Google disabled remote control functionality for first and second-generation Nest Learning Thermostats last month, but the company has continued to transmit device data to its servers. After cloning Google’s API to restore smart features to old, unsupported devices, security researcher Cody Kociemba found that Google was still collecting data from those devices.
Kociemba participated in a bounty program created by FULU, a right-to-repair advocacy organization cofounded by YouTuber Louis Rossmann. The $14,772 challenge asked developers to bring smart functionality back to unsupported Nest devices. His project, “No Longer Evil,” successfully restored thermostat control but revealed an unexpected discovery in the process.
When his custom software launched, logs from customer devices began streaming in automatically.
“While they turned off access to remotely control them, they did leave the ability for the devices to upload logs. And the logs are pretty extensive,” Kociemba told The Verge. These logs contain manual temperature adjustments, occupancy detection through motion sensors, ambient light readings, temperature, humidity, and other sensor data.
Google acknowledges this data transmission in its support documentation, stating that unsupported devices “will continue to report logs for issue diagnostics.” However, Kociemba points out that Google can no longer use this information to help customers.
“Although these logs can contain technical details such as HVAC error states, Google can no longer use that information to assist the customers who still depend on these thermostats, since support has been fully discontinued, even in cases of device failure,” he said.
Google, which acquired Nest for $3.2 billion in 2014, told The Verge that users can disconnect their thermostats from Wi-Fi via on-device settings to stop data transmission.