Google collects data from downgraded Nest thermostats

First- and second-generation Nest Learning Thermostats continue to transmit information to Google about temperature, humidity, lighting, and more.

Google officially disabled the remote control feature for the first Nest Learning thermostats last month, but it hasn't stopped collecting data from these "downgraded" devices. After digging into the backend, security researcher Cody Kociemba discovered that the first and second-generation Nest Learning thermostats continue to send Google information about manual temperature changes, whether someone is in the room, whether sunlight is hitting the device, and more.

See also: Firefox: New extensions must declare data collection practices

Kociemba made the discovery while participating in a bounty program created by FULU, an organization founded by electronics repair technician and YouTuber Louis Rossmann. FULU challenged developers to find a solution to restore smart functionality to Nest devices that are no longer supported by Google. That's exactly what Kociemba did with the open-source No Longer Evil project.

Google still collects data from downgraded Nest thermostats

After cloning Google’s API to create this custom software, it began receiving a huge amount of logs from customer devices, which it disabled. “On these devices, while Google disabled remote access, it left the ability for the devices to upload logs. And the logs are quite extensive,” Kociemba tells The Verge.

See also: Experian: Fined for illegal data collection

In addition to disabling remote control on early Nest Learning thermostats (including the European version from 2014), Google disabled the ability for users to check the status of their devices from the Nest or Google Home app. It also updates and software. Google notes that unsupported devices “will continue to report logs for diagnostic purposes,” although the data the company collects no longer appears to be useful.

“While these logs may contain technical details such as HVAC error conditions, Google can no longer use this information to help customers who still depend on these thermostats, as support has been completely discontinued, even in cases of device failure,” according to Kociemba.

See also: 175 malicious npm packages used to collect credentials

Google still receives all the information collected by Nest Learning Thermostats, including data measured by their sensors, such as temperature, humidity, ambient light, and motion. “I was under the impression that the connection to Google would be broken along with the remote control feature, however that connection has not been broken and instead is one-way,” says Kociemba.

FULU awarded Kociemba and another winner, who goes by the name Team Dinosaur, the $14,772 prize for restoring smart features to unsupported thermostats.