Google is still collecting detailed data from first- and second-generation Nest Learning Thermostats, even after users disabled remote control and officially ended support for these devices. Security researcher Cody Kociemba discovered that these devices continue to send information about temperature changes, motion, and ambient light to Google, despite the remote functionality being turned off. Kociemba made the discovery while participating in a bounty program created by FULU, a right-to-repair advocacy organization cofounded by electronics repair technician and YouTuber Louis Rossmann.
FULU challenged developers to come up with a solution to restore smart functionality to Nest devices no longer supported by Google, and that’s exactly what Kociemba did with his open-source No Longer Evil project. However, after cloning Google’s API to create this custom software, he started receiving a trove of logs from customer devices, which he turned off. “On these devices, while they [Google] turned off access to remotely control them, they did leave in the ability for the devices to upload logs. And the logs are pretty extensive,” Kociemba tells The Verge. “I was under the impression that the Google connection would be severed along with the remote functionality, however that connection is not severed, and instead is a one-way street,” Kociemba says.
This discovery highlights potential privacy concerns for users of discontinued Nest devices, as they may still be transmitting data to Google despite no longer receiving updates or remote control capabilities. The situation raises questions about how companies handle data collection from devices that are no longer actively supported, and whether consumers are fully aware of these ongoing data transmissions.