Buying guide
Four questions you can check in a shop, on your phone, in two minutes. They do not make a device safe, but after them you are buying deliberately instead of guessing.
Four checks, in this order
How long does the manufacturer promise updates?
The stated support period tells you how long the manufacturer promises security fixes. Look for a date or a clear number of years.
Where to lookThe product page, the manual and the manufacturer support pages. Search by the model number, not the product name.
A bad answerThe support period is not stated anywhere, or the seller only says updates come as needed.
Does the device have its own password, or the same one as every other unit?
A factory password shared by every device of the same model is known to other people too. Setup should require a change or use a unique password.
Where to lookThe box, the manual and the setup guide. A device-specific password is often on a sticker underneath the device.
A bad answerThe manual prints the same username and password for everyone, and setup does not force you to change it.
Does the device work without the cloud?
Local control can keep the basic functions working when the cloud service or the internet connection is down.
Where to lookThe technical details on the product page and the description of the app. Look for a mention of local control, or of what the device does with no network connection.
A bad answerThe device wants an account and a network connection before it does anything, and the basic function does not work without them.
Red flags and green flags
Red flags
- The support period is not stated anywhere.
- The same factory password on every device of the model, printed in the manual.
- The device wants an account before it does anything at all.
- The app asks for permissions that have nothing to do with the device.
- There is no way to send the manufacturer a security report.
- The manufacturer does not say what happens to your data after you close the account.
Green flags
- The support period is stated and it has an end date.
- A device-specific password, or setup makes you set your own.
- The device works on the local network without the cloud.
- The manufacturer has a public channel for security reports.
- Automatic updates are on by default.
- The privacy statement is written so a person can read it.
Device categories
This guide does not compare brands or models. For each category, check the usual data flows and the question worth asking before you buy.
Security camera
Video, sound, motion-detection events, and often the recordings themselves on the manufacturer's server.
Does it record to a memory card without a subscription, and how long is it updated for?
Baby monitor
Sound and video. A model on the network is a security camera in all but name.
Is the model online or radio-only, and which one suits your use?
Smart television
What is on the screen, including from a device plugged into the HDMI port.
Can content recognition be switched off, and does the television work without an account?
Smart speaker
Voice commands after the wake word, and the false starts along with them.
Is there a physical microphone switch, and does the app show the recording history?
Robot vacuum
A map of your home floor plan, and on some models video as well.
Where is the map kept, and can you delete it from the device and from the account?
Smart lock
Door-opening events and access rights, through the account.
Does the lock work without a network, and does the account support two-factor authentication?
What price and labels can tell you
Cheap does not mean bad, and expensive does not mean supported
An expensive device can go without updates and a cheap one can get them for years. The price tells you about materials and features, not about how long faults get fixed.
The CE marking is not a security test
It is the manufacturer's own declaration that the product meets the requirements. For internet-connected radio equipment those requirements have included security since 1 August 2025, so the marking means more than it used to. It still means less than the seller says.
Regulation is not a guarantee
The requirements cover what is placed on the market from a given day onwards. There is still older stock on the shelves, and online shops ship devices from outside the EU.
Judge the device by what you need it for
A connected device can be a good purchase when its features are useful to you and its update support, data handling and operation without the cloud are clear.
What about a device you already have?
Most people read this after buying. The same four checks work on a device that is already on the shelf, and the answers tell you how much to trust it.
If the answer about the support period is a bad one, move the device onto its own guest network. Then its problems are not the whole home's problems.
Checked