, 27 April 2021

Here's our full data privacy scan of the popular IoT gadget

Those of you who have been following along for a while now know that I’m particularly fond of my Google Nest thermostat. While I find most IoT devices to be more hype than reality, the Nest helps me be more environmentally conscious — and makes it super easy to adjust the temperature from bed. (I’m a hot sleeper.) So, yeah, I’m pretty pro-Nest thermostat.

When I took a quick look at my Nest last year during my inventory of the IoT devices in my home, I decided that I was pretty okay with the data they were collecting and what they were doing with it. But I thought it would be a good idea to give it the full What Does the Internet Know About Me? treatment. So here it is: What does Google Nest thermostat know about me? Will it stand up to scrutiny? Stay tuned to find out.

What does Google Nest know about me?

Nest has multiple products, but they all collect pretty much the same information. For the Nest thermostat, they know the setup info I gave them; environmental data from the sensors; any direct adjustments we make to it; heating and cooling usage info; and technical information — including model and serial number, software version, and technical information such as sensor status, Wi-Fi connectivity, and battery charge level. They also know when I’m home or not home, if I allow that function.

No surprises there, right? They collect information about my home that make it possible to heat and cool it and control the thermostat from afar. Basically, just the info that they need to function. 

What does Google Nest do with my data? 

Nest uses the data primarily to provide and improve the services they’ve promised — aka my smart thermostat. They also “may” use de-identified information for “research purposes” and to help them “make sales, marketing, and business decisions.” Sometimes they use service providers to help them with those tasks, but those people aren’t allowed to use that information for anything other than the task at hand. 

Most importantly, one thing Google Nest doesn’t do is sell information to third party marketers. That means whatever information they have about me stays within their own ecosystem. I don’t have to worry that data brokers are combining information about how warm or cold my house is with like, information about my snack preferences or something. (I really don’t need ads trying to serve me up cold weather junk food, thanks.) 

Here’s what the Nest Privacy Policy has to say about it:

“Under no circumstance do we share personal information for any commercial or marketing purpose unrelated to the activation and delivery of Nest Products and services without asking you first. Period. We do not rent or sell our customer lists.”

If I were in Europe, Nest would want me to know that the only time they’d process my data — outside of processing it to provide the service I’ve asked for — is when “responding to a legal process or an enforceable governmental request.” In other words, they’re keeping it under wraps unless they’re legally obligated to share. 

What am I getting in exchange for my data? What are the tradeoffs? 

Honestly, I’m not even sure we need this section for this particular product! I think that their Privacy Policy is really clear and non-technical, which is always a plus in my book. They also are super direct about not renting or sharing customer data, which is awesome. And I can control my thermostat from my couch, rather than having to hop up from my comfy nest and walk four steps to change it. It’s all a win to me!