• Millions of Brits own a smart device but only 1 in 7 have a clear understanding of how their data is collected, used and shared
• We call on companies to do better as we share five steps you can take today to protect your privacy

From TVs and speakers to air fryers and fitness trackers, smart devices collect a lot of information about us and slide seamlessly into our homes. But a third (33%) of people don’t feel confident they understand how their smart devices collect, use and share their data.

In fact, three quarters (75%) would be surprised to learn that a smart toaster is gathering their personal data, while 74% said the same about a smart toothbrush.

The findings come as we call on smart device companies to handle people's personal data responsibly and shares simple steps the public can take to protect their privacy. 

William Malcolm, ICO Executive Director for Regulatory Risk, said:

“Smart devices collect some of the most sensitive data about our lives, from our health to our daily routines and family life. They are designed to make our lives easier, but this should never come at the cost of our privacy. Our findings suggest consumers are caught between convenience and concern – wanting to embrace the benefits of smart devices but not fully trusting or understanding how their data is being used.”

Almost half (43%) of consumers are willing to buy smart devices for benefits driven by their personal data, such as personalised features or automated routines. However, in stark contrast, the other half (42%) admit to concerns about their data when buying smart devices, with 15% actively avoiding the tech for this reason.

We have published our finalised guidance today for smart device manufacturers and developers. It sets out that smart products should only collect data they need, be transparent about how it is used, and give people meaningful control over their information.

William Malcolm added:

“We are clear that smart product companies must do better, making sure people understand what they’re agreeing to and are not just handing over their data by default. Where organisations are not giving you clear choices and confidence, we will take action to protect the public.”

We are now turning our attention to connected TVs, found in 70% of UK households. Smart TVs collect a huge amount of data - what you watch, when you watch it - and use that information to build a detailed picture of your viewing habits. They can use this to target you with advertising and personalised recommendations, but this must be done with your consent.

We will be engaging with connected TV manufacturers this year to assess whether they are complying with the law and offering both meaningful transparency and genuine consent over how your data is used. 

Andrew Laughlin, Which? Tech Expert, said:

"From air fryers tracking our location to smart washing machines demanding our date of birth, past Which? investigations have repeatedly exposed how smart devices harvest personal data far beyond what is necessary or acceptable. It’s encouraging to see the regulator's final guidance place a greater emphasis on limiting unnecessary data collection, improving transparency and giving people more control over their information.

"It's positive that the ICO will take a closer look at smart TVs. We've raised concerns for years about the amount of data some of these products collect and how little control households have over their own privacy, but guidance on its own isn't enough. Companies that ignore the rules must face consequences. Households shouldn't have to trade away their privacy just to use everyday technology."

Five simple steps to protect your privacy when using smart devices

While we are making sure companies are responsible with your data, there are steps you can take right now to protect your privacy.

1. Do your research before you buy. Check what data a device collects before you purchase it. Ask yourself whether you're comfortable with the information it wants to access.
2. Take control of your permissions. During set-up, use the privacy controls to limit what your device can access. If a permission seems unreasonable, don't agree to it.
3. Secure your device. Set a strong, unique password and enable two-step verification where possible to protect against unauthorised access.
4. Stay on top of updates. Install software updates regularly — security patches help protect your data from new threats.
5. Wipe your data before you part with a device. If you're selling or disposing of a smart product, factory reset it first to remove your personal information.

Find out more about your data rights and how to exercise them on our website. 

If you have concerns about how a smart device is using your data, you can raise a complaint with us. 

Our research is based on a survey of 2,080 UK adults, conducted between 15th and 18th May 2026 using a sample designed to be representative of the UK population. It explored consumer confidence in understanding how smart devices collect, use and share personal data, alongside attitudes towards purchasing such devices, and expectations about whether different smart devices collect personal data. 

The Information Commissioner’s Office (ICO) is the UK’s independent regulator that exists to empower people through their information rights. The ICO regulates the whole economy, including government and the public sector.

The ICO has specific responsibilities set out in the Data Protection Act 2018 (DPA2018), the United Kingdom General Data Protection Regulation (UK GDPR), the Freedom of Information Act 2000, (FOIA), Environmental Information Regulations 2004 (EIR), Privacy and Electronic Communications Regulations 2003 (PECR) and a further five acts and regulations. 

The ICO can take action to address and change the behaviour of organisations and individuals that collect, use and keep personal information. This includes criminal prosecution, non-criminal enforcement and audit.  

To report a concern to the ICO telephone our helpline 0303 123 1113 or go to ico.org.uk/concerns.