Sources

The picker is available on Android 17, or API level 37. The app has to use the picker before the user can share only the contacts needed through it.

Price does not determine certification. You can check the status in Google Play under Settings > About > Play Protect certification.

Play Protect is enabled by default. It also checks apps installed outside Google Play and can warn about harmful web addresses.

Android normally keeps one persistent randomized address for a network. In some Android 12 and later cases, the address can change more often.

Availability and schedules depend on the device, manufacturer and mobile operator. A phone system update does not reveal the update status of a separate smart device.

June 2026 round, Windows 11. Microsoft Defender Antivirus 4.18 scored 6/6 for protection, 5.5/6 for performance and 6/6 for usability.

The round tested 16 products. Thirteen of them scored 6/6 for protection. The test round changes every few months, so check the source for the latest result.

The restriction applies to apps targeting Android 17, or SDK 37, and later. For now, an app targeting an older version receives local-network access with its internet permission.

Local-network access belongs to the Nearby devices permission group. Internet access can work while local discovery and control fail.

An app running on Android 13 or later requests NEARBY_WIFI_DEVICES when it targets Android 13 or later and uses certain Wi-Fi operations. The permission is shown to the user as part of the Nearby devices group.

An older app can still ask for location. Some Wi-Fi APIs, including network scanning, can require precise location even on a new Android version.

Settings > Privacy & Security shows which apps have requested each kind of access. Access can be granted or removed later.

Local-network access can be changed under Settings > Privacy & Security > Local Network. Denying it does not stop the app’s ordinary internet access.

On current systems, the address can be fixed or rotating depending on the network security. A router may report the device as new when it first joins using a private address.

The manufacturer is responsible for the conformity assessment, technical file, EU declaration of conformity and affixing the marking. Some product groups require a notified body to take part.

Not every product needs CE marking, and it must not be affixed outside product groups covered by the relevant EU rules. The marking is not an approval issued to the product by the EU or an authority.

The service is meant for an individual consumer’s own situation. The authority itself supervises companies at a general level and does not settle individual disputes.

Read on the authority’s own English-language page, which states the service languages outright: “Consumer advice gives guidance in Finnish and Swedish. Therefore persons wishing to consult an advisor in some other language must get an interpreter at their own expense.” The same page marks the number 09 5110 1200 “(only in Finnish)”.

The language of the service affects whether the phone or the online form is a suitable way to use it.

The provision is Chapter 6, Section 12 a of the kuluttajansuojalaki (the Consumer Protection Act), added by Act 693/2022 of 8 July 2022 and in force from 1 January 2023. Kilpailu- ja kuluttajavirasto’s wording: after the call, the company must deliver the offer it made to the consumer in writing or in another durable form. If the consumer does not accept the offer, the contract is not binding, and the seller may not demand payment, the return of goods or their storage.

There are two exceptions, and they sit in different sections. The communications-service exception is separate from cases where the consumer began the contact.

The communications service exception is in Chapter 6, Section 4, on the application of the provisions to certain services: where the contract concerns communications services as defined in the Act on Electronic Communications Services, Section 12 a does not apply. In practice that means phone and internet subscriptions.

The other exception is inside Section 12 a itself: the rule does not cover a situation where the consumer contacted the trader, or where the trader called at the consumer’s express request.

Both sections read in the consolidated text on Finlex on 6 August 2026.

You can withdraw using the company’s form, by email, on the company’s website, or by including a note with the goods you return. You do not have to give a reason.

The consumer must be able to show that notice was given. A written notice is therefore the easiest to prove in practice, even though the law does not require email or a form in particular.

Return costs fall to the consumer unless the company has undertaken to pay them. If the company did not mention the costs in advance, the consumer does not pay them.

Examples include an opened sealed recording or hygiene product, made-to-order goods and goods that spoil quickly. Services and digital content have further exclusions. The handbook’s short list is not exhaustive, so an individual case must be checked against KKV’s current list.

The NIST IR 8259A baseline treats network and local device interfaces separately. Local interfaces include USB ports and memory-card slots, while a network interface may use Bluetooth.

A software update can be delivered remotely over a network or locally on removable media. A device that does not connect to the internet is therefore not automatically outside every security question.

Regulation (EU) 2024/2847 entered into force on 10 December 2024. Under Article 71, most obligations apply from 11 December 2027 and the Article 14 reporting duties from 11 September 2026. The chapter on conformity assessment bodies applied from 11 June 2026.

The manufacturer must determine a support period for the product. Once the main obligations apply, the end date of that period must be stated clearly at the point of sale.

An actively exploited vulnerability requires an early warning within 24 hours and a fuller notification within 72 hours of the manufacturer becoming aware. The final report is due no later than 14 days after a corrective or mitigating measure becomes available.

A severe security incident has the same first two deadlines. Its final report is due within one month of the 72-hour notification.

Article 14(8) requires the manufacturer to inform impacted users and, where appropriate, all users. Article 69(3) extends the Article 14 duties to every in-scope product placed on the market before 11 December 2027.

Notifications are submitted through ENISA’s Single Reporting Platform. The coordinating CSIRT is generally determined by the manufacturer’s main establishment in the EU.

The Commission’s plain-language summary explains the timetable. The Commission’s reporting page and ENISA’s platform guidance describe the reporting process.

Delegated Regulation (EU) 2026/339 repeals the earlier Radio Equipment Directive cybersecurity rule on the same date, 11 December 2027.

Delegated Regulation (EU) 2022/30 brings points d, e and f of Article 3(3) of the Radio Equipment Directive into use for different categories. These include internet-connected equipment, childcare equipment, toys, wearables and equipment capable of transferring money.

The date concerns when a device is placed on the EU market, not every device already in use. Delegated Regulation (EU) 2026/339 repeals this rule on 11 December 2027. The transition covers equipment placed on the market from 1 August 2025 through 10 December 2027.

The announcement was published on 21 October 2024. Labels already granted stayed valid for a transition period and are not renewed.

Looking for the Tietoturvamerkki on the box is therefore no longer current buying advice.

A scammer tells the target which gift card to buy and asks for the card number and PIN. Those codes give the scammer access to the value on the card even when the buyer still holds the card itself.

The FTC advises contacting the company that issued the card immediately, reporting the scam and asking for the money back. Keep the card and receipt for the report.

The OpenWrt guide creates a separate network interface, IP address range, address-assignment service and firewall zone for guest Wi-Fi. Its firewall permits traffic from the guest network to the internet, but not to the main local network.

The guide treats client isolation as a separate setting. It stops wireless clients on the guest network communicating directly with one another, but it is not the firewall boundary between the guest and home networks.

The manufacturer’s instructions include a separate option that can allow guest-network devices to see one another and access the local network. With the option cleared, guests can reach the internet but not computers or other devices on the main network.

The instructions apply to a named product family. The site uses them only as evidence that you must verify isolation in your own router’s settings rather than infer it from the network name.

The Finnish-language notice was published on 18 March 2026. IPIDEA observations began increasing in Finland on 18 February 2026, and the Centre was receiving nearly 900 observations a day when the notice was published.

The notice says enrolment code may be present in an app, a game or an Android streaming device. Its advice includes keeping Google Play Protect enabled, avoiding untrusted free VPN services and keeping devices updated.

The observation rate describes the situation in March 2026. It is neither a count of infected devices nor a current measurement.

The guidance describes double NAT between two private router networks. Different address ranges and firewalls can prevent devices from finding or using one another.

It specifically lists online gaming, port forwarding and UPnP as possible trouble spots. In bridge mode, the second device no longer forms a separate routed network.

The manufacturer’s guidance distinguishes router mode from access-point mode. Router mode enables NAT automatically and blocks direct access to private addresses behind the device.

The guidance covers router mode and NAT behaviour. It does not assess whether the product is secure or suitable.

On remote management, the guidance is blunt: it calls remote management the single largest risk to the device’s security. The setting may be labelled remote access, remote management or remote admin.

On cabling: the flat’s incoming internet cable must not be connected to a LAN port on the router, because that bypasses the router’s protections. The same applies to a building’s shared broadband.

Encryption doubles as a lifespan gauge: with neither WPA3 nor WPA2 available, the guidance says the router is reaching the end of its usable life. The source is available in Finnish and was updated on 14 April 2026.

The guidance recommends an additional network for smart devices, which a router may call a guest network. If the devices do not need to communicate with each other, it also recommends enabling client isolation.

The same page advises changing universal default passwords, enabling automatic updates and checking what data a device collects and how long it will be supported before buying it.

HTTPS makes it harder for anyone between the browser and the website to read or change the connection’s contents. It does not prove that the website itself is trustworthy. The guidance advises checking the site name even when the connection is secure and not entering sensitive information on a page that triggers a browser warning.

Chrome does not always use a padlock icon. Connection details are available from the security status icon to the left of the address.

The ban is entered free of charge in the Positive Credit Register’s online service. You can also consent to the register passing the information to Suomen Asiakastieto Oy and Dun & Bradstreet Finland Oy.

A credit ban does not stop you from taking out a loan yourself. It makes getting credit difficult for somebody trying to use your details.

App isolation also limits a third-party security app. It cannot scan other apps and the whole system in the same way as Windows antivirus.

The verification chain aims to confirm that the app comes from a known source, its code has not been modified and it is allowed to run on that device.

An app update is separate from an iPhone system update. Neither one reveals the software update status of a separate smart device.

Access can be changed under Settings > Privacy & Security > Contacts. Limited Access lets the user select individual people instead of sharing the whole contacts list.

This update applies to the iPhone operating system. It does not reveal the update status of a phone app or the software on a separate smart device.

Recital 44 names a telephone call as a possible way to withdraw. The statement must be unambiguous, and the consumer bears the burden of proving that notice was given in time.

A written message is therefore good practical advice, but it is not a condition for validity.

A warranty cannot have an excess or another payment obligation. A paid agreement may cover wear or damage from an outside cause that statutory liability does not cover.

A paid product must therefore be assessed by its own terms, exclusions, excess and price. Its marketing name does not establish what it adds to statutory liability.

NIST does not consider manually entered one-time codes phishing-resistant. WebAuthn can provide phishing resistance by binding the authentication key to the correct domain.

A synced passkey can use one or more factors. It should not always be called a second step after a password because it may replace the password entirely.

The FIDO Alliance defines a passkey as a FIDO credential. Passkeys use the FIDO2 standards, which include WebAuthn and CTAP.

WebAuthn is the browser API through which a website uses a passkey. FIDO2 and WebAuthn describe the technology; they are not synonyms for a passkey.

On length, the guidance says a long and unique password is better than a short one because it is hard to guess, and that 15 characters is already enough for many services.

On reuse: use a different password in different services, so that a password leaked from one service cannot be used to log in to the others.

The guidance also recommends a password management app and multi-factor authentication. The page was updated on 8 April 2026.

The police advise opening the bank through an address you type yourself or its official app. If credentials have already been given out, contact the bank immediately and file a criminal report.

Suomi.fi advises considering these restrictions particularly when a Finnish personal identity code has reached an unauthorised person. Contact-disclosure restrictions limit access through address and contact-information services.

Address notifications are blocked separately at Digi- ja vaestotietovirasto, the Digital and Population Data Services Agency, and Posti. In MyTax, the tax-refund account number can be limited to changes made after strong authentication, so a paper notification is not enough.

DNS queries also arise from embedded page content and browser prefetching. One query does not therefore prove that a person opened a particular page.

A device often uses the resolver provided by its network. A browser, operating system or another application can choose a different resolver and an encrypted transport.

The NCSC advises updating and scanning the device first. If the infection cannot be removed with confidence, wipe a computer and reinstall its operating system.

Microsoft warns that a scammer with remote access may install malware or other unwanted programs. Removing only the visible remote-access app is therefore not a complete check.

RFC 6092 describes recommended security capabilities for residential and small-office IPv6 gateways. The operating principle is to allow return traffic for connections started inside and block other unsolicited traffic from outside.

The document distinguishes this filtering from the NAT address translation commonly used with IPv4. A two-router boundary must therefore be checked for both IPv4 and IPv6 traffic.

iRobot says Smart Maps are stored in the cloud rather than in the app. Sending map data can be disabled in the app’s privacy settings.

Disabling mapping also removes room cleaning, keep-out zones, schedules and other features that use the map. The source covers iRobot products; other manufacturers may work differently.

The TR-488 home-network model separates the operator’s access network, network termination, internet gateway and devices in the home. The network termination is an ONT on fibre and a modem on DSL.

The internet gateway sits between the access network and the home network. The model allows a single-box or multi-box design. TR-124 defines routing, firewall, WAN and LAN functions among the gateway requirements.

The announcement is dated 7 May 2025, reference I-050725-PSA. According to it, routers made in 2010 or earlier are unlikely to receive updates any more. Malware installs a proxy that relays other people’s traffic through the router.

The recommended actions: replace a router that has fallen out of support, install the updates that are available, switch remote management off, and restart the device.

The end of update support is a valid reason to replace a router, although the device’s age alone is not.

Kyberturvallisuuskeskus (the National Cyber Security Centre) advises checking the apparent sender and the link address before acting. The source link carries the current advice.

The English-language page explains how to file a report online or at a police station and says that 112 is for urgent situations.

Depending on the model and subscription, a Nest camera can save events or continuous video to the cloud. Supported models can also hold events temporarily in local memory during a network outage.

Google now calls the subscription Google Home Premium; its former name was Nest Aware. Recording methods vary by model and subscription. Other manufacturers may work differently.

Cloudflare’s metrics include visits, page views and page load time. Its dimensions include the site hostname and path, referring hostname, country, device type, browser and operating system.

Cloudflare’s documentation says the service does not log the URL parts after the question mark. This excludes the search term from analytics even when the site’s local search appears in the URL query string.

Cloudflare says the beacon does not use cookies, local storage, session storage or IndexedDB. The IP address arriving with the ordinary web request is discarded at the nearest Cloudflare data centre and is not stored in the core analytics database or logs.

Google says its Voice and Audio Activity setting saves Assistant audio recordings in the Google Account. Its stated purposes include improving voice recognition and reducing unintended activations. Assistant activity can be reviewed and deleted from the account.

This source describes Google Assistant. Other manufacturers’ settings and storage behaviour must be checked in their own documentation.

The study measured Samsung and LG models in the UK and US. It does not establish that every smart television model behaves in the same way.

On the tested sets, recognition covered content arriving over HDMI too. The feature could be switched off, but doing so required several settings and menu levels.

The consumer IoT guidance covers devices and their associated apps, cloud storage and other services. It calls for no universal default passwords, a public vulnerability reporting channel and a stated software support period.

It also deals separately with continued operation during network and power outages and removing personal data when a device is sold or passed on.

Google published its investigation on 28 January 2026. Enrolment code could be embedded in an app that continued to perform its ordinary function. Google also found the code in software that promised to pay people for sharing their internet connection.

Google protected certified Android devices by warning about known IPIDEA apps, removing them and blocking new installation attempts. The company estimated that its disruption reduced the pool of devices in the network by millions.

The investigation does not give consumers a complete list of every affected app or device. Normal slowness or high data use therefore does not identify IPIDEA software on its own.

The guidance says that security does not require the latest or most expensive model. It recommends avoiding a device that is no longer supported or will fall out of support soon.

NCSC also advises changing a universal default password, enabling two-step verification, disabling unused remote access, installing updates and factory-resetting a device before passing it on.

The guide expands the name Virtual Local Area Network and distinguishes tagged from untagged traffic. Tags let one link carry several VLANs between a router, managed switch and wireless access point.

Each VLAN receives a separate IP network. Traffic crossing a VLAN boundary passes through a router, where firewall rules can control it. The guide uses guest Wi-Fi as one example of a wireless network attached to a VLAN.

The guidance covers organisational VPN deployments, not the choice of a consumer service. It supports work access as a genuine use case and limits protection to traffic routed through the VPN.

NCSC says to determine the need first. If none of the benefits address that need, there is no need to use a VPN.

Published 7 December 2021, updated 30 September 2022. The test covered 16 services. The most common exaggerations concerned complete anonymity and protection from advertisers and authorities.

The report also picks out the phrase “military-grade encryption”, for which there is no agreed definition at all.

The result concerns VPN marketing in general. The study does not assess individual services.

The CHI 2025 study went through 302 web pages from 78 providers in five countries. A separate IEEE S&P 2022 study looked at influencer marketing on YouTube and found systematic exaggeration of what the product protects.

The same line of research found that even users who understand security overestimate how much protection they get, on the strength of the advertising.

The ruling is dated 20 April 2022. The ASA found the advertisement to be “excessively violent, threatening and distressing to the extent that it overshadowed any attempt at humour”, and told the advertiser to make sure its future advertisements do not cause fear or distress without justifiable reason.

The ruling concerns how the advertisement was presented. It does not assess the technical protection of a VPN service.

A VPN routes traffic through servers controlled by its provider. An encrypted VPN connection limits what a local wifi network or internet provider can see about the contents of that traffic.

The service does not make the user anonymous. Some trust shifts to the VPN provider, which may handle traffic and share information under its own terms.

A warranty is voluntary, but it cannot restrict statutory liability for defects. The end of a warranty does not end liability for a defect in the item.

The law does not tie the duration of the liability for defects to a number of years. It follows from how long a comparable item can reasonably be expected to last.

The guidance describes WPA3 Personal as the newest option, WPA2/WPA3 Transitional as the compatible choice for older devices, and WPA2 Personal (AES) as appropriate when newer modes cannot be used. WPA/WPA2 mixed mode, TKIP, WEP and open networks are listed as settings to avoid.

An SSID is the visible network name. The guidance says to leave hiding disabled because it does not prevent detection or unauthorised access.