Smart home security: how to keep cameras, doorbells, speakers and TVs from spying on you

Stories about strangers talking through a baby monitor or watching a living room camera get a lot of attention. In many reported cases the attacker did not break the device. They logged in to the owner's account with a password leaked from some other site, a technique called credential stuffing. Once in, they see everything the owner sees.

The other risks, roughly in order of how much they matter to an ordinary household:

• Cheap devices that never get updates, with known flaws left open for years.
• Data collection you agreed to without noticing, especially by smart TVs and voice assistants.
• People with shared access who should not have it anymore: an ex, a former roommate, a previous owner.
• Company-side access. In 2023 the FTC alleged that Ring had let employees and contractors view customers' private videos; Ring settled. Even a big brand's cloud is only as private as its internal controls.

• Look for a stated update period. A maker that tells you how long a camera will get security updates is making a commitment you can hold it to. No statement often means no plan.
• Check the account security options. Does the app support two-factor authentication? Does the maker offer end-to-end encryption for video? Ring, Apple's HomeKit Secure Video and some others do, often as an opt-in.
• Be wary of no-name bargains. Very cheap cameras sold under shifting brand names on marketplaces often rely on generic cloud services with poor security records, and may never be updated.
• Look for the US Cyber Trust Mark. The FCC set up this voluntary label, a shield logo on the box, for connected devices that meet baseline security criteria such as supporting updates and avoiding default passwords. Labeled products have been slow to appear, so treat it as a plus when you see it rather than a requirement.
• Prefer local options if privacy matters most. Some cameras record to a memory card or a base station at home and can work without a cloud subscription. You give up some convenience in exchange.

1. Use a unique password for each smart home app account (Ring, Google Home, Amazon, Wyze, Arlo, Eufy, your TV maker). A password manager makes that easy. If you have reused one, check whether it leaked.
2. Turn on two-factor authentication. Look in the app's account or security settings. Our 2FA guide explains the options.
3. Change any default device password. Some cameras and network video recorders have their own local login separate from the app. If it still says admin/admin or similar, change it.
4. Check the login history and authorized devices if the app shows them, and remove anything you do not recognize.

Put smart devices on your router's guest network or a dedicated IoT network if it has one. If a cheap plug is hijacked, it cannot then reach the computers and phones on your main network. Our home Wi-Fi guide shows how to set one up and which router settings, like UPnP, to turn off.

In each device's app, find the firmware or software update setting and turn on automatic updates. For a smart TV, look in the system or support menu. When a maker stops updating a product, plan to replace it, especially anything with a camera or microphone. More in how to keep your devices updated.

Many smart TVs use automatic content recognition (ACR): the TV periodically identifies what is on screen, including from cable boxes, game consoles and streaming sticks, and reports it for ad targeting and measurement. You probably agreed to it during setup.

Each maker names the setting differently, and the names change with software updates. Look in the TV's settings under Privacy, Terms & Policies, or General for wording like "viewing information," "viewing data," "smart TV experience," "live plus," or "use information from TV inputs." While you are there, decline interest-based advertising and reset the advertising ID.

A simpler option: do not connect the TV to the internet at all, and use a separate streaming box instead. The TV cannot report anything without a connection, and streaming boxes have their own privacy settings worth a look.

Do not share one login. Most smart home apps let the owner invite other household members with their own accounts. That way each person has their own password and 2FA, you can see who has access, and you can remove one person without changing everything.

Review the shared users list every so often, and after any household change: a roommate moving out, a breakup, a dog walker who no longer comes. If you are worried that someone is using a device to monitor you, see the safety advice in how to tell if your phone is hacked before making changes they might notice.

1. Remove the device from your account in its app first. Some devices stay linked to the old owner otherwise.
2. Factory reset it using the maker's instructions, often a pinhole button held for several seconds.
3. Delete stored recordings in the cloud if you no longer want them, and cancel any subscription tied to the device.
4. For a smart TV, sign out of every streaming app before resetting, since some sessions are tied to the account rather than the TV.

Moving into a home with smart locks, thermostats or cameras already installed? Ask the previous owner or landlord to remove the devices from their accounts, then factory reset and set them up under yours. If that is not possible, contact the maker's support. The FTC's consumer advice site has more on securing connected devices.