Google continues data collection from discontinued Nest thermostats
Google continues collecting data from discontinued first and second-generation Nest thermostats after disabling remote control features, reportedly transmitting extensive logs including occupancy and temperature information from millions of American homes while no longer providing support or using the data to assist customers.
What happened
Google disabled remote control functionality for first and second-generation Nest Learning Thermostats in October 2025, but continued transmitting device data to its servers. Security researcher Cody Kociemba discovered the ongoing data collection while reverse-engineering the devices' API as part of a FULU-sponsored bounty program to restore smart functionality to unsupported Nest models.
The devices continue to transmit logs containing manual temperature adjustments, occupancy detection through motion sensors, ambient light readings, temperature, humidity, HVAC error states, and network details to Google servers. Google stated in support documentation that unsupported devices 'will continue to report logs for issue diagnostics,' but acknowledged it can no longer assist customers with this data since support has been fully discontinued.
Reported impact
Kociemba noted that the data provides significant insight into household daily patterns and routines. Sean O'Brien, founder of the Yale Privacy Lab, stated that proximity signals alone can reveal when someone is home, when they leave and when they sleep, and combined with temperature adjustment behavior can map out daily rhythm with surprising accuracy.
Index analysis
The ongoing data collection raises privacy concerns for millions of American households with first and second-generation Nest thermostats. The devices are also vulnerable to hackers since Google stopped shipping security updates.
Governance controls
Google told The Verge that users can disconnect their thermostats from Wi-Fi via on-device settings to stop data transmission. However, this requires manual action by users and is not the default behavior.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.