What we found
E355: CYour smart meter broadcasts your real-time energy usage over radio waves inside and around your home.
ZigBee HAN broadcasts real-time energy usage data via IEEE 802.15.4 radio at 2.4 GHz inside the home. Any device with a compatible ZigBee receiver within radio range can potentially intercept this data. Smart meter data has been used by police to identify cannabis grow operations — documented in Australian court cases where electricity consumption patterns were used as evidence. The HAN interface creates an additional attack surface for household surveillance.
Pulsar Plus: CAn app that controls your car charger collects your face scan for facial recognition and shares it with unnamed third-party companies that specialise in iden...
The myWallbox app (v2.104.0) requests CAMERA permission — needed for facial recognition features disclosed in the privacy policy. However, for an EV charger companion app, camera and biometric data collection is extreme overreach. The policy also discloses sharing biometric data with "suppliers of systems for the recognition and identification of users by face, fingerprint or voice" — third-party biometric processors for a charging app.
GEN24 Plus: CFronius inverters had a secret admin account called "today" that gave anyone full control if they knew the public device ID.
Fronius Solar.web Terms state that system operators can grant "Maintenance rights" allowing third parties to view data, generate reports, and modify settings. Fronius Technical Support can "assume the customer login to intervene directly." The backdoor account provides the same level of access but without customer knowledge or consent. Combined with the unauthenticated Modbus TCP interface, any device on the home network — or anyone with the public device-ID — could access or control the inverter.
IQ Gateway: CEnphase says they don't sell your data, but their app includes advertising trackers and requests your advertising ID.
The Enphase Enlighten companion app (v4.1.0) includes Google Analytics, Google Firebase Analytics, Google Tag Manager, and Google CrashLytics trackers, plus requests the AD_ID permission for advertising identification. These trackers share user behavioral data with Google for targeted advertising purposes — a form of data exchange that multiple US state privacy laws classify as a "sale."
Smart Meter (EDMI Atlas / Landis+Gyr E355): CIntellihub says they only collect data you give them voluntarily.
AEMC rule change mandates 100% smart meter installation by 2030 with no opt-out provision. Meters automatically record energy usage at 5-minute intervals. Data collection is compulsory under Australian energy regulation, not voluntary.
Powerwall 3: CTesla says it aims to collect a minimum amount of personal data.
Tesla collects: customer registration data, vehicle/energy product identification, telematics data on Powerwall performance/usage/operation/condition, battery use management, energy generation and consumption data, grid import/export metrics, and system configuration. VPP participants must share: name, address, energy usage patterns, utility account number, device information, and all data generated from the Powerwall. This data flows to owner-api.teslamotors.com, fleet-api.prd.na.vn.cloud.tesla.com, energysite-api.tesla.com, and hermes-prd.tesla.com.
Wall Connector Gen 3: CTesla says they only collect the minimum data needed to run your charger.
The Tesla companion app requests 40 permissions including ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION, CAMERA, RECORD_AUDIO, READ_CONTACTS, READ_CALENDAR, WRITE_CALENDAR, CALL_PHONE, and UWB_RANGING. A wall charger has no functional need for microphone access, calendar read/write, contact list access, phone calling capability, or camera access. These permissions far exceed what is needed to monitor charging status.