Google’s discontinued Nest Learning Thermostats (1st and 2nd Gen) continue to upload detailed home data to Google servers even after losing remote control features, raising significant privacy concerns. A security researcher, Cody Kociemba, found that these devices still send logs to the company’s servers, despite official support being discontinued. This discovery highlights potential data privacy risks for users who assumed the connection would end once smart features were no longer available.
Kociemba uncovered this data flow while participating in a right-to-repair challenge. He was restoring smart functionality to unsupported Nest devices as part of a project with the FULU right-to-repair group, cofounded by Louis Rossmann. The challenge encouraged developers to build tools that restore lost smart features for abandoned devices. During his work, Kociemba noticed an unexpected data upload from customer devices, prompting a deeper investigation into what Google still collects.
The research revealed that even though remote control functions have been disabled, the early Nest Learning Thermostats continue transmitting a steady stream of sensor data to Google. This includes information on temperature settings, scheduling adjustments, and system diagnostics. The data flow remains consistent despite the official discontinuation of support, creating a one-way connection that benefits the company more than the user. Google previously stated that unsupported models would ‘continue to report logs for issue diagnostics,’ but the continued uploads raise questions about how these logs are used and whether they should still be shared.
Google explained that diagnostic logs, which are not tied to a specific user account, are sent to the company for service and issue tracking. Users can opt out by disabling Wi-Fi access through the device’s settings menu, but many assumed the connection would end once remote control was removed. This highlights the ongoing data collection practices of tech companies and the need for greater user transparency regarding data sharing, even after product discontinuation.
The discovery has sparked debates about user control over their data and the responsibility of technology companies when their products are no longer supported. As more devices become obsolete, the challenge of balancing data collection with privacy remains a critical issue. Users are encouraged to review their connected devices and take steps to limit data sharing, especially if they are using older models that continue to communicate with online services despite losing their primary functionality.