We know there's a disconnect. That's exactly the problem.

Without discussing these things, the bar for 'normal' will simply continue moving.

Consider that in 2018 the term 'spyware' has essentially become meaningless because outside of FOSS products for power users and a few systems for enterprise _everything_ is doing it.

I won't buy my family products that spy on them and will recommend them against buying such. They need a moderating influence that understands the issues and doesn't have a vested interest in screwing them over like advertisers do.

Perhaps, but I don't think the solution to the ever-increasing number of devices collecting and distributing ever-increasing amounts of personal data is to shrug and say "well, at least it's not as intrusive as my toaster. Now there's some Orwellian shit". I think it is useful in and of itself to make people aware of the sorts of data that is collected and shared by devices most people don't consider at all related to privacy.

Agreed. Just for starters, there are two tied bad practices here. One is that the "creepy mater" is based on "user ratings" apparently despite being a curated Mozilla branded list. That immediately opens it up too all the normal random masses using it as a medium for non-relevant opinions, trolling, etc. Further it means that they have a list with nothing at all that isn't "A little creepy" so even if someone thinks "well then what should I buy?" there is no answer, which invites a "well whatever" attitude in and of itself.

Further as you point to, a lot of the "creepiness" factor is a function of the delta between expectations and reality, ie. how surprising it is, and the extent to which it's perceived to be avoidable. That can be different then absolute measures of how objectionable something is. To take your example, an internet connected game console these days has some upfront expectation of data collection by virtue of the profile and social features that are right there front and center. Since it's also generally static in a fixed location and used only for a specific purpose, the surprise factor of most of its privacy issues is inherently lower, and the data collection less passive. A cooking tool though might be a lot more subject to surprise at what it's doing.

This list definitely feels very shallow and disconnected from any deeper reasoning about specific security practices, business models, whether a net connection is actually required or not, etc. It's a popularity poll at best, and the actionable advice is minimal. It's a bit disappointing coming from Mozilla, at least to the extent that it's a wasted opportunity on something that the public is growing more aware of.

take the nest

'has parental controls': can't determine

well, it's a blooming thermostat. You can lock the thing out.

That's more 'parental control' than any standard thermostat.

creepy meter? as a gift for a non-family member? yeah, that's weird.

Standard anecdata disclaimer but Nests are a pretty universally liked gift in my circle. It passes the bar of being cool, tasteful, useful, and unlikely that the recipient would purchase one for themselves.