Smart Home Privacy & Security

Start With Your Accounts

Most people worry about devices being hacked directly. In practice, the far likelier route into a smart home is an account — reused passwords, no second factor, credentials exposed in someone else's data breach. Fixing that is unglamorous and takes about ten minutes, and it does more than everything else on this page combined.

The Three Things That Matter

• A unique password for every smart home account. The specific risk is reuse: when an unrelated site is breached, attackers try those same credentials elsewhere. A password used only for your camera account can't be exposed by someone else's mistake.
• Two-factor authentication wherever it's offered. This is the single most effective control available to you. Even a stolen password becomes largely useless without the second factor. If a manufacturer offers it, turn it on — particularly for cameras, locks and anything with a microphone.
• A password manager. Unique passwords are only realistic if something remembers them for you. Any reputable manager, including the ones built into browsers and phones, is a substantial improvement over reuse.

Prioritise by Consequence

If doing everything at once feels like too much, work in this order: door locks first, then cameras and anything with a microphone, then the hub or platform account that controls everything, then individual device accounts. The question to ask is what someone could do with access — opening a door and watching a living room sit rather differently from switching a lamp.

Securing the Router Itself

Your router is the front door to everything else, and it's frequently the least-maintained device in the house.

• Change the default admin password. Not the Wi-Fi password — the separate one for the router's own settings page. Default credentials for common models are published openly, and many people never change them.
• Keep the router firmware updated. Some update automatically; many don't. If yours doesn't, check occasionally, or consider replacing a router the manufacturer has stopped supporting.
• Use WPA2 or WPA3 encryption with a strong Wi-Fi password. Older standards are no longer adequate.
• Turn off remote administration unless you actively need it. There's rarely a reason for your router's settings page to be reachable from the wider internet.
• Consider disabling UPnP. It lets devices open ports automatically, which is convenient and reduces your control over what's exposed. Some devices need it; if yours don't, off is the safer default.
• Replace routers that no longer receive updates. An unsupported router with known unpatched flaws undermines everything connected to it.

Separating Smart Devices From Everything Else

Smart devices are often built to a price, sometimes stop receiving updates early, and occasionally come from manufacturers with limited security track records. Keeping them on a separate network limits what a compromised device could reach.

The Simple Version: Use the Guest Network

Nearly every router has one. Putting smart devices on it separates them from the laptops, phones and network storage where your actual data lives. If a device turns out to be poorly secured, it's isolated from anything worth reaching.

What to Watch For

• Client isolation may block discovery. Many guest networks prevent devices seeing each other, which stops casting, printing, and some app-to-device communication. Some routers let you disable isolation on the guest network specifically — that's usually the setting you want.
• Your phone may need to be on the same network for local control. If your phone stays on the main network, some apps will fall back to cloud control, which works but is slower.
• Set it up before adding devices, not after. Moving twenty devices between networks means re-pairing twenty devices.

If Your Router Supports More

Some routers offer proper VLANs or dedicated IoT networks with configurable rules, letting devices reach the internet but not each other or your computers. If yours has this, it's worth using. If configuring it sounds unappealing, the guest network gets you most of the benefit for a fraction of the effort.

Firmware & Update Habits

Firmware updates matter more for smart devices than for phones, because the consequences of an unpatched flaw are more physical — a lock, a camera, a device with a microphone in a bedroom.

• Enable automatic updates wherever offered. For most households this is straightforwardly the right setting.
• Check manually for devices that don't auto-update, particularly locks and cameras. A calendar reminder a couple of times a year is enough.
• Consider support lifespan before buying. A lock or camera is a long-lived purchase. Whether the manufacturer still updates its five-year-old products tells you something about what yours will look like in five years.
• Take end-of-support notices seriously. When a manufacturer announces a device will no longer receive updates, that's the point to plan its replacement — especially for anything security-related.

Cameras & Microphones

Physical Controls Beat Software Ones

Where available, prefer devices with a physical shutter or a hardware microphone disconnect. A software "off" depends on the software behaving correctly; a physical cover doesn't. Several indoor cameras include a motorised or manual shutter for exactly this reason, and it's a feature worth paying a little more for on anything pointed at a living space.

Placement Decisions Are Privacy Decisions

• Avoid bedrooms and bathrooms as a default. If there's a specific reason for one, it's worth being deliberate about it rather than sliding into it.
• Frame out neighbours' property where you reasonably can. Beyond being courteous, some jurisdictions have rules about recording beyond your own boundary, and privacy zones in the app are the usual tool.
• Use schedules or geofencing so indoor cameras switch off when people are home. Most apps support this and many people never enable it.

Tell People

Household members, regular visitors, cleaners and guests should know cameras exist and roughly what they cover. Beyond the legal position — which varies, and is stricter in some places than people assume, particularly for audio recording — it's simply the decent thing. A camera someone discovers rather than being told about damages trust disproportionately.

Recordings Are Data Too

Footage stored in the cloud is subject to that provider's policies, retention periods and access controls. Worth knowing: how long clips are kept, who in your household can view them, whether anyone at the company can, and what happens if you stop paying for a subscription. Local storage keeps footage under your control, at the cost of losing it if the device is stolen — which is a real trade-off rather than an obvious win either way.

Voice Assistants & Stored Recordings

Voice assistants listen locally for a wake word and normally send audio to the provider only after they think they've heard it. The practical wrinkle is false triggers: a similar-sounding phrase can start a recording nobody intended.

Controls Worth Knowing About

• The physical mute button. Most smart speakers have one that electrically disconnects the microphone rather than just setting a software flag. Useful for particular conversations, or in a room where you'd rather not think about it.
• Review and delete voice history. Every major platform provides this. It's also genuinely illuminating — the false triggers in the log tell you a lot about how often the device wakes unintentionally.
• Automatic deletion. Most platforms let you set recordings to delete after a defined period, or not to be retained at all. This is usually off by default and is one of the more worthwhile settings to change.
• Opting out of human review. Providers have used samples of recordings for quality review by people. Where an opt-out exists, it's usually in privacy settings.
• Voice purchasing. If enabled, consider a confirmation code or switching it off — particularly in a household with children or frequent visitors.

What Your Devices Collect

Smart devices generate more information about household routines than people generally expect. Not because it's sinister, but because that's inherent to what they do.

• Locks log who entered and when — a precise record of household comings and goings.
• Thermostats infer occupancy patterns, since they're designed to detect when you're home.
• Lights and plugs reveal daily routines through usage timing.
• Cameras capture footage, motion events, and often audio.
• Voice assistants store queries and recordings.

Reading a Privacy Policy Without Reading All of It

Four questions get you most of the way:

• What's collected, and is any of it beyond what the device obviously needs?
• Is data shared with third parties, and for what — service delivery, or advertising and analytics?
• How long is it retained, and can you delete it?
• What happens if the company is sold, or shuts down?

That last one is worth more attention than it gets. Smart home companies get acquired and discontinued regularly, and both the service and the data can change hands. Devices that work locally without a cloud account are more resilient to this, which is one practical argument for local control beyond speed.

Where You Live Affects Your Rights

Data protection law varies considerably by country and region. Depending on where you are, you may have enforceable rights to access, correct, or delete what a company holds about you, and manufacturers usually document how to exercise them. Worth knowing what applies where you live rather than assuming either the best or the worst.

Selling, Moving & Buying Used

This is the step almost everyone forgets, and it matters in both directions.

Before You Sell or Give Away a Device

• Remove it from your account in the app first, then factory reset the hardware. Doing only the reset often leaves the device still registered to you, which prevents the new owner adding it and leaves a stale entry on your account.
• Check for stored data on the device itself — local recordings on a camera's memory card, saved codes on a lock, network credentials.
• Delete any associated cloud footage you don't want retained.

When You Move House

• Remove any device you're leaving behind from your account, and reset it for the new occupants.
• Change codes on any lock that stays. Previous cleaners, contractors and neighbours may hold working codes you've forgotten about.
• Moving in? Assume any smart device left behind may still be linked to a previous occupant's account. Factory reset everything before use, and treat any lock as needing a full code reset. This applies to doorbells and cameras too — a device you can't fully control is one you shouldn't rely on.

Buying Used

Second-hand smart devices can be good value, with a caveat: if the seller hasn't removed it from their account, you may not be able to register it at all, and some devices remain partially controllable by the original owner. Before buying, ask the seller to confirm they've deregistered it. For locks and cameras specifically, the risk-to-saving ratio is poor enough that buying new is often the better call.

Common Situations

If a situation persists beyond these, the manufacturer is the right place to go next — they have model-specific information and account tools that general guidance can't substitute for.