Your smart speaker heard you say its name. What else did it hear, what did it keep, and who can listen to it later? Those are the right questions about AI smart home devices, and they have more specific — and more fixable — answers than the usual vague unease suggests. Not all devices collect the same things, and the privacy risk in your home is concentrated in a handful of settings most people never open. Work through the checklist room by room and you will have handled nearly all of it.
The checklist: what to review on every device
- Voice recordings: are they stored, for how long, and can a human ever review them? Find the setting to auto-delete them, and the one to stop them being used to “improve services.”
- The microphone itself: does the device have a physical mute or shutter? A hardware off-switch beats a software promise every time.
- Camera storage: are clips kept in the cloud, for how many days, and is footage encrypted? Who besides you has account access?
- Sharing defaults: doorbell and camera apps sometimes encourage neighborhood sharing. Check what is shared, with whom, and whether it happens automatically.
- Viewing and activity data: smart TVs and streaming devices track what you watch and when. Find the setting that limits ad tracking and viewing-data collection.
- Account security: unique password plus two-factor authentication on every home account. The best privacy settings on Earth do not survive a reused password.
- Guest access: who else has the app on their phone — ex-partners, old roommates, the installer? Review and remove.
- Kids’ devices: toys, tablets, and speakers in children’s rooms deserve the strictest settings of all, and often ship with the loosest.
Voice assistants: the recording is the point to understand
The detail that surprises most people is not that these devices mishear their wake word occasionally — it is that audio clips exist as reviewable recordings inside your account at all. Open your assistant’s privacy dashboard once and the abstraction becomes concrete: a list of your requests, playable, datable, deletable. Set recordings to auto-delete on the shortest cycle offered, turn off the option that lets your audio be used for service improvement and research, and learn where the physical mute button is for the conversations you would rather not risk being clipped at all. The device is a microphone with a computer attached; treating it with the respect that implies is not paranoia, it is accuracy.
Cameras and doorbells: your privacy, and everyone else’s
Cameras collect the most sensitive data in the smart home because they collect other people too — visitors, deliveries, neighbors, your own family at unguarded moments. Cloud storage means those clips live on a company’s servers under your account’s security, which is why the account rules above matter most here. Check whether your plan stores clips for days or months and prune accordingly; check who the footage is shared with if you have joined a neighborhood program, and what police-request policies your provider publishes; and aim cameras at your property, with motion zones set to ignore the street and the neighbor’s yard. Generosity with other people’s privacy tends to be reciprocated, and in some places it is also the law.
The television: the quietest collector in the house
Most owners never think of the TV as a sensor, but many smart TVs use automatic content recognition — sampling what is on screen, including from connected devices, to build a viewing profile for advertising. It is typically disclosed in a settings menu nobody opens, under names involving “viewing data” or “interest-based ads.” Turn off the recognition, limit ad tracking, and consider whether the TV needs to be online at all if a separate streaming stick does the connected work. The Mozilla’s Privacy Not Included guide to connected products rates exactly these practices device by device and is the fastest way to check a specific model before you buy or after you bring it home.
The front door: locks, alarms, and the highest-stakes gadgets
One category deserves slower treatment than the checklist pace, because its failure mode is not embarrassment but entry. Smart locks, garage controllers, and connected alarms trade in physical access, and they deserve physical-world scrutiny. Who holds a code or an app invite — cleaners, dog walkers, former housemates, a teenager’s entire friend group by now? Codes should rotate like passwords and for the same reasons, guest access should expire when the guest does, and every lock event log is worth a glance when something feels off. Prefer locks that still work with a key and alarms that still alarm when the internet dies; a security device that fails open in a power cut has misunderstood its job description. And be thoughtful about connecting the security layer to the convenience layer — the voice assistant that cheerfully unlocks the door on request is a feature until it is a voice through the letterbox. Keep the gadgets that amuse you and the gadgets that guard you on separate levels of trust, and let the checklist above decide which is which.
One honest counterweight belongs here, because a checklist can make the whole category sound like a threat with a power cord. These devices also prevent real harms: the doorbell footage that identifies the package thief, the camera that lets an adult child check on an elderly parent who fell, the leak sensor — too boring to fear, too useful to skip — that catches the burst pipe at minute ten instead of day three. Voice control is not a luxury for someone with limited mobility; it is independence. The point of auditing your settings is not to talk yourself out of the smart home. It is to arrive at the version of it where the protection runs toward you instead of the data running away from you — a house that watches the street for you, on settings you chose, under accounts you control. That house is entirely available. It just never ships as the default.
The data you cannot see, and the trade you are making
Beyond recordings and clips, devices generate a shadow dataset: when the house is occupied, when it sleeps, when the thermostat thinks you left. Individually harmless, in aggregate it is a pattern of life — which is why the broader questions in what happens to your data when you use a free AI tool apply indoors too: what is collected, who it is shared with, and what “free” services are paid in. None of this requires rejecting the devices. Voice control of lights is a genuine accessibility gift; a doorbell camera has solved real crimes and settled real disputes. The goal of the checklist is not abstinence. It is making the trade knowingly, per device, with the defaults — which are set for the manufacturer’s benefit, not yours — corrected in your favor. General guidance from groups like the Electronic Frontier Foundation’s privacy guidance pushes the same philosophy: you cannot negotiate with a settings page you never open.
The device nobody counts: your network itself
Every gadget in the checklist talks to the internet through one pipe, and that pipe has its own privacy settings. Your router sees the rhythm of the whole house — when devices wake, how much they send, which services they call — and your internet provider can see more of your traffic’s shape than any single gadget can. Two simple moves shrink that exposure. First, put smart home devices on your router’s guest network if it offers one: it costs them nothing in function, and it walls them off from the computers and drives where your actual documents live, so a compromised cheap gadget cannot wander the house. Second, treat the router like the front door it is: current firmware, a strong admin password that is not the default printed on the label, and remote administration switched off.
While you are in there, glance at the list of connected devices and play a short game: name every one of them. Most households find a stranger in the list — not an intruder, but a forgotten gadget still phoning home: the old tablet, the printer from two apartments ago, the smart plug behind the sofa. Anything you cannot identify gets disconnected until it explains itself. An audit that cannot account for its own devices is not finished, however tidy the settings are.
The twenty-minute audit that settles most of it
Set a timer and go device by device with the checklist above: recordings set to auto-delete, improvement programs off, camera sharing reviewed, TV recognition off, every account on a unique password with two-factor authentication, old guest access removed. Put a yearly repeat on the calendar, because devices get replaced, defaults reset with updates, and new gadgets arrive as gifts with their settings at factory generosity. Twenty minutes a year is the entire price of turning “my house is probably listening” into knowing what each device keeps, and choosing it yourself. That shift — from vague worry to an itemized, managed list — is what privacy in a smart home actually looks like.
