This is worse, in a way - from what I can tell at the point of purchase the system didn't have the problematic data collection - that was added later in an update. Even a savvy consumer who researched which product to buy would be screwed in this circumstance.

It does seem to me that once a product is purchased, it ought to remain usable and supported under the terms it was purchased under, but that seems a long way from the current laws around user agreements.

The law could include a ban on firmware updates that subsequently introduce and require sensitive data collection post-purchase.

That said, I'm not sure you can really pin this down. It's probably better to just assume that any device that requires a wi-fi connection to work is phoning home until proven otherwise.

And you have to assume that any device that phones home is collecting data. It's not even a secret that this is the case. Pretty much every time I go to a lunch-and-learn for a data product, the major premise of the obligatory client case study is, "We sell this consumer product that does X, but our most exciting product is actually all the data we can harvest from it and then resell."

> any device that requires a wi-fi connection to work is phoning home until proven otherwise.

It's really beyond me why people are buying these devices in case the wifi functionality is completely superfluous and has nothing to do with the main function of the device. It's like asking "hello strangers, tap me and track what I'm doing". This crap needs to stop.

I think this should be approached more broadly, making void any clause on contracts that allow unilateral modification on the contract at a later date

> The law could include a ban on firmware updates that subsequently introduce and require sensitive data collection post-purchase.

This is IMHO a broader issue with products that receive firmware or OTA updates, it's probably legally a breach of contract already to modify products after sale and change functionality to the disadvantage of the consumer.

Example off the top of my head: you have devices in the field which have not received an update since they were purchased 10 years ago.

A common crypto algorithm gets broken to a degree where it is phased out of use industry-wide to prevent leaking user data, MitM attacks, etc.

But once you flip the switch on that old crypto algorithm, your old devices can no longer be updated without a complex manual process (good luck getting the group of users who have never updated to do that,) and the devices will stop working with any secure online connectivity the users have been used to having (purchasing, downloading, etc.)

You have been trying to let users choose how they use their devices, but now they are upset that you broke their product, which they purchased in a working state. What do you do? This is a very small number of people and the years of accommodating them is getting very expensive, but you want to do right by them.

> What do you do?

Offer the old crypto algorithms as a configuration option, or offer 2 versions of the firmware (standard vs. compatibility). Can't be prohibitively expensive, but isn't necessary when it's in the clear interest of customers not to use these old algorithms.

The issue is that you cannot forcibly update devices; not all users accept them, often because of the concerns which were being discussed in this thread.

But if you continue to 'support' the legacy algorithm to keep things working for those users, you also open them up to attack and they will surely complain if someone steals their information from "your service".

I bought a Roku via NowTV, and used it for NowTV and sideloaded an app for local media display on our TV (music, family photos).

Roku/NowTV modified the device by connecting to it without authorisation and removing the ability to sideload.

In theory that's a breech of the UK Computer Misuse Act (similar to CFAA in USA), both in the access and separately in the modification.

In practice there's not much one can do, just never buy Sky/NowTV or Roku products ever again.

Moved to FireTV, installed the same app from the app store. Now we get Netflix instead.

You mean the contracts saying that the vendor gets to do exactly that that we all sign without reading?

I prefer the EU approach where the collection and use of personal data is regulated, not merely "be warned."

What difference does it make in practice? Sonos sells their products in the EU as well, do they behave differently there?

The difference is that they can be sued here in the EU now.

They don‘t.

The label would be useless at this point. You know how in California everything causes cancer? This would be the same.

CLASS 1 SURVEILLANCE PRODUCT