Privacy Gaps in Chinese Smart Home Apps Raise Concerns for Users

The study reviewed 49 smart home apps from the Apple App Store in mainland China, highlighting serious privacy issues for bystanders. All apps required users to register with a mobile phone number, reflecting China’s real-name registration system. The research revealed extensive data collection practices, including direct collection of personal information and indirect collection of device identifiers and location data.

Most apps requested permissions for location services, camera access, and microphones, among others, to support various functionalities. Alarmingly, 39 of the 49 apps reported collecting sensitive financial information and biometric data, including facial recognition and health-related metrics.

Privacy controls were primarily designed for the primary account holder, with no explicit protections for visiting or uninvolved bystanders. The study found that users received no notifications or consent mechanisms regarding data collection from bystanders, indicating a lack of transparency.

Inconsistencies were also noted between privacy policies and actual app behavior. For instance, while many apps claimed not to track users, their policies disclosed third-party SDK usage for monitoring. This mismatch raises concerns about the reliability of privacy labels in the App Store.

Implications for User Privacy

The findings underscore the need for stronger privacy protections, especially for bystanders who may not be aware they are being monitored. Users should be cautious about the permissions granted to smart home apps, as these can lead to extensive data collection without their knowledge.

Organizations and developers must improve transparency in privacy interfaces and ensure that privacy policies accurately reflect data practices. The study’s recommendations call for better bystander-focused privacy controls and consistency between app privacy labels and actual data practices.

• 49 Chinese smart home apps were reviewed for privacy practices.
• All apps required phone number registration, reflecting China’s real-name system.
• 39 apps reported collecting sensitive financial and biometric data.
• Privacy controls primarily focused on the primary account holder.
• Inconsistencies were found between privacy policies and app behavior.