The United States has a lot of government agencies that are supposed to protect us from dangerous products.
There’s the Consumer Product Safety Commission, or CPSC, which deals with products that can injure us or burn down our houses. There’s the FDA, which regulates medical devices and other products. There’s the FCC, which regulates radio-frequency equipment. There’s Customs and Border Protection, which enforces laws involving imported goods. And there’s the Federal Trade Commission, or FTC, which is supposed to protect us from fraud, deceptive advertising and unfair business practices. It even has a Division of Privacy and Identity Protection.
You’d think that between all these agencies, we’d be pretty well protected when we buy something manufactured in China.
You’d think.
We’re having enough trouble with the hardware
Earlier this year I wrote an article called How Made in China Makes Us Less Safe.
It started with a little astronaut dog I bought for my daughter to use as a night light. We affectionately called him “Space Dog.” He projected colorful nebulae and laser stars onto the ceiling, and we used him often.
Then one morning we smelled something burning. After searching around the house, we found that his USB-C connector had badly overheated.
Thank God it happened while we were awake. Had it happened in the middle of the night, near the carpet or bedding in my daughter’s room, things could have turned out very differently.
If an established American manufacturer sells a dangerous product, it has a brand reputation to protect, a business to lose, and regulators and lawyers to answer to. But what happens when a China manufacturer sells a dangerous product? It closes its Amazon store and opens a brand new one, selling the exact same product.
This particular type of product is hard to find nowadays, so I assume somewhere along the line somebody realized the harm it caused and prohibited their sale. I only wonder how many fires it took and how many children were blinded before sometime realized these were a problem.
Our regulators are struggling to keep up with products they can hold in their hands, photograph and test in a laboratory (and China sellers routinely skip pesky steps like UL or ETL testing, knowing that American consumers will fall over themselves to buy their products just to save the $5).
How well do you think they’re keeping up with the SOFTWARE that comes with them?
What are you agreeing to?
Over the last few years I’ve bought and tested all sorts of inexpensive electronic products, many of them in the “Smart Home” category. There are many smart home apps from trusted brands that I use regularly. Alexa from Amazon. LG ThinQ. Philips Hue.
Recently, though, I’ve noticed more and more cheap China “smart home” products, most of them aping an American, European, or Japanese brand name product, but undercutting the price by skimping on product certification or safety. Granted, there are some larger brand China manufacturers that do a better job than others at safety compliance, but most of them don’t.
Many of these companies could have built their products to open standards, but they see American companies that build their own proprietary ecosystems, and realize that’s how they maximize their profits–by locking consumers into their systems and their apps. And so more and more you see apps on the App Store created by China software developers and required to use the hardware they’re selling.
Sometimes that makes sense. A security camera needs a way to display its video. A smart light needs controls. A health monitor may need somewhere to display and store measurements.
But before you can use the product, you often have to create an account, accept a User Agreement, accept a Privacy Policy and approve a series of permissions.
Most of us have spent the last 25 years conditioned to click whatever makes these screens go away. Nobody wants to read a legal document just to turn on a light bulb.
That was me. But one day I decided to copy and paste the contents of my apps’ Privacy Policies and Terms of Conditions into an LLM and have it explain them to me. The results were chilling.
DayBetter: why are my lights concerned about “state power”?
DayBetter sells LED lighting and other smart-home products. Its User Agreement includes restrictions on the information users can upload or share. It’s the 67th most downloaded Utility on the Apple App store, so it’s installed in thousands of American households.
Among other things, it prohibits information opposing “the basic principles determined in the Constitution,” “subverting state power and sabotaging state unity,” and “damaging state honor and benefit.”
It also prohibits content that destroys the “religious policy of the state” or advocates “heresy and feudalistic superstition.”
Which Constitution are we talking about? And why am I agreeing to rules about state unity and religious policy to operate LED lights?
This is clearly agreement written for an audience that’s in China, translated into English and put in front of American customers without much thought about whether it belongs there. But guess what? When you click “Accept” you agree to sign away your legal rights to a CCP court of law.
The Privacy Policy also defines sensitive personal data broadly enough to include biometric information, communications, health information, transactions and precise location. A definition doesn’t tell us that a light bulb collects every one of those things. It does leave me wondering why an agreement for this product needs language covering them.
The privacy contact in the policy I reviewed was a Gmail address.
How many Americans have agreed to these documents? How many noticed what they said? And who at Apple, Google or any of our consumer-protection agencies thought these terms deserved a closer look?
Bebird: why does an ear camera collect advertising data?
Another gadget I looked at was Bebird, a little camera that lets you see inside your ear on your phone.
I won’t even discuss the most glaring elephant in the room here. This gadget’s terms of service includes a disclaimer saying “this is not a medical device”. Evidently, that’s all it takes for them to fly under the radar of the FDA. But that’s not what I’m focusing on here.
You’d expect the app to display the picture and let you save photos or videos. But its App Store privacy label also lists device identifiers, usage information and advertising data. Advertising data appears under analytics, product personalization, app functionality and even “Other Purposes.”
Why does an app for looking inside my ear need advertising data?
Apple says this disclosure hasn’t been verified by Apple.
The linked Privacy Policy doesn’t make the arrangement much clearer. Its third-party SDK list names Alipay and WeChat, but the Alipay entry links to Umeng documentation and a Umeng push service. Which service is actually involved, and what information does it receive?
The policy says collected information won’t be sent to a server for storage and display. It also permits third-party sharing, without clearly explaining how those provisions fit together.
Then there’s the disclosure language. Bebird permits sharing with administrative or judicial authorities and specifically discusses disclosure if you violate Chinese laws, regulations or the app’s rules.
The English policy provides no clear retention schedule or concrete deletion procedure.
An American buying an ear camera shouldn’t have to untangle all of this to understand what happens to his information. But unless he reads these documents himself, he’s unlikely to know these provisions are there.
Govee Home: read what comes with the lights
Govee is a much more familiar name. It sells smart lights, thermometers, water sensors and other devices, and Govee Home is among the top ten free Utilities apps in Apple’s U.S. App Store.
I haven’t used the app. But I read its User Agreement and Privacy Policy.
The agreement identifies Shenzhen Intellirocks Tech Co., Ltd. as the app operator. It calls for Chinese law to govern the agreement and for disputes to be arbitrated in Shenzhen, in Chinese.
How many Americans buying lights for their children’s bedrooms realize that’s in the agreement?
The Privacy Policy says smart-device management involves collecting device identifiers, MAC addresses, settings, running status and device control and usage records, which are saved to a server.
For displaying and searching goods or services, it lists information including IMEI, device identifiers, a mobile application list, authorized GPS information, WLAN access points, Bluetooth and base-station sensor information. Support logs can include sensor information and device-operation records.
Why does displaying products require a list of applications on my phone?
The policy covers different products and platforms; actual access depends on the operating system, features and permissions. Govee also says the Wi-Fi setup information, including the password, stays local. But those details don’t answer the larger question of what happens to the information that does reach its servers.
The policy permits sharing with affiliates and service providers, disclosures for legal and government proceedings, and processing outside the user’s country. It doesn’t clearly identify every processing location or establish that American users’ data is inaccessible from China.
Americans are handing information about devices inside their homes to a company operating in Shenzhen. That company is subject to laws requiring cooperation with Chinese intelligence and security authorities, which I’ll explain below.
Apparently we’re supposed to assume that buying from a familiar brand through an American retailer makes that arrangement safe.
Meanwhile, Apple’s privacy disclosure for Govee includes this sentence: “This information has not been verified by Apple.” The developer supplied it.
Cameras, health monitors and everything else
Govee isn’t the only app with an expansive policy. Here’s just a sample of apps I found on my phone.
Powerlava, associated with Poclink, lists device identifiers including IMEI, OAID, UUID, Android ID, SIM IMSI and MAC address. Its policy discusses microphone, storage, location, camera and Bluetooth permissions, international transfers and disclosures to government authorities.
ViHealth, associated with Shenzhen Viatom Technology, is used with health devices. Its policy discusses information including activity, sleep, weight, heart rate, blood oxygen, breathing rate, blood pressure and body temperature. Health measurements are an obvious part of a health app. But they’re also information I’d want protected especially carefully. ViHealth says information generated outside mainland China is stored using Amazon Web Services. That tells me something about the hosting provider; it doesn’t, by itself, tell me who can access the data.
An security-camera policy I reviewed discusses information about surrounding Wi-Fi access points, beacons and cell towers.
Each company has explanations for its collection practices. But consumers are being asked to accept a growing amount of data collection without an easy way to understand the full arrangement.
China companies answer to the CCP
Whenever this subject comes up, somebody points out that American companies collect our data too.
Yes. Google, Facebook and Amazon collect enormous amounts of information, and I’ve criticized them plenty of times. I’d like American companies to collect less of it as well.
But China companies operate under a government that has written intelligence cooperation into law.
Article 7 of China’s National Intelligence Law requires organizations and citizens to support, assist and cooperate with state intelligence work, and to keep their knowledge of that work secret. The U.S. National Counterintelligence and Security Center has specifically warned about these obligations.
Article 35 of China’s Data Security Law requires organizations and individuals to cooperate when public-security or national-security authorities obtain data for national-security purposes or criminal investigations through the procedures specified by Chinese law.
The Party’s role in business is institutionalized too. Article 18 of China’s Company Law provides for Communist Party organizations within companies under the Party constitution and requires companies to provide conditions for their activities.
A China company calling itself “private” doesn’t remove those obligations. If Chinese authorities compel it to provide information within its possession or reach, an American customer cannot rely on the company’s friendly branding to stop them.
We’re creating stores of information about American homes, habits and health under the control of companies subject to that system.
Americans have been naive since PNTR was granted, but we’ve gone beyond handing over our manufacturing base and are now handing over data and intelligence. And that door goes one way.
We look at whether the gadget works, whether it has good reviews and whether the price is right, patting ourselves on the back for being “smart consumers” when we save a few dollars by buying a no-name generic ripoff. We rarely ask who ultimately has power over the information it generates.
Washington understands the risk in other industries
In January 2025, the Department of Commerce finalized restrictions on certain connected-vehicle hardware and software linked to China and Russia. It specifically identified risks involving sensitive information and technologies such as cameras, microphones and GPS.
The Justice Department’s Data Security Program also identifies China as a country of concern and addresses access to bulk sensitive American data, including health, biometric and precise-location information.
So Washington understands why this information can pose a national-security risk.
I’d like to see the same urgency applied to the devices Americans are putting in their bedrooms, connecting to their home networks and using to record their health.
People sometimes respond, “I’m nobody. Why would China care about me?”
A collection of information about millions of Americans has uses that don’t depend on every individual being important. It can reveal relationships, routines and patterns, and help identify people who are worth targeting. Our government’s concern about bulk data already recognizes that.
Who’s watching the watchdog?
Apple and Google have built useful protections into their operating systems. Permission controls and limits on what apps can access are real improvements. But a privacy label shouldn’t be confused with an independent investigation of what an app does.
We’ve already seen Apple’s statement that Govee’s privacy information “hasn’t been verified”. Google tells developers its review process is “not designed to verify the accuracy and completeness” of their Data Safety declarations. It can act on discrepancies it discovers, but the developer is responsible for the declaration.
How many customers know that? How many assume an app available through Apple or Google has already been thoroughly checked?
And where is the FTC? Its privacy division addresses deceptive and unfair practices involving personal information.
Corporate America and American politicians have thoroughly failed us, not just in squandering America’s manufacturing base, but allowing the CCP to collect data to an unprecedented degree.
Consider the information that today’s connected devices can generate collectively: images and audio, location, health measurements, account identities, sensor readings and histories of when devices are used. A lighting history may suggest when someone is home or awake. Location records can show where they go. Other devices can add information about their health and daily routines. Combining those records can reveal far more than any one gadget does.
The range of information available from a modern connected home makes Orwell’s telescreens look tame by comparison.
And we’re buying the equipment ourselves, connecting it and agreeing to the collection. When the companies controlling those records are subject to Chinese intelligence demands, we’re creating a route through which the CCP can obtain information from inside American homes.
What can you do?
There are a few things I’ve started doing, and I’d encourage you to do them too.
- Find out which app a product uses before buying it. Look up the developer and the company behind it. The brand on the box may tell you very little. Figure out the name of the app and look it up on the App Store.
- Ask whether you need the app at all. “No app required” has become a key selling point for me. A product that works offline gives you fewer things to investigate.
- Read the policy before agreeing. Search for words like “location,” “microphone,” “identifier,” “SDK,” “affiliate,” “government” and “transfer.” Ask why the product needs the information it describes.
- Deny unnecessary permissions. Check what you’ve already allowed in your phone’s settings. Some features need particular permissions; you can decide whether those features are worth enabling
. - Use a unique password and a separate network when practical. A guest or IoT network can reduce access to your other devices. It won’t stop information the gadget sends to its own cloud service.
- Be especially selective about cameras, microphones and health devices. Look for clear answers about storage, remote access, retention and deletion before putting them in sensitive places.
- Return products whose terms you won’t accept. Buying the hardware doesn’t obligate you to accept whatever software arrangement comes with it.
We’ve spent years treating “Agree” as just an annoyance to ignore when setting up a product. Companies have learned how little attention we pay.
If the corporations and politicians won’t do their jobs and protect us, it’s up to us to demand better ones, and to tell our fellow Americans to do the same.
