← IoT Privacy Database

Samsung SmartThings

Samsung Electronics · Smart-Home Hub / Ecosystem

Staff Reviewed — a person at DeSpy reviewed this rating.

3.3Surveillance
Index
Policy — what its policy permitsC
Evidence — what research provesC

SmartThings sits at the center of the home and aggregates telemetry from every paired device - lights, locks, cameras, sensors, appliances - into one Samsung account. Because it correlates motion, door, presence and geofence signals across the whole house, it can infer occupancy, daily routines, and precise home location even though the hub itself has no mic or camera. A Samsung account is mandatory and most automations round-trip through Samsung's cloud, though newer Edge drivers can run some routines locally on the hub.

Why this rating

Policy loses points for whole-home aggregation of occupancy/location-revealing sensor data beyond the need of any single device (sensitive-collection), vague and open-ended retention, layered policy language that concedes 'other information not described may be collected' when third-party services are linked (policy-vagueness), reserved unilateral changes and binding arbitration in the US terms; the local Edge-execution capability earns a partial local-processing credit. Evidence reflects real independent scrutiny (Cisco Talos found 20 remotely-chainable vulnerabilities in the SmartThings Hub in 2018, now patched and >5yr so half-weighted) against an otherwise disclosed, opt-out-supported data model.

What it is

Manufacturer
Samsung Electronics
Category
Smart-Home Hub / Ecosystem
Model years
2020-present
Market status
Current
Companion app
SmartThings
Are you the maker? Respond to this finding

Free. There is no paid or faster path, and nothing about a rating is for sale. Prove you control your company's domain with one DNS record; a person then reads your statement beside our finding and decides whether to publish it.

An email is encrypted at rest and opened only to answer you; it is erased 30 days after we resolve this (or 180 days if still open), and you can erase it sooner. Unproven filings are deleted after 14 days.

Think something here is wrong?

Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.

If you leave an email it is encrypted at rest and opened only to answer you — never shared, never used for anything else. It is erased 30 days after we resolve this (or 180 days if it is still open) without you asking, and you can erase it sooner at any time; either way your correction stays, anonymously. Leave it blank and your request is fully anonymous from the start (we store no IP address either way).

Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.

← Back to the IoT Privacy Database