That said, I'm not sure you can really pin this down. It's probably better to just assume that any device that requires a wi-fi connection to work is phoning home until proven otherwise.
And you have to assume that any device that phones home is collecting data. It's not even a secret that this is the case. Pretty much every time I go to a lunch-and-learn for a data product, the major premise of the obligatory client case study is, "We sell this consumer product that does X, but our most exciting product is actually all the data we can harvest from it and then resell."
It's really beyond me why people are buying these devices in case the wifi functionality is completely superfluous and has nothing to do with the main function of the device. It's like asking "hello strangers, tap me and track what I'm doing". This crap needs to stop.
This is IMHO a broader issue with products that receive firmware or OTA updates, it's probably legally a breach of contract already to modify products after sale and change functionality to the disadvantage of the consumer.
A common crypto algorithm gets broken to a degree where it is phased out of use industry-wide to prevent leaking user data, MitM attacks, etc.
But once you flip the switch on that old crypto algorithm, your old devices can no longer be updated without a complex manual process (good luck getting the group of users who have never updated to do that,) and the devices will stop working with any secure online connectivity the users have been used to having (purchasing, downloading, etc.)
You have been trying to let users choose how they use their devices, but now they are upset that you broke their product, which they purchased in a working state. What do you do? This is a very small number of people and the years of accommodating them is getting very expensive, but you want to do right by them.
Offer the old crypto algorithms as a configuration option, or offer 2 versions of the firmware (standard vs. compatibility). Can't be prohibitively expensive, but isn't necessary when it's in the clear interest of customers not to use these old algorithms.
But if you continue to 'support' the legacy algorithm to keep things working for those users, you also open them up to attack and they will surely complain if someone steals their information from "your service".
Roku/NowTV modified the device by connecting to it without authorisation and removing the ability to sideload.
In theory that's a breech of the UK Computer Misuse Act (similar to CFAA in USA), both in the access and separately in the modification.
In practice there's not much one can do, just never buy Sky/NowTV or Roku products ever again.
Moved to FireTV, installed the same app from the app store. Now we get Netflix instead.
It does seem to me that once a product is purchased, it ought to remain usable and supported under the terms it was purchased under, but that seems a long way from the current laws around user agreements.