Count the things in your house that can sense you. The thermostat that knows when you’re in. The doorbell that sees the postman before you do. The telly that knows you watched three episodes of a police drama on a Tuesday. The watch that clocked your bad night’s sleep before you’d finished the first coffee.
Most of us bought these gadgets one at a time, for one sensible reason each. Put them all together, though, and you’re living inside a sensor network. It’s very good at noticing you, and it doesn’t always tell you what it’s noticed. So here’s what that network actually does, what the law now says about it and how to make sure it’s working for you rather than for someone else.
What is the internet of things, in plain English?
The internet of things, or IoT, is the industry’s clunky name for everyday objects that have a sensor, a small computer and a network connection. The sensor measures something (temperature, movement, light, sound, vibration, location). The computer decides what that reading means. The connection sends it somewhere, usually to an app on your phone and a server owned by the manufacturer.
None of the parts are new. Burglar alarms have used passive infrared motion detectors (they spot body heat moving across a room) since before most of us had a mortgage. What changed is that the parts became cheap enough to go into a £20 smart plug and connected enough to report back all day, every day.
The result is hard to see, which is rather the point. Your car is full of sensors. So is the motorway it drives on, the lift in your office and the factory that made your washing machine, where vibration sensors on the machinery warn engineers that a bearing is about to fail before it actually does. That last one, known as predictive maintenance, is one of the least glamorous and most useful things IoT does. It saves money, it prevents breakdowns and nobody’s privacy suffers.
The smart home: helpful, nosy, or both?
At home the trade is more personal. A smart thermostat that learns your routine can trim your heating bill. A video doorbell can save you a wasted trip to the sorting office. A connected smoke alarm that pings your phone when you’re away is genuinely reassuring.
But every one of those benefits depends on the device building up a picture of your life. When you’re in, when you’re out, when you go to bed, who comes to the door. On its own, each scrap of data is harmless. Put together and kept on someone else’s server, it’s a pretty detailed diary.
A sensor doesn’t have to be clever to be revealing. It just has to be patient.
Doorbell and security cameras deserve a special mention. If yours films beyond your property line, over the street or into next door’s garden, UK GDPR can apply to you as well as to the manufacturer. A county court found in 2021 that a homeowner’s cameras had breached a neighbour’s data protection rights. The fix is boring: angle the camera at your own front path, use the privacy masking most apps offer and put up a sign.
Are smart devices safe from hackers now?
Safer than they were, and that’s thanks to the law rather than any sudden attack of conscience in the industry. For years, cheap connected gadgets shipped with factory passwords such as admin or 12345, which were printed in manuals and easy to find online. In 2016 the Mirai botnet (a network of hijacked devices controlled by criminals) took over huge numbers of cameras and routers that way and used them to knock major websites offline.
Since 29 April 2024, the Product Security and Telecommunications Infrastructure regime, known as PSTI, has applied across the whole UK. It sets three basic rules for consumer smart devices sold here. They can’t come with a universal default or easily guessed password: each one needs a unique password, or you set your own when you first switch it on. The manufacturer has to publish a way to report security flaws. And it has to say how long the product will get security updates.
The National Cyber Security Centre says the rules cover smart speakers, TVs and streaming sticks, doorbells, baby monitors and security cameras, phones, tablets and games consoles, wearables, and smart appliances from light bulbs and plugs to kettles, thermostats and fridges. Some things are exempt, including desktop and laptop computers, smart meters, medical devices and some vehicles, because other rules cover them. Firms that break the rules can be fined up to £10 million or 4% of their worldwide turnover.
It’s worth keeping this in proportion. PSTI is a minimum standard, not a guarantee. It stops the laziest failures. It doesn’t make a badly designed gadget secure, and it says nothing about how much data a device collects or what the company does with it. That’s a matter for data protection law.
How do I check what my smart devices are collecting?
Start with an audit. Log in to your broadband router’s admin page, or open your provider’s app, and look at the list of connected devices. Most people find one or two they’d forgotten about. If you can’t identify something, find out what it is before you do anything else.
Next, go through the app for each device and look at the privacy settings. Turn off anything you don’t use: voice recordings kept forever, viewing data shared for advertising, location tracking on things that never leave the house. Smart TVs are among the worst offenders. The setting that tracks what you watch often hides under a name like viewing information or content recognition.
Under UK GDPR you also have the right to ask a company for a copy of the personal data it holds on you. This is called a subject access request, and it costs nothing. Ask a doorbell or smart speaker maker for yours. It’s illuminating, and occasionally unnerving.
Before you buy the next gadget
Now that support periods have to be published, use them. Before you buy, check how long the maker promises security updates. A cheap camera that stops getting updates in two years is no bargain if you expected it to last ten. If you can’t find the date, that tells you something too.
Once it’s home, set your own strong password if asked, switch on automatic updates and, if your router allows it, put smart gadgets on a separate guest network. That way, if one is compromised, it can’t easily reach the laptop holding your bank details. When a device goes out of support, replace it, or at least take it offline.
Finally, ask yourself the question the marketing never asks: does this actually need to be connected? A kettle you can boil from bed is a nice party trick. A kettle that phones home is one more thing to patch.
In short
Sensors and connected gadgets now run quietly through your home, your car and the places you work, and most of what they do is useful. Since April 2024, UK law has banned easily guessed default passwords and made manufacturers say how long their devices will get security updates. What a device collects is still largely up to you. Check the support period before you buy, switch off data sharing you don’t need and keep your gadgets updated or unplugged.
Sources
Midcent Tech
Alex Innes explains technology for men 45 and over who have seen every gadget since the ZX Spectrum and are not easily impressed. AI and ChatGPT, phones, cars, the smart home, the subscriptions worth keeping and staying safe online – what it does, whether it's worth the money, and whether you need it at all.
One of Midcent's writers. Spotted something? Write to alex@midcent.uk.
