Your Living Room Is Listening, But You're Still in Charge: A 2026 Room-by-Room Privacy Sweep

Nobody buys a smart speaker hoping to be surveilled. You buy it because it's cheap, it plays Radio 4 while you're doing the washing up, and it stops the kids arguing for eleven minutes. Then three years pass, the app has had four redesigns, and you genuinely cannot remember whether you ever turned off the thing that sends your voice clips off to be "improved".

That's not a personal failing. It's a design choice by the industry, and the fix is boring rather than dramatic. Below is a sweep you can do in one evening, room by room. Keep the tech. Just take the controls back.

Start in the living room: the telly that watches back

Modern smart TVs are less televisions than advertising terminals with a screen attached. The big one to look for is ACR — Automatic Content Recognition. It fingerprints what's on screen, matches it against a database, and uses the result to build a profile for ad targeting. On most sets it's on by default.

You'll find the switch under Settings, then something like Privacy, Data Collection or Advertising — the wording varies wildly between LG, Samsung, Sony and the rest, which is half the problem. Turn off ACR and personalised ads. While you're there, check whether the voice remote is listening for wake words you never agreed to.

Also worth knowing: if you use a streaming stick or a games console, each one has its own privacy menu. They do not inherit your telly's settings. Annoying, but there it is.

The kitchen speaker: deleting what it already has

Alexa and Google Assistant both let you go back through your voice history and delete the lot. On Alexa it's Settings → Alexa Privacy → Review Voice History. On Google it's My Activity, filtered to Assistant. You can also set recordings to auto-delete after three or eighteen months, which is the setting most people never touch.

Two more things while the app is open. First, find the "help improve" toggles and switch them off if you'd rather your kitchen arguments weren't training data. Second, be honest about the mute button — the physical mic-off switch is the only guarantee, and ambient noise does occasionally wake these things mid-sentence. Not sinister, just a microphone doing what a microphone does.

The hallway doorbell: your weakest password is now a camera

Video doorbells are wonderful and also the single most commonly compromised smart device in UK homes, largely because people reuse a password from 2016. If a doorbell app doesn't offer two-factor authentication in 2026, replace the doorbell.

Beyond that: change the default credentials, set clip retention to the shortest period that's actually useful, and check whether footage is being shared with anyone you've forgotten about — installers, a previous housemate, a family member who set it up. And a legal note that surprises people: if your camera films a neighbour's garden or a public footpath beyond your own boundary, the ICO's domestic CCTV guidance applies, and you may need a sign and a defensible reason.

The nursery: the one to take seriously

Baby monitors are the category where a mistake has the highest emotional cost. Cheap unbranded units bought from a marketplace seller are the usual offenders — default passwords, cloud dashboards with weak authentication, and the occasional port left open to the internet.

Since April 2024, products sold in the UK have had to meet minimum security requirements under the Product Security and Telecommunications Infrastructure regime, including a ban on easily guessable default passwords. That helps with new kit. It does nothing for the monitor you bought in 2021. So: change the password, install firmware updates when they appear, disable remote viewing if you only ever watch from inside the house, and never forward a port on your router to make an app work.

Bedroom and home office: the quiet accumulation

This is where the audit usually falls apart, because it's not one gadget — it's a smart plug, a bulb, a fitness ring, a printer that has somehow got an email address, and a work laptop on the same Wi-Fi as all of it.

Two practical moves. Put the gadgets on a guest network so they can't see your laptop or your NAS. And do a shared-access review: who else is logged into the heating app, the plug app, the doorbell app? Family sharing is convenient right up until someone moves out.

What you're actually entitled to ask for

Here's the empowering bit. Under UK GDPR, the companies behind these devices are data controllers for what they collect — and you have rights you can exercise for free.

• Subject access request — ask what they hold on you. They have one month to respond, and can only extend that in specific circumstances.
• Right to erasure — ask them to delete it, subject to their legal retention obligations.
• Right to object — particularly relevant to profiling and marketing-driven data use.

You don't need a solicitor and you don't need magic words. A plain email to the privacy address in their policy, naming the right you're using, is enough. If a firm ignores you, the ICO takes complaints.

The twenty-minute quarterly habit

Do this once a season and it stops being a chore: open every smart device app on your phone, check the privacy toggles, confirm 2FA is still on, delete old voice recordings and clips, and update the firmware you've been dismissing for a month.

You are not going to unplug your house in 2026. You don't need to. You just need to be the person in the room who knows what the box is doing.