Google says your doorbell processes video locally on the device for privacy. But all the event clips still get uploaded to Google's cloud servers. The local processing just decides what to send — your footage still ends up on Google's computers. Google says you can always access and delete your doorbell footage. But when the FBI needed video in the Nancy Guthrie case, Google recovered footage from behind-the-scenes systems that the user couldn't even see in the app. Your video doesn't truly disappear when you think you've deleted it.
What they claim: Google Nest marketing highlights "TLS/SSL with 128-bit AES" encryption and states devices use "Verified Boot" and automatic security updates. Google commits to "at least 5 years" of security updates.
What we found: CVE-2024-44097 (CVSS 9.8 Critical) revealed the Nest Doorbell firmware before version 1.73c did not properly validate TLS server certificates. This allowed any network attacker to intercept video streams and credentials via man-in-the-middle attack — completely negating the advertised TLS/SSL encryption. The vulnerability affected all Nest cameras and doorbells.
What they claim: Google states: "we will keep your video footage, audio recordings and home environment sensor readings separate from advertising."
What we found: The Google Home app (com.google.android.apps.chromecast.app) requires a Google account, linking doorbell data to the same profile used for search, YouTube, Gmail, and Maps. App includes Google Firebase Analytics tracker. App requests QUERY_ALL_PACKAGES (can see all installed apps), READ_CONTACTS, GET_ACCOUNTS, and ACCESS_FINE_LOCATION. Google's own policy admits "specific partners" can "collect information from your browser or device for advertising purposes using their own cookies." While video itself may not directly feed ad targeting, the Google account linkage means the metadata (when you come home, when you have visitors, how often you leave) enriches the same advertising profile.
What they claim: Google Home app requests ACCESS_FINE_LOCATION and ACCESS_COARSE_LOCATION permissions, ostensibly for device setup and local control.
What we found: Google paid $391.5 million in November 2022 — the largest AG-led consumer privacy settlement in US history — for deceiving users about location tracking. Google continued tracking location even after users disabled Location History via the hidden Web & App Activity setting. The same deceptive infrastructure applies to the Google Home app which requires a Google account and accesses fine-grained GPS location.
What they claim: Google's Nest privacy commitments state data is kept separate from advertising and users have control. The Familiar Faces feature uses facial recognition to identify frequent visitors.
What we found: Mozilla Privacy Not Included review confirms Google collects "facial recognition data" from Nest cameras and doorbells. Google's privacy policy does not fully disclose where biometric facial recognition data from Familiar Faces is stored or how long it is retained. Multiple states have biometric privacy laws (Illinois BIPA, Texas CUBI) that require explicit consent for facial recognition data collection. Google's Nest privacy page does not mention "biometric" or "facial recognition" in its commitments.
What they claim: A video doorbell needs camera access, network access, and notification permissions to function. The device hardware supports Wi-Fi, BLE, camera, mic/speaker, and PIR motion detection.
What we found: Google Home app requests 37 permissions including CALL_PHONE (make phone calls), READ_CONTACTS (read contact list), GET_ACCOUNTS (access accounts on device), QUERY_ALL_PACKAGES (see all installed apps), MANAGE_ACCOUNTS, WRITE_EXTERNAL_STORAGE, BILLING, and RECORD_AUDIO. Most of these are unnecessary for a battery-powered video doorbell. QUERY_ALL_PACKAGES is particularly concerning as it lets Google inventory every app on your phone.
What they claim: Google commits to "at least 5 years" of automatic critical security updates for Nest devices and uses Verified Boot for software integrity checking.
What we found: CVE-2024-44097 was a CVSS 9.8 critical vulnerability that allowed complete interception of video streams. The vulnerability existed in all Nest cameras and doorbells. Google publishes quarterly security bulletins (March, June, September, December 2024) suggesting patches may not be immediate. For a device recording the entrance to your home 24/7, any period of exposure to a 9.8 CVSS vulnerability represents a serious security gap, despite Google's commitment to regular updates.
What they claim: Google Nest privacy commitments state: "When video footage is stored with your Google Account, you can access, review and delete this footage at any time" and "You are always in control of your devices and settings."
What we found: In the 2026 Nancy Guthrie case, FBI investigators recovered Nest camera video from Google's "backend systems" even after footage was no longer visible to the user in the Google Home app. Recovery took several days of complex technical work. This proves Google retains video data in backend infrastructure beyond what users can see or delete through the app.
What they claim: Google Nest privacy page promises: "We will only share video footage with third-party apps and services if you or a member of your home explicitly gives us permission."
What we found: Google confirmed in July 2022 it will share Nest doorbell and camera footage with law enforcement without a warrant in "emergency" situations under the ECPA exception. Google defines the emergency threshold itself. Unlike Ring, Google has not published specific numbers of warrantless disclosures for Nest devices. The policy page's promise about sharing "only with permission" does not mention the law enforcement exception.
What they claim: Google markets Nest Doorbell as a home security device. Privacy page states device usage data is "not used for ad personalization" when interacting directly with the device.
What we found: The doorbell requires a Google account — the same account used for Gmail (email content), YouTube (viewing habits), Google Search (search history), Google Maps (location history), and Chrome (browsing). The Google Home app includes Firebase Analytics tracking. While Google claims the doorbell data itself is not used for ad personalization, the Google account creates a comprehensive behavioral profile: when you leave home, when you return, how many visitors you receive, combined with your search, email, and location data — all under one profile owned by the world's largest advertising company.
What they claim: Google Nest privacy page states: "these on-device camera-sensing features don't send video or images... to Google" and markets on-device ML for person/package/animal/vehicle detection as a privacy feature.
What we found: Firmware analysis shows 9 hardcoded Google cloud endpoints including home.google.com, firestore.googleapis.com, and www.googleapis.com. All event clips are uploaded to Google's cloud infrastructure. Google Home Premium (Nest Aware) stores up to 60 days of continuous video in the cloud. The on-device ML only determines what to upload — the footage itself still goes to Google's servers.