Is Your Smart Home Device Sending Too Much Data? How to Check What It Uploads
A connected device talking to the internet is not proof it is spying on you. Here is how to see what your devices are doing, tell normal telemetry from suspicious behavior, and cut back what you do not need.
The short answer
Your router can usually show that a device is talking, how often, and sometimes where it connects—but not what an encrypted message contains. The practical approach is to build a baseline of normal activity, compare it against the device's features and privacy policy, and investigate repeatable, unexplained changes. The famous 'ransomed coffee maker' story was a firmware security demonstration, not evidence that the appliance was secretly uploading your data.
A connected device talking to the internet is not proof it is spying on you. Here is how to see what your devices are doing, tell normal telemetry from suspicious behavior, and cut back what you do not need.
01 / The story
The coffee maker story, told accurately
The case most people mean when they say 'my coffee maker is spying on me' is something different—and in some ways more interesting. In a report published on September 25, 2020, Avast researcher Martin Hron described deliberately modifying the firmware of an older, first-generation Smarter Coffee Maker. The goal was to prove that the machine's firmware update process could be hijacked without authentication, not to measure what the appliance normally uploads. [1]
The modified machine was made to display a ransom demand and misbehave. The vulnerability is cataloged as CVE-2020-15501, which describes firmware replacement without proper authorization on the pre-second-generation product. It is a serious finding about insecure update design—but it is not evidence that the coffee maker was routinely sending personal data anywhere. [2, 3]
Keeping that distinction straight matters, because the two questions have different fixes. Insecure firmware updates are a manufacturer's problem to patch. Unexpected network chatter is something you can observe yourself, and most of it turns out to have a boring explanation.
02 / The story
What researchers found when they actually measured
The most thorough measurement effort so far is a study published at the ACM Internet Measurement Conference on October 21, 2019. Researchers ran 34,586 controlled experiments on 81 consumer devices in U.S. and UK labs, then compared the results with a 36-household in-home study. They found that device traffic can reveal information—and occasionally expose sensitive data—but also that destinations, encryption and behavior vary widely by device. [4]
A companion line of research showed why even encrypted traffic is not fully private. In a 2019 paper, researchers demonstrated that a passive observer can infer what is happening inside a home—when someone wakes up, when a TV is on—from the timing and size of encrypted packets alone. The content stays hidden; the pattern does not. [5]
A third study introduced IoT Inspector, an open-source tool for watching device traffic at home, and reported findings including outdated encryption and hundreds of third-party advertising and tracking domains contacted by smart TVs in its sample. These are findings about the specific products tested, not a verdict on every device sold today. [6]
03 / The story
How to look at your own network, safely
Start with equipment you already own. Most routers have an admin page or app that lists connected devices, and many show per-device data usage or connection history. The U.S. Federal Trade Commission recommends checking this list regularly and removing anything you do not recognize. [7]
Then build a baseline. Watch one device while it sits idle, then while you use it on purpose. Note the time, the upload and download volume, and the destinations. A brief burst of activity after startup or an update is normal. So are periodic low-volume connections to the vendor's cloud for time synchronization, update checks and remote control.
If you want more detail, the open-source IoT Inspector tool was built for exactly this job—read its current documentation and understand what data the tool itself collects before installing it. Tools like Wireshark can analyze traffic on networks you own, but they require skill and cannot read properly encrypted content. Do not install random 'traffic analyzer' apps, and do not scan networks you do not own or administer. [6]
04 / The story
Normal telemetry versus behavior worth investigating
Usually normal: periodic small connections to the vendor or a big cloud provider, time synchronization, update checks, activity when you trigger the device from its app, and camera uploads when live view or recording is switched on. Encryption itself is a good security property, not a sign of secrecy.
Worth a closer look: sustained or suddenly increased uploads while the device is idle, traffic that continues after you disable its cloud features, destinations with no plausible connection to the vendor, repeated connection attempts to many different hosts, or activity at times that do not match how you use the device.
Before concluding anything, rule out the boring explanations: a mislabeled device in the router list, a shared cloud address used by many services, a pending update, or another household member's usage. Traffic volume and destination prove that communication happened—not what was inside it. Stronger conclusions need corroboration from the vendor's disclosures or a controlled before-and-after test.
05 / The story
Reducing what you do not need
Once you know what a device does, trim it proportionately. Disable cloud and remote-access features you never use, opt out of analytics and personalization where offered, and review the companion app's phone permissions—location, microphone, contacts—keeping only what the features you use actually need.
Many routers let you put smart home gadgets on a separate guest network, which limits what they can reach if one is compromised. Blocking a device from the internet entirely is an option only if its local functions stay safe and useful; a blanket block can break updates, alerts and remote control.
Finally, keep firmware and apps updated, change default passwords, and use unique credentials with multi-factor authentication where offered. The FTC noted in November 2024 that it is often hard to know how long a smart device will keep receiving security updates—if a product is abandoned by its maker, retiring it is a reasonable security decision. [7, 8]
A closer look
What we verified and what stays uncertain
This guide is desk research based on the original Avast coffee-maker report, peer-reviewed smart-home traffic studies, and U.S. Federal Trade Commission consumer guidance, checked on October 18, 2026. Router features vary by brand, and an IP address often belongs to a shared cloud provider, so destination names alone rarely tell the whole story.
Uncertain as of publication: the exact retail model and firmware build of the coffee maker in the 2020 demonstration are not reliably established in public summaries, and no reviewed source documents a measured list of routine upload destinations for that device. We do not claim it was found sending data anywhere specific.
Put it to work
Check a device in under an hour
To understand what one smart home device is doing:
0 of 6 considered
These questions are editorial guidance, not a product score or verified assessment.
Keep learning
Further reading
- AI Agent Security: Prompt Injection, Safe Tools, and Containment
Qlauson · Artificial Intelligence
- Passkeys vs Passwords: How Modern Authentication Works
Qlauson · Cybersecurity
- ChatGPT and Your Browser: What Can AI Actually See, Read and Do?
Qlauson · AI Tools
- Avast/Gen Digital: The fresh smell of ransomed coffee (Sep 25, 2020)
External resource · Original research report on modifying a first-generation Smarter Coffee Maker's firmware. Opens in a new tab.
- Avast: IoT firmware hack summary (Oct 2, 2020)
Primary documentation · Follow-up describing the local Wi-Fi attack path. Checked Oct 18, 2026. Opens in a new tab.
- CVE-2020-15501 record
Primary documentation · Vulnerability description: firmware replacement without authentication on the pre-second-generation product. Checked Oct 18, 2026. Opens in a new tab.
- Ren et al., ACM IMC 2019: Information Exposure From Consumer IoT Devices
Primary documentation · Controlled measurement of 81 devices; basis for what traffic can and cannot reveal. Checked Oct 18, 2026. Opens in a new tab.
- Apthorpe et al., PoPETs 2019: Keeping the Smart Home Private
Primary documentation · Shows encrypted traffic patterns can expose in-home activities. Checked Oct 18, 2026. Opens in a new tab.
- Huang et al.: IoT Inspector research (2019)
Primary documentation · Open-source home traffic monitoring tool and findings on smart TV tracking domains. Checked Oct 18, 2026. Opens in a new tab.
- FTC: Securing Your Internet-Connected Devices at Home (May 11, 2021)
Primary documentation · Official consumer guidance on router device lists, updates and passwords. Checked Oct 18, 2026. Opens in a new tab.
- FTC: How long will your smart device get software updates? (Nov 26, 2024)
Primary documentation · On unclear update-support periods for smart devices. Checked Oct 18, 2026. Opens in a new tab.
Read next
Passkeys vs Passwords: How Modern Authentication Works
How passkeys use cryptographic keys to resist phishing, why synchronization and recovery matter, and what passwordless sign-in does not protect.
Continue readingNewsletter
Get new Qlauson stories by email.
An occasional email when we publish a new guide or update an important one. No unrelated promotions, and you can unsubscribe from any email.
