products into a single ecosystem, often managed through a phone that already knows where you are at all times. Voice assistants record audio not only when you say the wake word but, depending on settings, brief snippets before and after. Smart TVs can identify what is on the screen and send viewing data back to manufacturers and advertisers. Robot vacuums map the floor plan of your house and store that map on company servers, sometimes indefinitely.

The deeper concern is not any single data point but the pattern they form together. Energy usage data can reveal when you are home, asleep, or away on holiday in Bali. A door sensor paired with a calendar integration can show when the children arrive from school in Brisbane. Geofencing on phones already exposes comings and goings, and once it is fused with in-home sensors, the resulting profile becomes uncomfortably complete. Researchers at several Australian universities have demonstrated that even low-resolution data, such as aggregate energy use over a day, can be used to infer which appliances are running and roughly what activities are taking place.

Manufacturers argue that the data is needed to make the products work, and sometimes that is true. The harder question is whether the amount collected, the retention period, and the sharing with third parties are proportionate. Australian Consumer Law requires products to be fit for purpose and free from hidden characteristics, but the typical privacy policy runs to dozens of pages of legal language that few people read before tapping accept.

The Australian Privacy Framework and Its Gaps

Australia's main privacy law is the Privacy Act 1988, administered by the Office of the Australian Information Commissioner. It sets out Australian Privacy Principles covering collection, use, disclosure, and storage of personal information, and the Notifiable Data Breaches scheme requires organisations to tell affected individuals when serious harm is likely. For most consumer smart home devices bought online, however, the manufacturer is based overseas, which means the Act applies only in limited circumstances and enforcement against a foreign company is slow at best.

The ACCC has taken a more active stance in recent years, particularly around misleading data practices and the security of connected products. In 2023 the regulator published guidance on consumer guarantees as they apply to digital products, and it has pursued cases against companies that collected more information than disclosed. None of this replaces a tailored regime for the internet of things, and consumer advocates have argued for years that Australia needs specific rules covering connected devices, including mandatory security standards and clearer disclosure of what is collected.

There is also the practical matter of where the data ends up. Many cloud services used by smart home brands route information through servers in the United States or other jurisdictions, where access by law enforcement follows different rules. Major breaches at local companies, including the 2022 Optus incident affecting millions of customers and the Medibank attack later that year, reminded Australians how exposed personal information can be once it leaves the device it was collected on.

Common Weaknesses in Off-the-Shelf Smart Home Gear

Security researchers have spent the better part of a decade poking at consumer smart devices, and the findings are not flattering. Default passwords, unencrypted local communication, and outdated firmware remain common. A study published by a UK consumer group several years ago found that several popular smart hubs could be taken over through the home network with relatively little effort, allowing an attacker to control lights, locks, and cameras from outside.

Many vulnerabilities are not exotic. They stem from products being rushed to market with minimal attention to security, then left without updates once the manufacturer moves on to the next model. Australian households that bought an early-generation smart speaker or a budget security camera from an online marketplace may find that the app no longer receives patches, or that the company behind it has quietly gone out of business. The device keeps working, but in a state that is increasingly porous.

The risk is not only external intrusion. Some products have been caught sending data to advertising networks in unexpected ways, or sharing usage information with third-party analytics providers buried several layers deep in the setup process. Once that information leaves the device, controlling where it goes becomes effectively impossible for the person who bought the product.

Voice Assistants, Cameras and the Question of Consent at Home

Voice assistants raise a particular set of questions because they are often shared by everyone in a household, including children, guests, and visiting tradies. Recordings can be triggered by mistakes in voice recognition, and human reviewers at the companies behind the products have, in documented cases, listened to fragments of conversations never meant for the cloud. Even when audio review is switched off, transcripts and metadata typically remain, building a long record of who said what and when.

Indoor cameras introduce a different dimension. A camera in a living room in Melbourne may be reasonable for one household and an absolute violation of trust for a flatmate who never agreed to be recorded. Australian tenancy law does not yet give renters a clear right to refuse landlord-installed cameras in shared spaces, and disputes have begun to surface in tribunal records. Smart doorbells pointed at the street add another layer, capturing neighbours and passers-by who have not consented to being filmed as they walk to the local café.

The honest answer is that consent inside a home is rarely as informed as the privacy policies imply. Most people do not read them, and even those who do often have no real alternative if they want to use the product at all. Shifting the conversation from individual choice to clearer industry standards is one of the more useful things that could happen in this space.

Practical Steps for an Australian Household

Reducing the privacy footprint of a connected home does not require throwing every device in the bin. A few targeted changes make a meaningful difference, and most of them take less time than assembling the flat-pack furniture that often comes home from the same shopping trip.

Start with the router. Most home networks in Australia still rely on the modem-router supplied by the ISP, whether that is Telstra, Optus, TPG, or one of the smaller providers. Logging into that device, changing the default admin password, and checking that firmware updates are automatic closes off a surprising number of attack paths. From there, putting smart home devices on a separate guest network isolates them from laptops and phones, so a compromised bulb cannot reach the family computer.

Inside individual apps, turn off anything that sounds like advertising personalisation, voice sample review, or data sharing with partners, and switch account access to two-factor authentication. Replace any device still using a factory-set password with a unique one stored in a password manager. For voice assistants in particular, the option to delete recordings on a schedule, usually weekly or monthly, materially reduces the long-term record held by the manufacturer.

For households that want to go further, local-only devices are becoming more common. Smart switches, lighting, and sensors that use the Matter standard can be controlled entirely from a hub inside the home, without sending routine data to a cloud service. It is not a perfect solution, since some features still require an internet connection, but it shifts the default away from constant transmission.

A quiet Sunday spent listing every connected device in the home, deciding which ones genuinely earn their place, and reviewing the privacy settings on each is a realistic starting point. Pick one device tonight, open its app, and switch off one permission you cannot justify.