Source-linked AI summary
User Perceptions of Smart Home IoT Privacy
Serena Zheng, Noah Apthorpe, Marshini Chetty, Nick Feamster
TL;DR
Smart home IoT devices increasingly collect and upload private data, but users’ understanding of privacy implications and external access remains limited. The paper uses eleven semi-structured interviews with smart home owners to study these perceptions and behaviors. It finds that convenience, connectedness, perceived benefits, manufacturer trust, and unrecognized inference risks shape privacy expectations, motivating lower-burden privacy controls and clearer protections.
Problem
As smart home devices upload more private data to the cloud, users face unclear answers about collection, storage, ownership, access, and use amid minimal regulations or standards.
Method
The authors conducted eleven semi-structured interviews with U.S. smart home owners about device experiences, privacy awareness, concerns, trade-offs, and protective actions.
Results
Users prioritized convenience and connectedness, judged data sharing by perceived benefits, trusted manufacturers without verification, and overlooked inference risks from non-audio/visual data.
Takeaways & Limitations
The findings support privacy features and notifications that reduce user effort and better match smart home owners’ expectations and preferences.
Takeaways & Limitations
The small interview sample is not representative of all IoT users, and the recommendations should be interpreted in the United States context.
Abstract
from arXiv · showhide
Smart home Internet of Things (IoT) devices are rapidly increasing in popularity, with more households including Internet-connected devices that continuously monitor user activities. In this study, we conduct eleven semi-structured interviews with smart home owners, investigating their reasons for purchasing IoT devices, perceptions of smart home privacy risks, and actions taken to protect their privacy from those external to the home who create, manage, track, or regulate IoT devices and/or their data. We note several recurring themes. First, users' desires for convenience and connectedness dictate their privacy-related behaviors for dealing with external entities, such as device manufacturers, Internet Service Providers, governments, and advertisers. Second, user opinions about external entities collecting smart home data depend on perceived benefit from these entities. Third, users trust IoT device manufacturers to protect their privacy but do not verify that these protections are in place. Fourth, users are unaware of privacy risks from inference algorithms operating on data from non-audio/visual devices. These findings motivate several recommendations for device designers, researchers, and industry standards to better match device privacy features to the expectations and preferences of smart home owners.
1 INTRODUCTION
The paper examines how smart home owners perceive privacy risks involving external entities and how those perceptions shape privacy-related behavior. Eleven semi-structured interviews reveal that convenience, connectedness, perceived benefits, manufacturer trust, and limited awareness of inference risks are central themes motivating design and policy recommendations.
- Study focus: Eleven semi-structured interviews with smart home owners examined device adoption, privacy perceptions, and actions involving external entities.Participants discussed privacy awareness, concerns, device use cases, and protective behaviors.
- Recurring themes: Convenience and connectedness were primary reasons for adopting IoT devices and for disregarding personal privacy concerns.The authors describe convenience as a recurring justification for sacrificing privacy among IoT owners.
- Recurring themes: Users considered data sharing more permissible when external entities were perceived to provide tangible benefits to themselves or their families.Manufacturers offering updates and new features were least concerning, while opinions about advertisers and governments varied with perceived benefits; ISPs were uniformly distrusted.
- Recurring themes: Participants generally trusted well-known IoT manufacturers to protect privacy but did not verify whether adequate protections were actually in place.Brand familiarity and reputation influenced purchasing decisions and confidence in privacy protections.
- Recurring themes: Users were unaware that machine-learning inference from non-audio/visual data could reveal sensitive information such as sleep patterns and home occupancy.The paper identifies this lack of concern about inference-based privacy risks as evidence not reported in prior work.
- Implications: The authors recommend easier privacy controls, collection notifications for screenless devices, centralized hub controls, and certification of device privacy features.These recommendations aim to reduce the burden placed on users by the current U.S. consumer IoT market model.
2 RELATED WORK
Prior work documents technical attacks, design challenges, proposed privacy solutions, and user concerns about connected devices. This paper extends that literature with qualitative evidence from people who independently incorporated diverse IoT devices into their homes, focusing on external entities and situated privacy perceptions.
- Existing research: Prior research has identified smart home privacy challenges, attacks that infer users and behaviors, and technical or sociotechnical solutions.Proposals include design frameworks, data management, visualization, and network-level approaches.
- Research setting: Most experimental IoT privacy studies used temporary or laboratory settings because long-term household ownership was previously uncommon.The authors position their work as examining users with independently chosen, real-world smart home devices.
- Existing research: Survey research reports widespread concern about connected devices, including safety concerns among over 60% of worldwide respondents.Other surveys found especially strong concern among American users about Internet-connected devices.
- Related interview studies: Concurrent interview research likewise found gaps in users’ understanding of IoT threat models and identified social issues in multi-user smart homes.Those social issues were not expressed by this study’s participants, motivating continued research into varied user experiences.
- This study: This study contributes evidence about privacy and security perceptions for diverse IoT devices among users who independently adopted them at home.Its focus is on external entities that create, track, and regulate IoT devices or data, while recognizing that privacy is situated in household contexts.
3 INTERVIEW METHOD
The study used semi-structured interviews with eleven U.S. smart home owners to investigate device use, privacy awareness, concerns, trade-offs, and protective actions. Researchers recruited households with varied devices, conducted home tours and interviews, and analyzed transcripts through structured analysis and open coding.
- Participants: The recruitment process selected eight households with more than two devices to maximize the variety of device types represented.Recruitment used local flyers, listservs, and word of mouth without mentioning privacy or security.
- Participants: Participants included six women and five men aged 23–45, with households representing families, couples, and roommates.Most households were located in the Seattle metropolitan area, with others in New Jersey, Colorado, and Texas.
- Participants: The participant pool was fairly affluent, technically skilled, and highly interested in new technology, fitting an early-adopter profile.Seven of eight households had at least one resident with computer science or technology-industry experience.
- Interview procedure: Interviews combined smart-home tours with semi-structured discussions about device experiences, adoption reasons, data collection, privacy concerns, trade-offs, and protective actions.The interviewer followed up on topics that arose naturally and varied across households, participants, and devices.
- Analysis: Researchers transcribed recordings, analyzed answers to structured questions, and used iterative open coding to identify emergent themes.Codes began with interview questions and expanded through analysis.
4 LIMITATIONS
The study’s conclusions are constrained by its small, nonrepresentative participant pool, U.S.-specific setting, overlapping privacy and security influences, and focus on external rather than in-home threats. The authors caution that in-home privacy risks, especially for vulnerable people, require targeted research.
- Scope: The eleven-household interview sample is limited and should not be treated as representative of all IoT device users.The authors state that follow-up studies should address this limitation.
- Study focus: The study focused on external threats because participants did not raise concerns about privacy violations or malicious behavior between household members.The authors explicitly caution that this lack of concern does not represent all connected-device user experiences.
- Geographic scope: All participants lived in the United States, so the findings and recommendations reflect American privacy perspectives rather than global user concerns.The authors note that users in other regions may differ and recommend studies in additional world regions.
- Interpretive scope: Participants’ responses reflected intertwined impressions of device security, safety, and social-order norms in addition to privacy.Additional research is needed to separate the relative contributions of these overlapping values.
5 RESULTS
Interviews identified four recurring themes in smart home owners’ privacy expectations and behaviors: convenience and connectedness, perceived benefit, manufacturer trust, and skepticism about non-audio/visual risks.
- Convenience and connectedness dictate owners’ privacy expectations and behaviors.
- Perceived benefit shapes opinions about who should access smart home data.
- Trust in device manufacturers and brand reputation influence purchasing behavior and privacy assumptions.
- Users are skeptical of privacy risks from non-audio/visual devices.
5.1 Convenience and Connectedness are Priorities
Participants prioritized the convenience and connectedness provided by smart home devices, often accepting privacy, security, and obsolescence concerns in exchange for easier, more seamless lives.
- Convenience was a major reason participants purchased smart home devices.Participants also valued staying connected to their homes, families, and pets.
- Smart home devices supported connectedness by enabling remote awareness of household members and activities.Participants described checking devices as a way to feel close to family when away.
- Convenience and connectedness outweighed concerns about device obsolescence and security issues.One participant considered replacing an obsolete device worthwhile because of its convenience, while another said peace of mind outweighed hacking worries.
- Participants were willing to trade privacy for convenient, seamless experiences.They described accepting some privacy loss because smart home features made life easier.
- Participants generally valued convenience and connectedness more than knowing and controlling where smart home data goes.
5.2 Opinions about Data Access Depend on Perceived Benefit from External Entities
Participants judged external access to smart home data according to perceived benefits, with more acceptance of beneficial uses and strong concern about access by ISPs and government entities.
- Acceptability of smart home data collection depended on perceived benefit to the end user.This pattern held across manufacturers, advertisers, ISPs, and government entities.
- Users’ assessments relied on blurred and stereotyped distinctions among manufacturers, advertisers, ISPs, and government entities.These entities can overlap in roles, and participants’ stereotypes may change when confronted with concrete details.
- Ten of eleven participants accepted manufacturers collecting and analyzing data to improve products and user experiences.Participants generally assumed manufacturers would collect data responsibly, and several preferred anonymized aggregate collection.
- Advertiser access divided participants, with greater comfort when users expected benefits or control over collected data.Six of eleven participants did not mind advertiser access because they valued targeted or improved advertising experiences.
- All participants opposed ISP access to smart home data because they viewed it as invasive, unnecessary, and lacking an obvious benefit.Participants were concerned that ISP access was difficult to prevent and preferred ISPs not see their network traffic.
- Participants were most concerned about government access, although perceived benefits could make sharing seem permissible.Most participants associated government use with persecution and framed the concern in terms of civil liberties.
5.3 Trust in Manufacturer Privacy Protections
Participants trusted device brands to protect privacy and used reputation to guide purchases, but generally did not verify that claimed protections were actually in place.
- Brand reputation and company trust strongly influenced participants’ smart home device selections.All participants reported researching devices and ultimately relying on online reviews and brand reputation.
- Participants trusted large technology companies’ technical ability to protect data without confirming encryption or anonymization practices.
- Participants generally took no extra action to verify manufacturers’ privacy protections because they trusted their chosen brands.The study notes that users might instead rely on regulatory agencies if manufacturer trust were breached, given the effort required to configure privacy settings.
- Participants assumed well-known brands included adequate privacy and security protections.They trusted both major technology companies and household appliance or lighting brands, regardless of those brands’ connected-device experience.
5.4 Skepticism of Non-A/V Device Privacy Risks
Participants were more concerned about audio/video devices than non-A/V devices and often viewed innocuous sensor data as non-sensitive. This skepticism overlooked how inference algorithms can derive sensitive information from non-A/V data.
- Participants generally considered audio/video devices more privacy-sensitive than non-A/V devices.
- Several participants expressed little concern about smart lights, plugs, thermostats, or related account data revealing household information.
- Participants were unaware that machine learning could infer sensitive information from in-home temperatures and front-door activity.
- Metadata from non-A/V devices can reveal home occupancy, work routines, and sleeping patterns.
- By dividing data into sensitive and nonsensitive categories without understanding analysis capabilities, participants may jeopardize privacy while believing they are safe.
6 RECOMMENDATIONS
The recommendations aim to reduce the burden of smart home privacy management through clearer controls, centralized mechanisms, better inference awareness, and cross-industry standards. They also recognize that convenience, device proliferation, regulatory fragmentation, and consumer incentives constrain these approaches.
- Smart Home Device Designers: Privacy recommendations should make notifications and settings exceptionally clear and convenient because users prioritize convenience and trust manufacturers.
- Smart Home Device Designers: Visual indicators and mobile applications can communicate privacy states and provide settings for devices, especially those recording voice or video.
- Smart Home Device Designers: Dedicated privacy hubs may be impractical when they require additional setup and maintenance without tangible benefits to users.
- Researchers: Separate applications and simple indicators become ineffective as households accumulate devices or users discount non-A/V privacy risks.
- Researchers: Privacy controls should address inference from domestic sensor data and the difficult-to-anticipate combinations that can enable compromising inferences.
- Researchers: Centralized hubs could control privacy across smart home networks, but this requires shared privacy APIs, meaningful settings, and enforcement mechanisms.
- Regulation, Industry Standards, and Consumer Incentives: Cross-industry certification standards could help consumers evaluate manufacturers’ privacy practices across regulatory divisions.
- Regulation, Industry Standards, and Consumer Incentives: Standardization risks overly prescriptive requirements and depends on consumers caring about certification and learning about privacy safeguards.
7 CONCLUSION
Interviews of smart home owners found that convenience and connectedness shape privacy behavior, while perceived benefits shape views of external data access. Participants trusted manufacturers but overlooked inference risks from non-audio/visual data, motivating clearer controls and broader privacy standards.
- Eleven interviews found that convenience and connectedness shape users’ smart home privacy opinions and behaviors.
- Users’ views about external access to smart home data depend on perceived benefits from entities managing, tracking, creating, or regulating devices and data.
- Users trust IoT manufacturers to protect privacy but remain unaware that machine learning can infer sensitive information from non-audio/visual data.
- The findings suggest improved privacy notifications, user-friendly settings, and industry standards spanning regulatory divisions.