Cybernews analysts have combed through the privacy policies of the 25 biggest consumer router makers in the US. None of them says outright whether the router logs which websites the devices connected to it are reaching, the study found.
The researchers didn’t test the hardware itself. They looked at no network traffic, firmware or device behavior — only at the companies’ public documents.
The biggest problem, they say, is that most brands don’t have a separate policy for their routers. Instead, a single document covers everything at once: the online store, mobile apps, cloud services, security cameras, smart home devices and networking gear. That makes it hard for buyers to tell which clauses actually apply to the box in their living room.
DNS requests — the lookups devices make to turn domain names into addresses — show the gap most clearly. Not one of the 25 manufacturers states whether its routers keep a log of them. These lookups don’t reveal what’s on a given page, but their history can say a lot about a user’s habits, interests and activity.
Follow Mediasat on Google News: the latest in TV, telecom and tech
Traffic analysis is just as murky. Policies from 20 companies give no clear answer on whether they use deep packet inspection (DPI), which examines the actual contents of internet traffic. Only Google Nest and Ubiquiti Cloud explicitly rule it out. Amazon Eero, MSI Radix and AT&T Turbo Hotspot, by contrast, allow for it in certain configurations.
Ordinary personal data gets far more detailed treatment. Some 84% of companies say they collect an email address and account name. Nearly half spell out four categories at once: name, email, phone number and mailing address.
The researchers also checked what brands say about location and nearby Wi-Fi networks. Seven companies allow for collecting a device’s precise location, and six more do so under certain conditions. Only D-Link and Amazon Eero explicitly mention the identifiers of neighboring access points (SSID and BSSID), which can be used to pin down a physical location. Most manufacturers don’t address the practice at all.
Wi-Fi signals themselves can be put to other uses, too. In August, Comcast rolled out a feature on its Xfinity gateways that detects motion inside a home from changes in the signal.
To compare transparency, Cybernews gave each brand a score from 0 to 66. Confirmed data collection earned 3 points, missing information 2, conditional collection 1, and an explicit statement that data isn’t collected 0. The higher the total, the more uncertainty or declared collection a company’s documents contain.
The highest scores went to D-Link (56), TP-Link’s Omada (55), Amazon Eero (53), Xiaomi Mesh, Wyze and Cudy (52 each), and TP-Link, Netgear and Ubiquiti Cloud (51 each). Asus, which the FCC cleared to keep selling networking gear in the US in September, scored lowest at 34, followed by MSI Radix (38) and Google Nest (39). The authors stress that this isn’t a ranking of the most private routers but an assessment of what the legal documents say.
The study’s main takeaway isn’t that manufacturers are necessarily inspecting home traffic. It’s that their public policies often make it impossible to tell whether they do or not. For a device that nearly all of a home network’s traffic passes through, the researchers see that uncertainty as a serious problem.
