We’re researchers from the Mozilla Foundation. We spent almost 1000 hours researching the privacy and security of this year’s most popular connected gifts to find out which ones are creepy and which ones aren’t. Ask us anything!

Beyond airdropping links to the Privacy Not Included guide onto our unsuspecting neighbors' phones, what can we do to protect ourselves from all the Ring cameras everyone else is installing? Is this a call-your-congressperson sort of a situation, or is consumer pressure the only real way to influence companies to do better?

There was a really interesting court case in the UK recently where a woman sued her neighbor who installed a Ring doorbell camera. It seems the device could not only see her, but it could hear her too. She asked him to remove it or move it and he declined. She sued him and won. https://www.theguardian.com/uk-news/2021/oct/14/amazon-asks-ring-owners-to-respect-privacy-after-court-rules-usage-broke-law

Would that work here in the US. Who knows, maybe not. But it’s an interesting precedent. Consumer pressure is always going to be faster than political policy too. The idea that a video doorbell could listen into you rather than just see you is super creepy. It’s one thing to be seen coming and going in your home. It’s another thing to have conversations eavesdropped on in your home. Right now, there’s not too much consumers can do other than ask their neighbors nicely to not spy on them. That’s probably not going to work. The UK lawsuit though, that’s something to keep an eye on.

- JEN C

What are some of the strangest things that had horrible privacy issues?

Home exercise equipment! Holy cow, that’s a whole category of consumer tech that seems to currently be doing a pretty bad job at privacy. Which sucks for all those people hoping to work out in the privacy of their own home. Peloton, NordicTrack, SoulCycle, Tonal. All of these products earned our *Privacy Not Included warning label. Mostly because they seem to want to collect as much data on users as possible and use that data to sell, share, or combine with other personal information to sell you more stuff. It kinda reminds me of where the streaming TV space was a couple of years ago where companies like Roku wanted to collect as much personal information on users as possible to make more money selling/sharing it. Home exercise equipment blew up during the pandemic and it seems data protections didn’t keep pace in that space. And given the kinds of personal information these devices can collect, it all feels really creepy

-JEN C

It's creepiest that we needed someone who studied this for 1000 hours to find this out.

We agree

What kind of data?

Good question. Geolocation data, social media data, health and exercise data, including sleep and nutritional data or other physical patterns or rhythms from your workouts or fitness goals, identity data like name and address, financial data, contact data like email and address. Soooo much data is being collected. Also, the data they collect isn’t limited to what you give them. These companies may also go out and gather information on you from third parties like data brokers and public sources so they can know more about your interests and education and such. Yeah, like we said, it’s creepy.

-JEN C & MISHA R

Are there any brands that are generally best to stay away from?

Absolutely! Facebook tops my list. They just have such a terrible track record of collecting so much data, using that data for questionable purposes, and not doing a great job of protecting and securing that data and being honest with users about that.

The Amazon products with Alexa built in worry us too, because we have too many questions and concerns about how some of the data, especially from third party Skills (those little Alexa widgets anyone with the know-how can make), is being collected, stored, and used.

You can see all the products we slapped with our *Privacy Not Included warning labels at privacynotincluded.org (just click the little *privacy not included checkbox to see them all). -JEN C

Big fan of the product guide. Overall do you notice if companies are getting better at protecting privacy? Or worse, and is all hope lost?

Hey u/Ecks_! Thanks for the question. All hope is NOT quite lost! We hope. We’re seeing companies getting better at security...kinda. Almost every company we reviewed meets our Minimum Security Standards. BUT, and it’s a big but, companies are also collecting tons more data these days and using it in all sorts of questionable ways like selling to data brokers or using it to build huge profiles on you to sell you more stuff. That, coupled with the fact that nearly all companies have had some sort of data leak or security vulnerability. So, we would say, privacy is not getting better. And companies are asking consumers to take on too much responsibility to protect themselves. But, we can hold them accountable with our money. Don’t buy from the bad companies, buy from the good ones! 

- JEN C

Mozilla itself collects data for studies, marketing etc. How is it different from the data collected by Amazon, Google, fb?

Great question. The first and biggest difference is, Mozilla is a non-profit organization, whereas Google and Amazon are corporations. Their goal is to make money for their shareholders. Our mission is to make the internet better. Mozilla believes in what we call Lean Data Practices. That means we only collect what little data is necessary, we protect that data, and we empower users to have control over that data. You can learn more about our lean data practices below. Trust us, Google and Amazon and Facebook and others DO NOT follow lean data practices.

-JEN C

https://www.mozilla.org/about/policy/lean-data/

https://blog.mozilla.org/netpolicy/2020/08/20/practicing-lean-data-and-defending-lean-data/

How much does a new car spy on you?

Great question! We haven’t researched cars yet, but it’s on our list for the future. From what we are hearing, it could be quite a lot. That’s creepy for sure.

-JEN C

The main concern about cars lies more in security & safety than in privacy. It is not much fun when a car collects tons of data on you and shares with someone to target you ads - but it is definitely much less fun if your car is hacked and someone takes control of your braking and steering systems (as was demonstrated already in 2016: https://www.theverge.com/2016/8/2/12353186/car-hack-jeep-cherokee-vulnerability-miller-valasek )

-MISHA R

What was the most obvious vulnerability found that left you kinda scratching your head?

Onyx Boox left us confused. To start with, it is hard to figure out what is an original product page, and what is a fake. There are multiple websites that claim to sell these eReaders. Make sure you’re buying from the actual Chinese company’s website -- shop.boox.com -- and not a questionable Russian (?) reseller site like onyxboox.com. We could find no proof of minimum security standards for this eReader: encryption, password or security updates might not happen there.

In 2020, a Reddit user posted photos (https://www.reddit.com/r/ereader/comments/j66beo/huge_onyx_boox_s_privacy_concern/) of the policy he said he had to agree with to update his Onyx device. And there are plenty of things to worry about: according to the photo of the policy, Onyx collects a lot of data from your device, and the data can be used whenever the company believes 'it is necessary for the purposes of the legitimate interests pursued by Onyx." We would love to look closer if things changed in 2021, but unfortunately, we could find no product privacy policy publicly available. And though Reddit is cool, we also believe that users do not necessarily have to go there to check how their data is treated.

This said, lots of products do not have an easily available privacy policy. That is the most obvious and quick-to-spot vulnerability. And it must not happen in 2021.

-MISHA R

In terms of alternatives—did you find anything troubling from kobo ereaders?

Kobo eReaders are better. But we have concerns about them, too. For instance, no data retention details are mentioned by Kobo. Data deletion policies are mentioned only for European Economic Area and California citizens. Kobo can also share your data for purposes that include marketing. In terms of alternatives, we highly recommend PocketBook. Pocketbook says they do not collect any personal identity information on their users. Which means they can’t share it either, because they don’t collect it. That’s great!

-MISHA R

Ok if you had to pick for me - which fitness watch should I get?

I bought myself a Garmin fitness watch last year and so far, I love it. Garmin seems to do a good job of protecting and securing all the crazy intimate personal data these devices collect. And they’ve had no known security breaches in the past three years. They did suffer a ransomware attack last year, but no personal data was compromised in that attack. It also seems like the Whoop Strap and the Oura Ring do a pretty good job with privacy too. Oh, and the Apple Watch is a good bet. All in all, just know all these devices collect a ton of sensitive data and if that data is compromised, well, yikes! And beware of ever sharing this data with third parties outside of the fitness tracker maker. Those third parties will have their own privacy policies and it’s also one more place this data will go where it can be compromised.

-JEN C

So I have a google home device.

Should I, as an average boring bloke in the UK, actually be worried about using it?

Hey u/theartofrolling! I actually have a few Google Home devices too. They are a little bit creepy for sure. But overall, you’re probably OK. Google lets you delete your requests by saying, “Hey Google, delete what I just said.” or “Hey Google, delete this week’s activity.” And Google, while certainly not great, also does seem to do a little better job than Facebook and Amazon at protecting your personal information. All in all, maybe just don’t tell your Google Home device all your deepest darkest secrets and you should hopefully be OK. But, you know, nothing on the internet is ever 100% private, so know your comfort level and proceed accordingly. That’s what I do.

-JEN C

Not a surprise Facebook and Amazon is garbage tier in terms of privacy. Does it matter which region you use the products in.. say strict information privacy laws in Germany? I remember differences in What's App.

Insight into Steam would also be interesting. I know a lot of people that avoid it because of concerns - wonder how well funded they are if one chooses to set everything to private.

Yes, a region makes a difference, often a huge difference! I am also in Germany, and I love GDPR (as well as BDSG). It is a rights-oriented regulation, and we should not be shy to use our rights with any company, especially Facebook and Amazon. If more people would exercise the right for data portability or the right to be forgotten, it could (hopefully) make companies a bit more disciplined with their internal data privacies. This said, forcing the rules can be challenging also in Europe. The data protection authorities are overwhelmed with complaints and thus are slow-to-react. I set a personal rule to request deletion of my personal data after every finished interaction where sensitive data is involved (like recruitment or searching for flats). And my experience so far is discouraging, even with European organizations.

-MISHA R

Talk to us about "Easter Eggs" in Privacy Policies! Any fun / funny examples you've found in all your reading?

We found it very cute how FitBark cares about pets’ data. Their privacy policy starts with “This is how we gather, use, disclose and manage human and doggie info.” That is great, as most devices from the same line only mention human data in their policies.

FitBark also writes “App lockers can provide another level of security for your precious doggy data. https://www.fitbark.com/blog/foolproof-ways-to-protect-your-dogs-digital-privacy/ --> Check out the full blog post if you are concerned about your precious doggy data, too.

-MISHA R

How do you feel about Alexa on Firestick and Fire TV? What can we do to maximize our security and maintain privacy? Aside from buying something new of course.

Hello! Thanks for the great question. In general, using Alexa as little as possible is good for your privacy. There are also several privacy controls for both Alexa and Firesticks that you can check and adjust. We would start with turning off collection of device collection data under Settings > Preferences > Privacy Settings > Device Usage Data. If you turn this setting off, Amazon will stop processing this device usage data for purposes of serving you customized marketing offers and improving our products and features. You should also consider opting out from interest-based ads under Settings > Preferences > Privacy Settings > Interest-based Ads.

You can check more settings under https://www.amazon.com/gp/help/customer/display.html?nodeId=GQFYXZHZB2H629WN

Finally, we recommend setting up an automatic deletion of Alexa voice recordings. For that, go to the Alexa Privacy settings page, and select Manage your Alexa data. Click on the Automatically delete recordings setting there. You can read more about Alexa privacy settings here: https://www.amazon.com/gp/help/customer/display.html?nodeId=GPGRYRZ494GDFPZ2

-MISHA R

Can I piggy back off this and ask your thoughts on Apples version of all this. Siri. Home kit.

Apple is better. In June 2021, Apple announced that it will no longer send Siri requests to its servers, but instead will process them at the device level. That is a wonderful best practice, and it is long due. (https://www.theguardian.com/technology/2021/jun/07/apple-overhauls-siri-to-address-privacy-concerns-and-improve-performance)

With Alexa, even when audio or text records are deleted, Amazon may still retain other data concerning your interactions, such as all records of actions Alexa took in response to your request. So there is really no way to make Amazon forget what you have said. And what you’ve said, may be used for targeting you with ads.

-MISHA R

Ok so this is a little off-topic, but my brother has intentionally trained his Alexa to recognize only mispronounced words: LAYATES OON instead of LIGHTS ON for instance.

This is funny (to him, not his wife), but also has a secondary reaction of intentionally skewing Alexa's AI algorithms and how it understands human input and behavior. Something that computers can't really pick up on (yet) is malicious human behavior. My brother is essentially breaking the device's functionality and ability to invade his privacy by using its own privacy-destroying programming against it.

Another way of thinking about it would be as privacy camouflage.

I know this is kind of an obtuse topic, but is there anything similar being done to counteract privacy invading device's?

Hmmm...interesting question. Also, I’m sorry to your brother’s wife because that sounds super annoying. And we’re not sure it’s really effective. Just because your brother asks Alexa to turn the lights on in funny ways, Alexa still knows that their lights are being turned on. And this could also help train Amazon’s Alexa AI to understand different voices and accents and sayings (check out our Common Voice project here). Unfortunately, there’s just not much transparency in AI these days to know of ways to help protect your privacy, as far as we can tell.

- JEN C

The only way to counteract a privacy-invading device is most probably not talking to it at all. Talking to it in any way will always make it smarter, from what we can see. -MISHA R

What privacy tips would you give people? If possible, ranging/sorting these tips from beginner to advanced?

Best tip is, don’t buy devices from companies with a terrible track record of collecting, protecting, and using/selling/sharing your data. For example, Apple isn’t perfect, but it’s better than Facebook. Consumers can and should vote with their dollars. That is the thing companies understand most.

Next tip, while reading privacy policies is boring as heck (trust us), you don’t have to read them all the way through to know if they are bad. Do a search (control F) in the privacy policy for words like SELL to see if the companies sell your data, or SHARE to see who they might share your data with. If you feel creeped out (and you will), skip the company’s product and find a better one.

Little things like using local storage for security cameras on an SD card rather than storing your video in the Cloud is a great way to keep your data a little safer.

And lock down those privacy settings on everything you buy. It’s time-consuming and confusing and you, as the consumer will have to opt-out of more stuff than you want because the companies put the onus on you to protect yourself, which really sucks. Companies need to do better.

- JEN C

It’s our first Christmas buying presents as parents! I was looking at the Amazon kitchen for kids, but it may not be the best. Are there any specific brands you’d recommend that are better for kids?

Yes! iRobot, the maker of those Roomba robot vacuum cleaners, actually makes a coding kit for kids called Root that looks really cool. And iRobot is a great company that really seems to take privacy and security seriously. We have concerns about the Amazon Kids devices with Alexa built-in. But, a regular old eReader like the Amazon Kindle for Kids or the Pocketbook eReader seems pretty safe. Nintendo Switch seems like a pretty decent gaming platform option. And Parrot is a French drone maker that takes privacy seriously if you’re considering a drone as a gift. All in all though, do kids really need toys that connect to the internet? I mean, they probably already play with phones and tablets, so getting them some Legos or a cool remote control car or even some old fashion books seems to be a great idea to us. -JEN C

Misha here! Here’s an idea. Go through the closest of your grandparents or aunts and uncles to find some old school toys to regift. It’s great for privacy and it’s great for the environment too! -MISHA R

Are there any issues with robot vacuum cleaners?

Hey u/whidzee - thanks for the question! We do have concerns with some robot vacuum cleaners. There is a range with these types of vacuums. Some are dumb and just vacuum your house without using WiFi or collecting data. Others come with cameras and microphones built in and are marketed as a rover surveillance device as well as a robot vacuum (there is an Ecovacs Deebot model that does this). So, if you want a robot vacuum, it’s good to do your research and determine what you really need it to do. Does it need to be connected to the internet? If so, then look at what companies are good. iRobot Roombas made our Best Of list because they seem to take privacy quite seriously. As for a robot vacuum that roams your house with a camera and microphone, yeah, that seems like a potential privacy nightmare.

-JEN C

Why do you think this is a valuable and important privacy area to study? There are lots of area of privacy that need attention, why choose this one to spend your time on?

Are you asking why researching consumer privacy in connected devices is important? I’d say it’s because it affects all of us. There are billions of connected devices in the world. The average home in the US has upwards of 25 connected devices. That’s bonkers when you think of all the data being collected and share on us these days. Someone the other day told me a factoid that voice biometric data can be used to tell how tall a person is within just a few centimeters. And our fitness trackers can now tell if we’re drunk and are even learning about our emotional states. This just feels important for people to know so they can understand how their privacy is slipping away and maybe someday, take action. Privacy is still important to us humans, even if we’re not quite sure how to protect it.

-JEN C

Why is the Garmin Vivoactive in the “not creepy” category while the Garmin Venu is in the “slightly creepy” category? My understanding is those are basically identical products except for the display technology used.

You are correct, they both fall under Garmin’s privacy policies and track record. The Creep-O-Meter rating you are seeing there is done by readers of the guide, not us. So, for some reason, our readers rated the Venu slightly creepier than the Vivoactive. In reality, they are both pretty much the same.

-JEN C.

How come that so many people still flock to the really creepy products from your list? Is it usually that the company adds bad data practices when their products are doing well or is there just so little data protection to begin with?

It feels like the biggest reason is that most people are price-driven. They want to pay less for certain functionality. But we saw the most affordable products are usually also the murkiest in data handling. They either use selling/sharing of data as an additional source of revenue to compensate for lower product price, or save on security measures and bug bounties, or both. In contrast, good privacy practices usually come with higher costs. An analogy would be the ‘bio’ line of products at the supermarket. Of course, privacy must not be a luxury: that is why we support strong regulations like GDPR and CCPA.

In general, I did not notice companies adding bad data practices only after a product became popular. There are a few exceptions like WhatsApp, but in general my assumption is that security and privacy standards should improve over time (albeit not fast enough to compensate for improvement in surveillance & hacking technologies, too). If you have more examples, please share them! We would love to challenge that assumption.

-MISHA R

I have a question, although probably too late: how can I rate the privacy policies of something like Steam or Epic Games Laucher software platform?

According to the wonderful PrivacySpy project, Epic Games' privacy policy is not entirely privacy-friendly. It received just 2.2 out of 10. You can look deeper here: https://privacyspy.org/product/epic-games/

-MISHA R

Q1: How is Apple's privacy situation? A lot of people in the privacy community like them, but at the end of the day their software is close sourced. We don't know what data the are collecting from us.

Q2: Are smart watches privacy nightmare? Should we use them? If I don't connect the device to my phone will it still track me?

(1) They detail the data collected in their privacy policy (https://www.apple.com/legal/privacy/), and I doubt that a company like Apple would risk violating its own privacy policy in such an egregious way as to secretly collect personal data.

This said, open-source definitely rocks and proprietary causes many questions, incl. on privacy. It is so unfortunate that many companies still do not go open source.

(2) Not all smart watches are created equal. Some are a privacy nightmare. Some are just questionable. Some received our ‘Best of’ label. You can check in more detail in our *Privacy Not Included guide: https://foundation.mozilla.org/en/privacynotincluded/categories/wearables/

-MISHA R

What's the last item you would have expected to be privacy unfriendly that virtually every one owns?

Alexa- and Google Assistant-controlled devices are all not entirely privacy-friendly. The same goes for Facebook log-in functions and Android devices.

-MISHA R

Which interactive children's toys should we steer clear of?

The Amazon Alexa Kids toys concern us because we aren’t 100% sure about their data collection and sharing methods, especially with Skills. iRobot’s Root toy looks good and they seem to do a good job. Mostly though, do kids need interactive toys? That’s something we’re still struggling with. Going old school here seems best most days. We’re privacy researchers though, so that’s us maybe knowing too much for our own good.

-JEN C