Bridging Devices and Apps: A Joint Analysis of IoT Privacy and Communication

Abstract

Internet of Things (IoT) devices automate everyday tasks, from managing home security systems to optimizing energy usage. Their mobile companion apps often act as a user interface and provide (remote) control for convenience’s sake. However, both devices and apps can collect and transmit significant amounts of personal data. In this paper, we perform a joint measurement study of IoT devices and their companion apps, focusing on privacy implications. We develop an approach for automated experimentation with devices and their apps to understand the extent of data sharing and how network settings (LAN vs. WAN) affect data transmission. Performing over 2,040 experiments with 34 IoT devices, our findings reveal that while a small percentage of devices directly contact third parties, the majority of companion apps do so, highlighting their significant role in posing privacy risks in the IoT ecosystem. We further compare our observed data flows with privacy policies and data-access responses, and find critical GDPR compliance issues. Our study highlights the importance of increased transparency and enforcement of data protection across components of the ecosystem.