Where your smart thermostat’s data ends up

A traditional thermostat knows one thing: the temperature of the room it sits in. A cloud-connected smart thermostat knows far more, and sends it continuously to the manufacturer’s servers. That is how the app works, and how the manufacturer offers features such as energy-saving tips or switching to away mode when you leave.

There is nothing illegal about it, and often nothing hidden: it is in the terms of use. But few people read them, and fewer still ask what that data can reveal. Smart thermostat data privacy deserves a closer look, so let’s take one.

What data a thermostat collects

A cloud-connected thermostat typically sends the server, every few minutes:

• the temperature, and often the humidity, of every room with a sensor;
• set points and schedules, and every manual change;
• system status: when it heats, when it stops, for how long;
• presence, if the thermostat has a motion sensor or uses your phone’s location to know when you are home;
• technical data: model, software version, network address, signal quality.

Add the account data: name, email, home address, and sometimes billing details if you use consumption comparison features.

What temperatures reveal

Taken one by one, these are harmless readings. Lined up over time, they say a lot about the lives of the people in the house. From temperatures and system states alone you can tell:

• what time people get up and go to bed, from the morning and evening starts;
• when the house is empty, from daytime set-backs or the presence sensor;
• when people go on holiday, from frost protection mode staying on for days;
• how many people live there and in which rooms, from zone use;
• the condition of the building, from how quickly it cools down.

This is exactly the information a burglar would like to have, and that an insurer or an energy supplier would find interesting. It does not mean it is used that way. It means it exists, and it sits on a server outside the house.

What the terms of use say

Terms of use for cloud home services tend to repeat certain clauses. They are worth looking for before you buy.

• Use to improve the service. Data is used to develop new features and train algorithms. Usually in “anonymised” or “aggregated” form, terms whose meaning varies from one contract to the next.
• Sharing with partners. Energy suppliers, insurers, analytics companies. Often with the user’s consent, sometimes with consent given once and forgotten.
• Retention. How long data is kept, and what happens when you close the account.
• Change of ownership. If the company is sold, the data passes to the new owner.
• Server location. Inside or outside the European Union, with different rules.

Under European law, temperatures linked to an account are personal data, protected by the GDPR. You have the right to know what data is processed, to get a copy and to ask for it to be deleted. It is a useful right, but you need to know whom to ask.

Buildings with many occupants

In a private home the issue concerns one family. In an office, a school or a hotel it concerns employees, students and guests. Room temperatures, combined with presence sensors, show who is there and when.

For whoever manages these buildings, system data becomes third-party personal data, with everything that entails: privacy notices, data processors, supplier contracts. A system that sends everything to an external server adds a supplier to the chain. A local system shortens it.

The local alternative

A local control system keeps data where it is created: in the building. Temperatures are read, used for control and stored on a controller in the panel. The app reads them from there, at home or from outside through a private network, as we explained in the article on remote access without the cloud.

That does not mean giving up data: in fact, with a local system you can keep more of it, in more detail, because the storage is yours. It means you decide whether, when and with whom to share it. For example with an energy manager for an energy audit, exporting only what is needed.

This is the principle Brick is built on, and one of the reasons we chose home automation without the cloud: data stays exclusively available to whoever uses the system.

If you already have a smart thermostat

There is no need to throw away a thermostat that works. A few steps reduce the data leaving the house.

• Review the privacy settings in the app. Many sharing features, such as energy supplier programmes or “service improvement”, can be switched off.
• Turn off geolocation if you don’t really use it. It is the most personal data of all, and the feature that uses it can often be replaced by a well-designed schedule.
• Ask for a copy of your data. It is a right under the GDPR, and seeing what the file contains is the quickest way to understand what the service collects.
• Check whether a local integration exists. Some thermostats can be controlled from Home Assistant directly over the home network, without going through the cloud. Then the thermostat can stay, and the manufacturer’s app becomes optional.

When the time comes to upgrade the system, the choice of a local system can then be made calmly, knowing exactly what you gain.

Three questions to ask the seller

Before choosing a thermostat or a control system, three questions help you find out where the data will end up.

1. Where is the data stored, and for how long? A precise answer, naming the country of the servers, is a good sign. “In the cloud” is not an answer.
2. Who is it shared with? And can you say no without losing system features?
3. Does the system work without sending data? If control stops without the server, sending data is not a choice but a condition.