Samsung SmartThings' privacy notices disclose broad collection of account, location, residence, and connected-device data (including audio/video content from linked cameras and microphones), along with use of cross-device tracking and cookies to support interest-based advertising. The company's own SmartThings privacy notice identifies Samsung Electronics Co., Ltd. and its UK affiliate as the responsible entities and describes cross-border data transfers to Korea, the U.S., and Japan. Samsung's track record includes a 2022 breach affecting Samsung Account-linked customer data, a 2019 exposure of internal SmartThings source code and analytics logs, and a 2016 academic study identifying remote-attack vulnerabilities in the SmartThings platform.
TIMELINE
NO ENTRIES ON FILE YET.
ULTIMATE PARENT
TOOLS WE RECOMMEND
PLUS
RECEIPTS
11 ON FILE
COLLECTION
The SmartThings U.S. Privacy Notice states that when users connect video or audio recording devices, or connect Samsung's Bixby voice assistant, the service may obtain recorded video/audio content, images, and audio of voice commands.
The SmartThings U.S. privacy notice discloses collection of contact information, Samsung Account details, residence information such as approximate home square footage and number of family members, and precise geolocation via GPS, Bluetooth and WiFi signals.
The SmartThings global privacy notice discloses that use of the SmartThings Cooking feature results in collection of information about favorite ingredients, cuisines, dietary preferences, and cooking experience.
The SmartThings U.S. privacy notice discloses that use of SmartThings Family Care results in collection of care-recipient profile information, including emergency contacts.
The SmartThings privacy notice for Europe identifies Samsung Electronics Co., Ltd., headquartered in Suwon-si, South Korea, and Samsung Electronics (UK) Limited as the entities jointly responsible for SmartThings data practices.
The SmartThings U.S. Privacy Notice discloses that Samsung engages in online advertising, showing ads on other websites or apps and targeting messaging using demographic data and inferred user interests.
In 2016, researchers from the University of Michigan and Microsoft analyzed the Samsung-owned SmartThings smart home platform and discovered vulnerabilities that could be exploited for remote attacks on connected homes.
In May 2019, a security researcher reported that an erroneously public Samsung internal GitLab instance exposed SmartThings source code, private certificates for the Android and iOS SmartThings apps, and logs and analytics data for Samsung's SmartThings and Bixby services.
In September 2022, Samsung disclosed that an unauthorized third party had acquired customer information from some of its U.S. systems in late July 2022, including name, contact and demographic information, date of birth, and product registration information, though not Social Security or payment card numbers.
An earlier version of the SmartThings global privacy notice discloses that Samsung may collect personal information about users' online activities on connected devices over time and across third-party devices, apps, and other online features and services.
The SmartThings U.S. Privacy Notice states that the associated Samsung Privacy Policy describes additional information collected through cookies and third-party analytics services used in connection with the Service.