SmartThings

Is SmartThings safe?

For most homes, yes. SmartThings has no regulator action against it that we could find and no known breach, which is more than many smart home apps can say. The catch is a gap in Samsung's own paperwork. Apple's privacy label for the app says nothing is linked to you and nothing is used to track you, while the SmartThings privacy notice describes collection of camera video and audio, voice commands, sleep data and, if you turn on personalised services, the apps on your phone and the websites you visit. We score SmartThings 68/100, well ahead of Ring at 57.

What data does SmartThings collect?

More than the App Store suggests. Apple's label, filled in by Samsung, lists precise and coarse location, name, email, phone number, user and device IDs, usage data and diagnostics, all marked "not linked to you". That is hard to square with an app that needs a Samsung account, a phone number and a list of your registered devices to work at all.

The SmartThings privacy notice is more candid. It covers:

• video and audio from connected cameras, including live streams, shared clips and anything sent to the AI video analysis feature
• voice commands, which pass through SmartThings servers, and Bixby audio if you connect it
• sleep data such as wake-up time and total sleep, used for routines and sleep reports
• medication schedules, symptoms and step counts if you use Family Care, and the care recipient's location if they agree to share it
• food photos taken inside a Samsung Family Hub fridge when the door opens
• precise location from GPS, Bluetooth and Wi-Fi, which the app can use in the background

The advertising rules are better than the collection list. Samsung says it uses SmartThings data for ads on its other services only if you give a separate consent called "Improved personalized ads with Samsung account data". The broader Samsung US policy, updated in July 2026, still allows personalised advertising and treats some ad-tech data sharing as a "sale" under state law, with an opt-out.

How secure is SmartThings?

Reasonably, with a steady trickle of fixes. The most serious recent flaw was CVE-2025-2233, published in March 2025 through Trend Micro's Zero Day Initiative. It sat in the hub's local API on port 8766, which did not properly check a cryptographic signature, so anyone on the same network could bypass authentication. It scored 8.8 out of 10, though an attacker had to be on your network first.

The app has its own list. Samsung has published about 20 SmartThings CVEs since 2021, among them a 2024 flaw that let a household member keep access past the expiry date the owner had set (fixed in version 1.8.17) and an August 2026 access-control bug that exposed sensitive information to a local attacker (fixed in 1.8.47.24). Researchers at Cisco Talos found 20 flaws in the older SmartThings Hub in 2018, all since patched.

Samsung runs a bug bounty for apps its mobile division develops and signs, paying from $200 to $1 million, though the program page does not name SmartThings. Your account is a Samsung account, so its password and two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary are your main defence. There is no end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary for camera feeds routed through SmartThings.

Who should be careful?

People sharing a home with someone they do not trust. SmartThings can show who is home, when doors open and what cameras see, and anyone added as a member gets much of that view. SmartThings Find, built into the app, also locates Galaxy phones and SmartTag trackers. Samsung added a scan for unknown SmartTags in 2021 so you can check whether one is travelling with you.

Parents should know the app is rated 13+ on the App Store and Samsung says its services are not aimed at children under 13.

How to set up SmartThings safely

1. Turn on two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary for your Samsung account and use a password you use nowhere else.
2. Leave automatic updates on for the app, any hub and connected devices. Most of the flaws above were fixed this way.
3. Skip personalised services and the "Improved personalized ads" consent unless you want them. They are what unlock the app-list and cross-service ad uses.
4. Review household members every few months and remove anyone who has moved out.
5. Put smart home devices on a guest or separate Wi-Fi network, so a flaw like the 2025 hub bug cannot be reached from a visitor's laptop.
6. If you are in the US, use Samsung's privacy rights page to download or delete your data and to opt out of sale and targeted ads.

For a camera-first comparison, see Google Home, which also runs Nest cameras, and TP-Link Tapo.

How we scored it

The regulatory record (86) and the low content risk (80) carry SmartThings: no regulator has acted against the app, and it has no public feed for scams or abuse. Privacy (60) is its weakest factor because we score Samsung's privacy notice rather than the cleaner App Store label. Security (66) reflects no known breach, offset by the 2025 hub bypass, regular app CVEs and no end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary for cameras.