Collects MAC addresses of ALL connected devices plus device brands, RSSI, connection types. MAC addresses uniquely identify specific devices. Combined with ISP and geolocation, creates complete household device inventory.

The Nest WiFi Pro defaults DNS to Google Public DNS (8.8.8.8/8.8.4.4), routing every domain name lookup for every device in the household through Google's servers. While the router itself may not "track" websites, Google as a company receives a complete log of every domain every device resolves. Google Public DNS handles the DNS queries — meaning Google knows every website visited by every device on the network. The claim of not tracking websites is technically narrow: the router hardware doesn't log URLs, but Google's DNS infrastructure receives the same information by default.

PACKET CAPTURE (10-minute clean capture, 23 March 2026): The modem at 192.168.1.1 broadcasts NetBIOS name service announcements via UDP port 138 to 192.168.1.255 (local broadcast). Packet payload contains SMB MAILSLOT\BROWSE datagrams advertising the device as 'VX420-G2V' in workgroup 'WORKGROUP'. This means the modem runs SMB/NetBIOS services — Windows file-sharing protocols that are a well-known attack vector (EternalBlue/WannaCry exploited SMB). A router has no legitimate need to advertise file-sharing services. This exposes the device name to network enumeration and increases the attack surface unnecessarily.

Amazon Sidewalk was enabled by DEFAULT on all eero routers in June 2021, sharing up to 80 Kbps of home bandwidth (500 MB/month) with nearby Amazon devices including Ring doorbells, Echo speakers, and Tile trackers — without asking user permission. Consumer Reports noted Amazon was "helping themselves to your network without asking permission." Users had to actively discover and opt out. This effectively turned every eero router into an Amazon surveillance infrastructure node.

In the 2021 data breach, employee Nickolas Sharp stole gigabytes of confidential data from AWS servers and GitHub repositories using standard employee access credentials — demonstrating that customer data stored in Ubiquiti cloud infrastructure was accessible to individual employees. Ubiquiti initially downplayed the breach as a "third-party cloud provider" incident rather than disclosing the true scope. The breach exposed source code, cryptographic secrets, and customer credentials.

The TP-Link Tether companion app (com.tplink.tether v4.12.212) includes Google Firebase Analytics tracker which collects user behavior data, and requests BILLING permission for in-app purchases. The policy carefully avoids stating they do not sell personal data — only that they do not use it for interest-based ads, leaving the door open for other forms of data monetization.

Community users documented the Deco M5 making unprompted DNS queries for netflix.com, amazon.com, reddit.com, and youtube.com even when no devices are actively browsing and Parental Controls are disabled. These queries occur even in AP mode when the Deco should not be performing DNS resolution at all.

The Deco app (com.tplink.tpm5) requests 27 permissions including CAMERA, ACCESS_FINE_LOCATION, BLUETOOTH_PRIVILEGED, READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE, and SYSTEM_ALERT_WINDOW. A mesh WiFi router management app has no legitimate need for camera access, storage read/write, or privileged Bluetooth operations beyond initial setup.