Smart home privacy without the paranoia
Not a question of whether you are being watched. A question of which specific records exist, who holds them, and which of them you can decline.
Two kinds of data, and only one of them is interesting#
Almost everything a smart home reports falls into one of two buckets, and conflating them is why this topic generates more heat than light.
Metadata is the fact that something happened: the plug turned on at 06:42, the hallway sensor tripped, the front door unlocked. Each record is trivial. The set of them is a schedule of your household accurate to the minute, held on somebody else's disk under a retention policy you did not write.
Content is the thing itself: audio from a microphone, video from a camera, a floor plan from a vacuum. That is qualitatively different, and it is where the effort belongs.
Ask four questions per device: what does it send, to whom, how often, and can I turn it off? Then spend your attention on the answers that involve content.
What each class actually sends#
| Device class | What typically leaves the house | What it reveals |
|---|---|---|
| Zigbee, Z-Wave or Thread devices on a local hub | Nothing, unless your hub forwards it | Nothing, if the hub is local |
| Matter devices, local control | Nothing on the control path | Control is local by design. The vendor app may still report separately |
| Cloud Wi-Fi plugs, bulbs and switches | Every state change, with timestamps and your account ID | Occupancy patterns, sleep and wake times, when the house is empty |
| Motion, contact and presence sensors | Every trigger, with timestamps | The most detailed occupancy record in the house |
| Smart locks | Lock and unlock events, which credential was used | Who came and went, and when |
| Thermostats | Setpoints, ambient temperature, HVAC runtime, often an occupancy signal | Presence, heating habits, sometimes utility program participation |
| Voice assistants | Audio after the wake word, plus transcripts and request history | Content: whatever was said in the room after the wake word |
| Cloud cameras and doorbells | Video, thumbnails, detection events and, on paid tiers, cloud analysis | Content: the room, the street, faces, packages, visitors |
| Robot vacuums | Floor maps, room labels, cleaning history | Your floor plan, room by room, and when you are out |
| Smart TVs and displays | Viewing telemetry, often automatic content recognition | What you watch, on any input |
| Energy monitors, solar and EV chargers | Interval consumption data | Appliance-level habits and vehicle movements |
Two notes on that table. First, "nothing leaves" for local protocols is a real property, not a marketing claim: a Zigbee sensor has no IP address and no route to the internet, so the only way a record reaches a server is if your hub sends it. Second, a Matter device being locally controlled does not stop its manufacturer's own app from reporting separately if you have that app installed and linked.
Microphones: the one that changed#
Voice is where the biggest single change of the last two years happened, and it is worth stating plainly rather than dramatically.
Wake word detection runs on the device. The speaker is listening for one pattern locally, and audio before the wake word is not streamed. After the wake word, the audio goes to a server, because interpreting arbitrary human speech is a large model running in a data center.
What changed is the option to avoid that. Amazon removed on-device voice processing on 28 March 2025, deleting the "do not send voice recordings to the cloud" setting from the three Echo models that had it. There is no opt-out. All Alexa voice is processed in the cloud, which is also why an Echo does nothing useful during an outage. Google's move to Gemini for Home on speakers and displays from late 2025 into 2026 is cloud processing too, and Siri sends requests to Apple for interpretation.
The genuinely local alternative exists but it is a project: Home Assistant offers a fully local voice pipeline, with speech-to-text and intent handling on your own hardware. It is less capable at open-ended questions and completely capable at "turn off the kitchen light".
What you can do without giving up the assistant:
- Turn off voice recording retention and delete history in the assistant's privacy settings. Google documents its data controls, including auto-delete defaults, in its safety center.
- Use the physical mute switch on the speaker rather than a software setting. It cuts the microphone circuit.
- Do not put a voice device in a bedroom or a home office where sensitive conversations happen. This is a placement decision, and it is more effective than any setting.
- Prefer a display or speaker with a physical camera shutter if the room needs one at all.
Cameras: content, retention and who analyzes it#
A camera is the highest-stakes device in the house on this axis, because it produces content continuously and because the business model usually depends on processing that content in the cloud. Google's move from Nest Aware to Google Home Premium on 1 to 2 October 2025 put advanced camera intelligence and the newer assistant features behind a $10 or $20 a month tier, with a free tier of six hours of video history.
There are three architectures, and the difference matters more than any privacy policy:
- Cloud recording with cloud analysis. Video leaves the house, is stored by the vendor, and is analyzed by their models. Most subscription cameras.
- Local analysis, encrypted cloud storage. Apple's HomeKit Secure Video is the mainstream example: your home hub does the detection work and clips upload encrypted. The vendor holds ciphertext rather than footage.
- Fully local. Onboard storage or an NVR, with an RTSP or ONVIF stream, and nothing leaving unless you send it. The most private and the most work.
Matter 1.5 added camera support in November 2025, including local or cloud recording as an option, and 1.5.1 refined it in March 2026. As of September 2026 SmartThings is the only major controller shipping Matter 1.5 cameras, so this is a direction rather than a solution today. Matter cameras and cameras and doorbells cover where that actually stands.
Cutting it down, in order of payoff#
1. Move device classes onto local protocols. This is the only step that eliminates rather than reduces. A Zigbee, Z-Wave or Thread sensor reporting to a local hub produces no external record at all. Sensors are the highest-value class to move, because occupancy data is the most revealing metadata in the house. Sensors: motion, contact, temperature, leak covers the hardware.
2. Make the hub the only thing that talks outward. One component with an internet connection, under your control, beats fifteen devices each phoning a different company. That is also the security argument in securing a smart home network.
3. Unlink integrations you no longer use. Every cloud-to-cloud link is a standing grant of access to your device list and state. Stale links are common after platform experiments, and removing them helps reliability too, because a broken link is a source of phantom failures. Running two platforms on purpose covers doing this deliberately.
4. Use the vendor's own controls. Delete voice history, turn off cloud detection features you do not use, opt out of product improvement programs, and set retention to the shortest option. These settings are real and they are usually three taps deep.
5. Segment the network, but understand the limits. Putting IoT devices on their own VLAN or SSID limits what a compromised device can reach on your LAN. It does not stop a device sending data to its own manufacturer, because that is outbound traffic to a service the device is designed to use. The network setup a smart home wants has the build.
6. Block outbound access only where you know the consequence. Firewalling a device off the internet works for products with a genuine local API, breaks products without one, and stops firmware updates in both cases, which is a security trade rather than a free win. Test one device before doing it to twenty.
7. Buy against it at the shelf. The pre-purchase checklist asks whether a device works without an account and where the data goes. NIST's IR 8425 baseline for consumer IoT products is a useful frame for what a responsible manufacturer should provide.
A proportionate threat model#
The realistic risks, roughly in order of likelihood: a vendor using your data commercially or changing its policy, a breach at a company holding your records, legal process served on a cloud provider, and a household member seeing something through shared access that you did not intend to share. Note what is not on that list: a stranger picking your smart bulb out of the air. The attacks that happen at scale are about credentials and exposed services, not eavesdropping on your lights, and they are covered in securing a smart home network.
Shared access is the privacy question people forget. Apple's guest access is all or nothing, and shared users on every platform can see device history. Decide who sees the lock log before you invite someone, not after.
Does Alexa record everything I say?
No. Wake word detection runs on the device, and audio is streamed after the wake word rather than continuously. What did change is your ability to keep processing local: Amazon removed on-device voice processing on 28 March 2025 and there is no opt-out, so all Alexa voice requests are now processed in the cloud. You can still delete voice history and use the hardware mute switch.
Do Matter devices send data to the manufacturer?
Not on the control path. Matter control happens locally between your controller and the device on your own network, with no cloud in the loop, which the CSA describes as a core property of the standard. What can still report is the manufacturer's own app, if you have it installed and linked, and anything cloud-side that the vendor attaches to the product separately.
Is a local hub actually more private, or does it just feel that way?
Measurably more private for anything that stays on it. A Zigbee or Z-Wave device has no IP address and no route out of the house, so its reports reach a server only if your hub forwards them. The honest caveat is that a hub with cloud integrations, remote access or a voice assistant attached is forwarding plenty, so the benefit depends on how you configure it.
What can someone learn from my smart plug data?
More than the plug suggests. State changes with timestamps show when the kettle runs, when the TV goes off, and when nothing happens for a week because you are away. That is why occupancy-adjacent devices, sensors and plugs and lights, are worth moving to local protocols even though each individual record looks harmless.
Are cheap no-name devices worse for privacy?
Often, but the more reliable predictor is the architecture rather than the brand. A cloud-only device from a large company sends the same categories of data as a cloud-only device from a small one, with better lawyers attached. A device that speaks a standard local protocol and never needs an account is the safer purchase regardless of who made it.
Does putting IoT devices on their own VLAN stop them sending data home?
No. A VLAN limits what a device can reach on your own network, which is a security benefit and a good idea. Outbound traffic to the manufacturer is exactly the traffic the device was built to send, and it still goes unless you write firewall rules to block it. Segmentation and data minimization are different jobs.
Which platform is best for privacy?
Home Assistant, by a wide margin, because you can run it with no cloud at all, including local voice. Apple Home is the strongest of the mainstream three, with local automation execution and on-hub camera analysis in HomeKit Secure Video. Alexa and Google Home are cloud-first by design. The Local Control Index scores the underlying property, and local control and privacy track each other closely.
Primary sources
Specification and vendor documentation we checked while writing this page. Where a claim depends on firmware behaviour rather than a published spec, the page says so inline.