Buying one smart thermostat can require reviewing nearly a thousand contracts

Evidence

Wi-Fi–enabled and networked, the thermostat’s intricate, personalized data stores are uploaded to Google’s servers. Each thermostat comes with a “privacy policy,” a “terms-of-service agreement,” and an “end-user licensing agreement.” These reveal oppressive privacy and security consequences in which sensitive household and personal information are shared with other smart devices, unnamed personnel, and third parties for the purposes of predictive analyses and sales to other unspecified parties. Nest takes little responsibility for the security of the information it collects and none for how the other companies in its ecosystem will put those data to use. A detailed analysis of Nest’s policies by two University of London scholars concluded that were one to enter into the Nest ecosystem of connected devices and apps, each with their own equally burdensome and audacious terms, the purchase of a single home thermostat would entail the need to review nearly a thousand so-called contracts. — Shoshana Zuboff, The Age of Surveillance Capitalism, 32

Categorization

• SHARE: A perfect gobsmacking stat for someone working in privacy law or consumer-tech journalism: one thermostat = ~1000 contracts to review.
• QUESTION: Are ‘so-called contracts’ — clickwrap agreements that no consumer can practically review — legally enforceable boilerplate? Worth chasing the University of London scholars’ actual paper.
• SEED: Essay angle: ‘the thousand-contract thermostat’ as the reductio of modern consent — how the terms-of-service regime makes informed consent literally impossible by design.