What Your Smart Thermostat Tells Google About Your Home

A reading from three vendor privacy policies, plus what researchers proved in 2016 about what those readings leak.

State of Surveillance

TL;DR: A smart thermostat is not a switch on the wall. It is a sensor package with a microphone-shy habit of phoning home. Nest's own privacy statement says the Nest Learning Thermostat collects temperature, humidity, ambient light, and motion data, and that "your Nest Product regularly sends the data described in this Privacy Statement... to Nest to provide you with the Services."[1] Ecobee's privacy policy says the device collects environmental data and "additional types of data, such as motion sensing (i.e., 'occupancy sensing')."[2] Resideo's corporate privacy statement for Honeywell Home explicitly notes that connected thermostat data is covered by separate connected-product policies, not the general policy you see on the homepage.[3] Researchers have known since 2016 that even aggregate occupancy readings from a thermostat can leak "individual location information."[4] None of this is illegal. All of it is optional, if you can find the settings.

What Nest Collects, in Nest's Own Words

The Nest Learning Thermostat's privacy statement is unusually direct about the sensor package on the wall. The vendor's list, verbatim:

"The Nest Learning Thermostat collects: Setup information you provide; Environmental data from the Nest Learning Thermostat's sensors; Direct adjustments to the device, including temperature or settings; Heating and cooling usage information; Technical information from the device."[1]

That five-item list reads like a survey form, until you expand each item into what Nest actually takes. The setup info includes your home or business status and your postal/ZIP code.[1] The environmental sensors record "current temperature, humidity and ambient light in the room," and the device can "sense whether something in the room is moving."[1] When you turn the dial, Nest records "the time and duration during which your system was on,"[1] plus your model and serial number, software version, and battery charge.[1]

Nest then states the data flow plainly: "your Nest Product regularly sends the data described in this Privacy Statement (excluding your Wi-Fi password) to Nest to provide you with the Services."[1] The word "regularly" is doing work. Nest does not publish a fixed cadence, but it does call out that the data is continuous.

If the device is paired with a Google account, the destination is not just Nest Labs' servers. The same privacy statement says: "If you use your Nest devices and services with a Google Account, then your data will be handled as described in the Google Privacy Policy."[1] Google's general privacy policy, effective October 12, 2026, does not call out thermostats by name, but does say Google "may also show you personalized ads based on your interests and activity across Google services."[5] Linking Nest to Google is the toggle that puts occupancy data into the advertising pipeline.

What Ecobee Collects, and Who It Shares With

Ecobee's privacy policy, last revised November 14, 2024, splits the data into two categories and explains both.

The first is what the thermostat measures. Ecobee states: "Your ecobee Product collects environmental data, such as temperature and humidity, as well as operational data, such as thermostat runtime data and temperature set points from your HVAC equipment."[2] On higher-end models with built-in sensors, the device also "may collect additional types of data, such as motion sensing (i.e., 'occupancy sensing')."[2] External room sensors, sold separately, add to that.[2]

The second is where it goes. Ecobee says the device "transmits encrypted ecobee Product Data to the ecobee Website" so the company can show you historical reports.[2] Sharing with third parties is the open-ended clause that follows: Ecobee "may disclose any of the personal information that we collect or that you provide us... To our subsidiaries and affiliates. To contractors, service providers, advisors, and other third parties (including technicians) we use to support our business."[2]

Two Ecobee-specific programs are worth flagging because they ship on by default and are easy to miss.

The first is Donate Your Data, an opt-in research program. Ecobee describes it: "If you agree to participate in ecobee's Donate Your Data program, you will be anonymously sharing your ecobee Product Data with ecobee's research partners."[2] The framing is "anonymously." The granularity of the underlying temperature, runtime, and occupancy data is not aggregated before the share.

The second is the utility demand-response pipeline. Ecobee says: "If you purchase your ecobee Product as part of, or choose to participate in, an electricity usage or demand response program... your name, address, contact information, and other information relating to your purchase may be forwarded to your utility provider ('Utility'), Regional Transmission Organization, Independent System Operator, state agency, regulator, or third-party partners or implementors."[2] Many utility rebates for Ecobee require joining that program, which means the rebate and the data share are the same offer.

Ecobee's retention language is the standard, non-committal version: "We retain your personal information only for as long as is necessary to fulfill the purposes for which it was collected and processed, in accordance with our retention policies, and in accordance with applicable laws or until you withdraw your consent (where applicable)."[2] No fixed number of days. No defined cap.

Honeywell Home: The Policy Says One Thing, the Product Says Another

Honeywell Home thermostats are now sold and serviced by Resideo. Resideo's corporate privacy statement, last updated December 16, 2022, governs the website and the corporate data flows: identity data, usage data, and technical data of the kind logged by your visit.[3]

The thermostat itself sits outside the corporate statement. Resideo says so in plain English: "Personal information collected about you in connection with other Company websites, products, services or mobile applications (including those made available to you by our group companies) may be covered by different privacy statements."[3] The corporate statement is not where you find what the thermostat on your wall is sending.

The separate privacy statement is the one that governs what the device actually collects. Resideo's general policy does not describe temperature, humidity, or occupancy as a category of personal information; the dedicated product policy is the one that does.[3] The corporate statement confirms two things that carry across: Resideo "may share your personal information with companies with which we have contracted to provide services on our behalf," and with "Distributors and other trusted business partners... for purposes that include allowing those third parties to send marketing communications to you."[3]

That structure is the actual privacy posture for Honeywell Home owners: read the connected-thermostat product statement, not the corporate one, to see what the wall device sends. Resideo's retention is similarly generic: "we store personal information needed to provide you with products and services... for so long as you are a customer," plus a second clause that keeps it "for as long as is needed to fulfill the purposes outlined in this privacy statement."[3]

Why "Just Temperature" Is Not the Whole Story

Each vendor frames its data collection as the price of automation. The thermostat learns your schedule and turns the heat down when no one is home. The audit is whether the data needed to learn that schedule is the same data that lets someone else infer when you sleep, when you leave for work, and whether anyone is in the house.

That audit was done by researchers in 2016, before any of the current vendor privacy policies were written. The paper "Privacy-Enhanced Architecture for Occupancy-based HVAC Control," Jia et al., found that "individual location information can be inferred from occupancy measurements" even when the sensor data is reported only in summary form.[4] The paper framed the problem as a privacy-performance trade-off: more sensor resolution means better HVAC control and better leak of who is where in the home.[4]

A 2022 academic study confirmed that thermostat sensor data is part of a much larger smart-home privacy problem. "Smart Home Privacy Policies Demystified: A Study of Availability, Content, and Coverage," Manandhar, Kafle, Andow, Singh, and Nadkarni, published at the 31st USENIX Security Symposium, examined 596 smart home vendors and 2,442 smart home devices. The paper found that "smart home devices transmit highly sensitive usage information to servers owned by vendors or third-parties as part of their core functionality," and reported 17 findings on how the policies describe the data, how often the descriptions match what the devices actually send, and how hard the policies are to find.[6]

Both papers predate the current vendor policies, and both treat the temperature-and-motion pipeline as a leak that needs deliberate defense, not a default the user accepts.

What You Can Do This Week

The thermostat sensor package is configurable. None of the three vendors ship every sensor on by default, and none make the settings easy to find. The minimum useful lockdown, by vendor:

Nest (with a Google Account). Open the Google Home app and look in Settings for the privacy controls tied to your thermostat and to Google Home activity in general. Toggle off any "activity" or "personalization" switch that mentions your thermostat or Google Home activity. If you do not need remote control, leave the device paired with a Nest-only account, which Nest's privacy statement treats as a separate data path from the Google-account path.[1] Google's privacy policy effective October 12, 2026 lets you review and delete stored activity through My Activity, and offers an auto-delete setting for activity older than a chosen period.[5]

Ecobee. In the ecobee app, open the device settings for each thermostat and look for the "Donate Your Data" toggle. Ecobee describes the program as opt-in, which means the default is off, but check that no one in your household flipped it on during setup. If you bought the device through a utility rebate, log into the utility's portal and look for the data-sharing controls. Ecobee's privacy policy says demand-response participation "may" forward your name, address, and contact information to the utility, the regional grid operator, and third-party implementors.[2] You can usually opt out of the data-share without losing the rebate, depending on the utility.

Honeywell Home / Resideo. The corporate privacy statement is not the one to read for the wall unit. Find the dedicated Honeywell Home or Resideo connected-thermostat privacy statement, which Resideo's own corporate page tells you is the right document.[3] In the Resideo app or Honeywell Home app, look for an Account or Privacy section and turn off anything that reads as advertising, data sharing, or "trusted business partners." Resideo's corporate policy explicitly authorizes sharing with "Distributors and other trusted business partners... for purposes that include allowing those third parties to send marketing communications to you," so the toggle is the only thing standing between your thermostat data and a third-party marketer.[3]

For all three brands. If you do not need remote control, do not link the device to an account at all. Each vendor supports at least the basic schedule on the device itself. The privacy cost of the cloud is the data flow, and the data flow is what disappears when the Wi-Fi link is gone.

The Bottom Line

A smart thermostat is a sensor with a furnace attached. The temperature, humidity, and motion data it sends back to the vendor is not optional infrastructure. It is the product.

  1. Nest's privacy statement says the Nest Learning Thermostat collects environmental data, heating and cooling usage, and motion data, and sends all of it to Nest on a regular cadence. If paired with a Google account, the data is also handled under Google's privacy policy.[1]
  2. Ecobee's privacy policy says the device collects environmental data and, on some models, "motion sensing (i.e., 'occupancy sensing')."[2] Ecobee's Donate Your Data and utility demand-response programs ship additional sharing paths that are easy to miss.[2]
  3. Resideo's corporate privacy statement explicitly tells readers that connected-product data is covered under a separate statement, not the corporate one.[3] Honeywell Home owners have to find that second document to see what the wall device sends.
  4. Academic work since at least 2016 has shown that occupancy readings from a thermostat can leak individual location information even when reported in aggregate form.[4] The 2022 USENIX study put the broader smart-home device count at 2,442 across 596 vendors and called the data flows "highly sensitive usage information."[6]
  5. The cloud link is the privacy cost. Every setting change, every data toggle, every demand-response opt-out is a way to keep the cloud link narrower than the vendor default.

Sources

  1. Nest: Privacy Statement for Nest Products and Services (Nest Learning Thermostat section)
  2. ecobee: Privacy Notice & Legal (last revised November 14, 2024; effective November 27, 2024)
  3. Resideo Technologies, Inc.: Privacy Statement and Cookies (last updated December 16, 2022)
  4. Jia, R., et al. (2016): Privacy-Enhanced Architecture for Occupancy-based HVAC Control (arXiv:1607.03140)
  5. Google: Privacy Policy (effective October 12, 2026)
  6. Manandhar, S., Kafle, K., Andow, B., Singh, K., Nadkarni, A. (2022): Smart Home Privacy Policies Demystified: A Study of Availability, Content, and Coverage (31st USENIX Security Symposium, pp. 3521-3538)

Published: October 12, 2026