What your devices actually collect
Bulbs, plugs and thermostats mostly record states and schedules: when lights go on, how much power a lamp uses, what temperature you like. That still reveals routines, such as when nobody is home, so it deserves protection. Speakers handle voice, and doorbells handle video of people, including visitors who never agreed to be filmed. Those two are where privacy decisions matter most.
Accounts come first
Your smart home is only as safe as the account that controls it. Use a password manager to give each brand a unique, long password, and switch on two-factor authentication everywhere it is offered, preferably with an authenticator app or passkey rather than SMS. Share access through the app's household or family feature instead of handing out your own login, so you can remove a former flatmate in seconds.
Your network
Keep router firmware updated and use WPA3 or at least WPA2 security. Many routers offer a guest or IoT network; putting smart devices there keeps them apart from the laptops holding your documents, though some features like casting may need the main network. Change the router's admin password if it still uses the sticker default.
Microphones
Speakers listen locally for their wake word and send audio to the company's servers after detecting it. Accidental activations happen. Each starter speaker has a physical mute control, and each platform lets you review and auto-delete recordings: Alexa Privacy settings, Google My Activity and Siri history in Apple settings. A mic-free bedroom is a perfectly reasonable choice.
Cameras and the law
In the UK, the Information Commissioner's Office (ICO) explains that domestic cameras capturing images beyond your boundary, such as a shared path or the street, bring obligations under UK GDPR and the Data Protection Act 2018. The 2021 case Fairhurst v Woodard, heard at Oxford County Court, found a homeowner's doorbell and cameras breached data protection law and contributed to harassment. In the EU, the Court of Justice's Ryneš ruling (2014) similarly limited the household exemption for cameras covering public space. The practical answer: aim at your own doorstep, use privacy zones, tell neighbours, and keep clips briefly.
Security labels worth knowing
The UK Product Security and Telecommunications Infrastructure (PSTI) regime, in force since 29 April 2024, bans universal default passwords and requires makers to publish a vulnerability reporting contact and a minimum security update period. In the US, the FCC's voluntary U.S. Cyber Trust Mark identifies devices meeting baseline cybersecurity criteria. The European standard ETSI EN 303 645 underpins many of these rules, and the EU Cyber Resilience Act will add mandatory requirements for connected products over the coming years. Check the stated support period before you buy.
Your step-by-step checklist
Before buying
Check the security update period, whether local storage or end-to-end encryption is offered, and whether core features need a subscription.
During setup
Unique password, two-factor authentication, guest network if suitable, latest firmware installed straight away.
For the doorbell
Privacy zones on, motion zones narrowed, audio recording only if needed, shortest practical retention, E2EE where available.
Every few months
Review shared users, delete old voice and video history, install updates, and remove devices you no longer use.
When you move or sell
Remove each device from your account, then factory reset it. A thermostat or doorbell left linked to your account is a privacy leak for you and the next resident.