A quarterly smart-home privacy audit for cameras, microphones, accounts, and the network
Review who can see and hear the home, what gets stored, which integrations still connect, and whether the router and devices can still be secured and updated.
Privacy settings drift. A dog sitter’s camera invitation survives the trip. A voice skill keeps its account link. An indoor camera that once watched an empty house now points at everyday family life. None of those changes appears on a battery-replacement calendar.
Quarterly is an operating rhythm, not a security guarantee. The audit should end with a dated inventory, a few deliberate changes, and an owner for anything that could not be explained.
The short answer
Once each quarter, reconcile the physical devices in the home with the router’s client list, platform accounts, shared users, third-party integrations, recordings, microphone settings, update status, and retirement plan. Review access and data paths before changing settings. Preserve evidence of anything unknown, then revoke, isolate, update, or remove it through the documented owner controls.
Walk the rooms before opening the apps
Start at the front door and list every camera, doorbell, speaker, display, television, lock, thermostat, sensor, hub, bridge, appliance, robot, and forgotten plug. Mark cameras or microphones in bedrooms, work areas, children’s spaces, and guest areas for a higher-privacy decision. Check what each lens can capture beyond the intended area, including neighboring property and shared walkways. Confirm visible privacy shutters, microphone-mute controls, and status lights work as described by the manufacturer rather than assuming an app toggle covers every recording path.
Reconcile accounts, people, sessions, and recovery
Open the household platform, then each camera, alarm, lock, router, storage, and vendor account. Name the primary owner and verify the recovery email and phone. Remove former residents, old guests, contractors, unused household profiles, stale device sessions, and access that no longer has a purpose. Give each person an individual login where supported instead of sharing the owner password. Use unique passwords and multifactor authentication. Check digital keys, keypad codes, monitoring contacts, shared video links, and installer access separately because they may not appear in the main household list.
Ask five questions about every camera and microphone
What triggers capture? Is audio recorded? Where do live video, clips, thumbnails, transcriptions, and backups go? Who can retrieve them? When are they deleted? Review zones, schedules, continuous recording, event history, facial or person recognition, voice history, human review, diagnostic uploads, and data-sharing controls. Use the least collection that still serves the household’s stated purpose. An indoor camera left enabled because storage is cheap has the privacy decision backward; first justify the view, then choose retention.
Inspect the network and update path
Compare the room inventory with the router’s connected-client list. Confirm router firmware and automatic-update settings, WPA3 Personal or WPA2 AES encryption, a unique administration password, and whether remote management, WPS, or UPnP is enabled. CISA recommends disabling those three services. A guest or IoT network can reduce access to personal devices when correctly configured, but some local discovery and control paths need communication across networks. Do not move locks, alarms, hubs, or Matter and casting devices blindly; document the required path and test after one change.
Use the NIST baseline as a keep-or-retire screen
NISTIR 8259A’s technical baseline asks whether an IoT device can be identified, configured only by authorized entities, protect stored and transmitted data, restrict logical access to interfaces, receive secure updates, and report its cybersecurity state. Apply those questions in plain language. Can you identify the exact model? Can you remove old access? Is there a supported update path and a stated support life? Can you tell when an update fails? A functioning device with an abandoned account or no security-update path belongs on a replacement or isolation list.
Review integrations as separate doors
List voice skills, automation services, home-sharing links, cloud-storage exports, webhooks, assistants, television accounts, and connections between platforms. For each one, record what it can read, what it can control, and whether it can unlock, disarm, open, view, listen, or export data. Remove unused links from both ends when possible, then test the remaining automation. App permissions on household phones matter too: microphone, camera, precise location, contacts, photos, Bluetooth, local-network access, and background activity should match features people still use.
Close the quarter with proof and a removal queue
FTC allegations against camera provider Verkada included failures involving password controls, encryption, and network controls; the agency said a 2021 breach gave a hacker access to more than 150,000 live customer cameras plus other information. A polished privacy claim is not a substitute for controllable settings and maintained security. Export the revised inventory, record the changes, set follow-up dates for unresolved devices, and erase and remove retired equipment using the manufacturer’s procedure. My view: a camera or microphone that no one can clearly own, update, and delete data from should not remain connected inside the home.
Put the guide to work
Field notes
- Audit evidence
- Save the date, account owner, device model and location, router client name or address, software version, update setting, recording destination, retention choice, microphone state, shared users, integrations, and action taken.
- Unknown does not mean hostile
- Routers often show private addresses, vague vendor names, or duplicate-looking clients. Photograph or export the entry, compare device labels and recent additions, and isolate it through supported controls if necessary. Do not accuse a household member or erase evidence on a guess.
- Use two viewpoints
- Review both the central platform and the manufacturer account. A person removed from one home may retain access in a camera, alarm, lock, cloud-storage, installer, or voice-assistant account.
Make the next step useful
Put this guide on your home plan
Know when to call a professional. Stop if work involves active gas leaks, damaged service wiring, structural movement, unsafe heights, suspected contamination, or a problem you cannot confidently isolate.
Editorial review and sources
Reviewed by: Smart Homeowners Editorial Desk
Last reviewed: September 20, 2026
Original Smart Homeowners editorial; not adapted from a third-party article.
