Samsung told customers their voice data was encrypted when sent from the TV. Security researchers proved this was a lie — voice recordings were sent without encryption, meaning anyone on the same network could listen to what you said near your TV. A privacy watchdog filed a formal complaint with the FTC over this.
critical
Samsung points out their TVs don't have a built-in microphone as a privacy feature. But security researchers found that someone nearby can hack the TV remote's microphone via Bluetooth, turning it into a listening device. The "no mic in the TV" claim gives a false sense of security when the remote's mic can be hijacked just as easily.
high
Samsung says it watches what you view on your TV to give you better recommendations. In reality, the TV takes a screenshot every half second of everything on screen — including content from your gaming console, laptop, or DVD player connected via HDMI — and sends this data to Samsung's advertising servers. Samsung was sued by Texas and paid $46 million in a class action because this data was being sold for advertising, not just used for recommendations.
Samsung's Gallery app scanned your face every time you opened your photo library. Nearly 50,000 people in Illinois said Samsung never asked permission to collect their biometric data. Samsung demanded each case go to individual arbitration instead of a class action — then refused to pay for the arbitration it insisted on. A federal judge had to force Samsung to participate in its own legal strategy. That's 50,000 faces scanned without consent, and a company that won't even show up to defend the process it chose.
critical
Samsung says Bixby only listens when you tell it to. What they don't emphasise is what happens after: your voice recordings get sent to third-party companies, combined with data from your other Samsung services, and used to build an advertising profile. Common Sense Media — the organization parents trust for child safety ratings — gave Bixby a "Warning" for privacy. Samsung won't clearly say how long they keep your voice recordings or when they delete them.
high
Researchers at Trinity College Dublin bought a Samsung phone, went through setup, and unchecked every single data sharing option. Then they watched what the phone actually sent. It sent telemetry anyway — your phone's unique ID, your list of installed apps, analytics data. The researchers' conclusion was blunt: "there is no opt-out." Samsung's opt-out toggle is a placebo. 600 million Galaxy owners have a button that does nothing.
When the SmartThings Hub crashed, it secretly sent a memory dump — which could include your passwords and personal data — to a third-party service called backtrace.io, completely unencrypted. Anyone watching your network could read it. Samsung never told users this was happening.
critical
Hackers stole Samsung's SmartThings secret keys and source code in 2022, potentially letting them impersonate Samsung's servers to your hub. Samsung's privacy policy never mentioned that a single breach could compromise the security of every SmartThings device worldwide.
high
The SmartThings app can make phone calls, read your contact list, and access your phone numbers — none of which are needed to control smart lights or locks. Samsung's privacy policy doesn't explain why your smart home app needs to know who's in your address book.
Samsung says your personal data stays on your device, but the earbuds app demands access to your calendar, call history, contacts, and phone numbers. Earbuds don't need to read your call log or calendar to play music. Samsung's own Customisation Service admits it collects this data with no way to opt out.
critical
Samsung filed these with the FCC as a simple "Bluetooth Headset" but they're actually a body-worn sensor array that monitors your heart rate, head movement, speech patterns, and audio environment. The FCC filing says nothing about the health sensors or always-on microphones. A serious security flaw lets strangers secretly connect and record through the microphones — Samsung first called this "working as intended."
critical
Samsung sells Voice Detect as a handy feature that knows when you're talking. But this means the earbuds are always listening to determine if you're speaking. A proven security flaw allows strangers to secretly connect and record through the microphones. The app can also read your system logs and has internet access to send data to Samsung's servers.
Your Samsung fridge has three cameras inside that automatically take photos of your food every time you close the door. These photos are uploaded to Samsung's servers for AI analysis. Most people buying a refrigerator would not expect it to photograph them and their food.
critical
The app you need to control your Samsung fridge can record audio, make phone calls, read your contacts, and see every app on your phone. None of these are needed to manage a refrigerator.
high
The Samsung Food app that connects to your fridge's cameras contains 9 tracking tools including advertising networks from Facebook, Google, and TikTok's parent company ByteDance. Your food and eating habits may be shared with these advertising companies.
Every time you open your fridge, a camera takes a photo. Samsung keeps those photos. They say they blur anything that isn't food, which is nice, but maybe the real question is why your refrigerator is running a surveillance camera trained on a million images in the first place.
critical
A researcher cracked open a Samsung fridge's data and found it hoarding Bluetooth IDs from nearby phones, your WiFi password, location, music listening history, and food photos. Your fridge knows more about your daily routine than your spouse does.
critical
Samsung says it blurs your face in fridge photos, which is a weird sentence to write about a kitchen appliance. They admit it might capture your body and crop it afterward. No hardware kill switch. The AI updates itself, so what it recognizes tomorrow might differ from today.
Samsung says your fingerprint and face data never leave your phone. But their own Samsung Members app has deep access to your biometric sensors AND contains advertising trackers from Adobe and Google. Your biometric data might stay on your phone, but information about when and how you use biometrics could be tracked and sent to advertisers.
critical
Samsung advertises Knox as making your phone ultra-secure. But their phone was hacked by commercial spyware that could record your microphone and steal your photos — just from receiving an image on WhatsApp. They had to patch 34 security holes in a single month. Knox also lets Samsung remotely lock or wipe your phone — they have a backdoor to a device you own.
critical
You bought and paid for your Galaxy S24, but Samsung still controls it. They can remotely lock or wipe your phone, silently install or remove apps, change your cellular settings, and force software updates — all without asking you. Your phone has the same remote control features that a company IT department uses to manage employee devices.
Samsung says your SmartTag location is private and protected by rotating IDs that change every 15 minutes. But security researchers found that an attacker can extract a secret key from the tag that lets them decode ALL those rotating IDs — forever. This means someone who gets close to your SmartTag once could track it indefinitely, defeating the privacy protections Samsung advertises.
critical
Samsung says it protects you from being stalked with SmartTags. But the detection feature is turned OFF by default — you have to know it exists and manually enable it. Researchers tested it and found it failed to detect SmartTags anyway. If you do not own a Samsung phone, you have virtually no way to know if someone planted a SmartTag on you. The anti-stalking protection is more of a marketing checkbox than actual safety.
critical
Samsung markets the SmartTag 2 as great for families and kids' items. But if you create a Samsung account for your child to use it, Samsung's policy allows them to collect your child's location, photos, videos, health data, and contacts — and share this data with "business partners" for purposes like "developing new products." Your child's location data is not just used to find lost toys — it feeds Samsung's data machine.
Samsung admits in legal language that sharing your data with advertisers may count as 'selling' your personal information. Independent reviewers at Mozilla rated the Galaxy Watch as a privacy nightmare. Samsung was also caught and sued by the Texas Attorney General for secretly tracking what people watch on their Samsung TVs. This pattern of hidden data selling extends across all Samsung devices including the Galaxy Watch, which collects far more intimate data than a TV — your heart rate, sleep patterns, body composition, and location 24/7.
critical
When you wear a Samsung Galaxy Watch 6, your health data and usage patterns are sent to two different companies — Samsung and Google — because the watch runs Google's Wear OS software with Samsung's overlay on top. Samsung's privacy policy mentions using Google Analytics but doesn't make it clear that every time you check your heart rate or track a workout, both Samsung and Google are receiving that information. You're effectively being monitored by two tech giants simultaneously.
critical
The Galaxy Watch 6 with LTE has its own cell phone connection. This means it can send your heart rate, location, sleep data, and activity patterns directly to Samsung and Google servers even if your phone is turned off or left at home. The FCC filing that approved this radio capability just calls it a 'Smart Wearable' without mentioning that it's essentially an always-connected health monitoring device that can report back independently.
Samsung describes its Customisation Service as helping you discover products you might like. In reality, it tracks your web browsing, analyses your text messages to figure out who your closest friends are, logs where and when you take photos, and monitors your precise location. The Galaxy Ring feeds your most intimate health data — heart rate, sleep quality, stress, menstrual cycles — into this same system, which Samsung uses to build advertising profiles and show you targeted ads.
critical
The Galaxy Ring only has Bluetooth — no Wi-Fi, no cellular — which sounds privacy-friendly. But that just means all your biometric data gets sent to Samsung's analytics and advertising servers through your phone instead. The ring's simple design masks the fact that your heart rate, sleep patterns, and health data still end up on Samsung's servers, where Samsung reserves the right to use it for purposes beyond what the ring needs to function.
critical
The Galaxy Ring tracks your menstrual cycle using skin temperature and heart rate patterns. Samsung's health app shares data with Google through embedded trackers. In a post-Dobbs America, your menstrual cycle data — collected 24/7 by a ring you wear while sleeping — could be accessed by law enforcement through Samsung or Google. Samsung's privacy policy explicitly allows sharing data in response to 'legal process,' and the data passes through Google's servers via embedded analytics trackers.
Samsung sells you an $800 tablet and shows you ads in the weather app, payment app, and game launcher. The operating system itself is an advertising platform — and they call this "prioritizing your privacy."
high
Spyware designed for Samsung devices exploited a bug for 8+ months before Samsung fixed it. Your tablet's quarterly schedule meant even longer exposure than Samsung phones.
medium
Samsung calls it "customization" but it reads your texts, analyzes who you call most, scans your calendar, and tracks every website you visit — all to show you ads. This is on by default on a device you paid full price for.
You never downloaded Samsung Health. It came on your phone. It's counting your steps right now. On a billion Galaxy phones worldwide, Samsung is passively collecting health data from people who never asked for a fitness app. Your step count, your activity level, your sleep patterns — collected by default, shareable with partners, integrated with Samsung's ad platform.
high
Samsung's "Customisation Service" is an ad targeting system enabled by default on your phone. Your Samsung Health data — how active you are, how well you sleep — feeds into the same profile used to serve you ads. The Italian DPA fined Samsung €2 million for deceptive consent. Your health data and your ad profile share a database. Samsung calls it customisation.