A concerning new report from consumer group Which? has uncovered that several popular air fryers and other smart kitchen appliances may be collecting users' personal data and audio recordings without clear justification.
The investigation found that air fryers manufactured by Xiaomi, Tencent, and Aigostar requested permission to record audio through users' phones, with no explanation provided for this feature. More worryingly, the Xiaomi and Aigostar models were discovered to be transmitting personal data to servers located in China.
"Consumers are effectively paying twice - once for the product and again with their personal data," explains Stephen Almond from the Information Commissioner's Office (ICO). The data collected could potentially be used for targeted advertising and market research.
The study revealed that all tested smart appliances required privacy consent for basic functionality and requested access to users' precise location data. Smart TVs from manufacturers Hisense and Samsung were found asking for users' postcodes during setup, with Samsung's TV app seeking permission to view all other applications installed on connected phones.
In response to these findings, the ICO plans to introduce new guidelines in 2024 for smart device manufacturers. These rules will address consent procedures, privacy information disclosure, and tools for users to exercise their data rights.
The issue extends beyond just air fryers - the Huawei Ultimate smartwatch topped the list by requesting nine "risky" phone permissions, defined as invasive access to device features like location tracking, audio recording, and app monitoring.
While none of the investigated companies are accused of illegal behavior, the findings raise questions about data privacy in smart home appliances. With British consumers expected to spend £15 billion on smart devices this Christmas, the length and complexity of privacy policies - averaging 8,000 words - poses additional concerns about informed consent.
The ICO emphasizes that smart products should only collect personal data necessary for their core functions, as these devices can gather intimate details about users' daily lives, from living arrangements to personal preferences and health information.