Key Takeaways
- Cloud usage data reveals your routines, presence, and habits
- Voice assistants send recordings to the cloud for processing
- Cloud cameras store footage on vendor servers, often behind a subscription
- Stored data is exposed to breaches and third-party sharing
- Local control keeps data on your hardware and removes the third-party processor
- Local AI (voice and LLM) lets you keep smart features without the cloud
- Local data processing means the hub, voice, and AI run inside your home — and the Echo option to skip the cloud was removed in March 2025
The Real Privacy Risks
The real risks are cloud data collection, always-listening assistants, camera feeds, breaches, and third-party sharing. Each stems from data leaving your home and living on someone else's servers.
- Usage data: device logs reveal when you wake, leave, and return.
- Always-listening assistants: voice queries are processed and may be retained in the cloud.
- Camera feeds: cloud cameras upload footage to vendor servers.
- Breaches and sharing: stored data can be exposed or shared with third parties.
What Each Ecosystem Collects
Cloud-first ecosystems collect more than local ones: usage, voice, and sometimes video; local setups collect none of it off-device. Privacy posture tracks how much runs in the cloud.
- Cloud-first ecosystems (Alexa, Google Home) process voice and store usage data on their servers.
- Apple Home is more privacy-leaning but still cloud-connected for some features.
- Home Assistant keeps data local by default — see smart home ecosystems compared.
Breaches and Exposure
Any data stored on company servers is exposed to breaches, policy changes, and third-party sharing you cannot control. Data a vendor never receives cannot be leaked by that vendor.
- Centralised footage and recordings are attractive breach targets.
- Privacy policies can change, expanding how your data is used.
- Local processing avoids the issue entirely by never sending the data.
Documented Incidents: Alexa, Ring, and Wyze
Three documented cases show the risk is not theoretical: a removed privacy setting, employee access to camera videos, and a caching fault that exposed other users' camera thumbnails. Each involved data held on vendor servers.
- Amazon Echo, 28 March 2025: Amazon removed the "Do Not Send Voice Recordings" option, which existed only on the 4th-generation Echo Dot, Echo Show 10, and Echo Show 15 for US English users. Amazon said fewer than 0.03% of customers used it. AP via NY1
- Ring, May 2023: The FTC alleged that Ring employees and contractors had broad access to customer videos, including one employee who viewed recordings of at least 81 female users. Ring agreed to pay $5.8 million in refunds and denied violating the law. FTC press release
- Wyze, February 2024: After an outage on 16 February, about 13,000 Wyze users received thumbnails from cameras that were not theirs and 1,504 tapped them, according to Wyze, which blamed a third-party caching library. Wyze incident update
What Local Data Processing Means for a Smart Home
Local data processing means the hub, the voice pipeline, and the AI model run on hardware inside your home, so device events and recordings are never sent to a vendor server. It is a choice per component, not an all-or-nothing switch.
Component | Runs locally with | Needs internet? |
|---|---|---|
| Automations and hub | Home Assistant | Only for cloud integrations |
| Devices | Zigbee, Z-Wave, Thread/Matter | No, for local control |
| Voice | Whisper + Piper | No |
| Cameras | Frigate | No (remote view needs VPN) |
| AI assistant | Ollama | No |
A Matter or Zigbee device can still depend on its vendor's cloud if the vendor app routes data through it. Check by blocking the device's internet access at your router and testing whether it still works.
The Fix: Local-First and Local AI
The fix is local control: run the hub, voice, and AI on your own hardware so that little or no data leaves the house. You keep smart features without the third-party processor.
- Move to a local hub and local devices — see the complete local smart home guide.
- Replace cloud voice with a local assistant — see connect Ollama to Home Assistant.
- For the EU/GDPR angle, see building a GDPR-friendly private smart home.
- For private local AI generally, see what local LLMs are (cross-cluster).
Your Data Access Rights in the EU
Since 12 September 2025, the EU Data Act gives users of connected products the right to access the data their devices generate, free of charge, and to have it passed to a third party. It covers smart home devices, speakers, and appliances offered in the EU, wherever the manufacturer is based.
- You can use direct access if the product offers it, or ask the data holder for readily available data without undue delay.
- Products placed on the EU market after 12 September 2026 must allow direct user access where relevant and technically feasible.
- This is an access right, not a ban on collection; GDPR rules on personal data apply separately — see building a GDPR-friendly private smart home. Irish CCPC: EU Data Act
Your Privacy Action Checklist
Reduce risk by replacing the highest-exposure cloud devices with local ones, starting with cameras and voice. Each swap removes a stream of data leaving your home.
Risk | Cloud setup | Local setup |
|---|---|---|
| Voice | Recordings processed in cloud | Local Whisper + Piper, on-device |
| Cameras | Footage on vendor servers | Frigate, footage stays home |
| Usage data | Logged by vendor | Stays on your hub |
| Automations | Run in cloud | Run on local hub |
Frequently Asked Questions
Do smart speakers always listen?
Cloud voice assistants listen for a wake word locally, then send the following audio to the cloud for processing. That means your spoken queries are transmitted and may be retained. A local voice assistant processes everything on your hardware instead.
Where do my camera feeds go?
Cloud cameras upload footage to the vendor's servers, where it is stored and often gated behind a subscription. A local setup with Frigate keeps footage on your own hardware, so by default it stays on your network.
Can I stop the data collection?
For cloud devices, you can limit but rarely eliminate collection through settings. The reliable fix is to switch to local-capable devices and a local hub, so the data is never sent to a vendor in the first place.
Is a local smart home actually private?
Largely, yes. With a local hub, local voice, and local AI, device data, recordings, and automations stay on your hardware with no third-party processor, provided no cloud integrations are enabled. This is what makes a local-first setup private by design.
What does local data processing mean for a smart home?
It means the hub, voice recognition, and AI model run on hardware inside your home, so device events, recordings, and camera footage are processed there instead of on a vendor server. It applies per component: automations, voice, cameras, and AI can each be local or cloud.
Did Amazon remove the option to keep Echo voice recordings off its cloud?
Yes. On 28 March 2025, Amazon removed the "Do Not Send Voice Recordings" setting, which was available only on the 4th-generation Echo Dot, Echo Show 10, and Echo Show 15 for US English users. Amazon said fewer than 0.03% of customers used it.
Does the EU Data Act stop smart home companies from collecting data?
No. Since 12 September 2025 it gives users the right to access the data their connected devices generate and to share it with a third party, but it is an access right, not a ban on collection; GDPR applies separately. Only local processing keeps data from reaching the vendor at all.