Smart Home Privacy Policies Demystified: A Study of Availability, Content, and Coverage

Authors: 

Sunil Manandhar and Kaushal Kafle, William & Mary; Benjamin Andow, Google LLC; Kapil Singh, IBM T.J. Watson Research Center; Adwait Nadkarni, William & Mary

Abstract: 

Smart home devices transmit highly sensitive usage information to servers owned by vendors or third-parties as part of their core functionality. Hence, it is necessary to provide users with the context in which their device data is collected and shared, to enable them to weigh the benefits of deploying smart home technology against the resulting loss of privacy. As privacy policies are generally expected to precisely convey this information, we perform a systematic and data-driven analysis of the current state of smart home privacy policies, with a particular focus on three key questions: (1) how hard privacy policies are for consumers to obtain, (2) how existing policies describe the collection and sharing of device data, and (3) how accurate these descriptions are when compared to information derived from alternate sources. Our analysis of 596 smart home vendors, affecting 2, 442 smart home devices yields 17 findings that impact millions of users, demonstrate gaps in existing smart home privacy policies, as well as challenges and opportunities for automated analysis.

Open Access Media

USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.

BibTeX
@inproceedings {281338,
author = {Sunil Manandhar and Kaushal Kafle and Benjamin Andow and Kapil Singh and Adwait Nadkarni},
title = {Smart Home Privacy Policies Demystified: A Study of Availability, Content, and Coverage},
booktitle = {31st USENIX Security Symposium (USENIX Security 22)},
year = {2022},
isbn = {978-1-939133-31-1},
address = {Boston, MA},
pages = {3521--3538},
url = {https://www.usenix.org/conference/usenixsecurity22/presentation/manandhar},
publisher = {USENIX Association},
month = aug
}

Presentation Video