Smart device setup: a general privacy checklist

What to take away

Use this smart device setup checklist alongside the manufacturer's instructions for your model.

This sequence covers several device types:

This is a general privacy checklist, not installation guidance for locks, alarms, medical devices, or child-monitoring products.

Verify the model before you power it on

Photograph the label. Record the manufacturer, model, hardware version, and serial number. Also record where you bought it and the support address. Check whether the unit is new, returned, refurbished, or already paired to someone else's account.

Install the maker's current app from the official store for your phone. Type the manufacturer's address yourself rather than scanning a QR code on the box, which can be replaced with a sticker pointing anywhere.

Decide who owns the account

Pick the person who will still be in the household in two years. An employer, a school, a landlord, a former resident, or an installer's business address all become a problem when that relationship ends and the device still answers to it.

Add other household members as named users after setup. Do not pass around the owner's password. Keep printed recovery codes somewhere other than the phone you use to administer the device.

Prepare the phone and the network

Update the setup phone and the router first. Pair on your own connection, then open the router's device list and note the new device's name and address.

The FTC's online-security advice advises changing default credentials, turning on two-factor authentication where offered, checking for updates, reviewing connected devices through the router, and planning for the day support ends. It gives general safeguards, not model-specific steps.

Decide whether the device belongs on the main network, a separate segment for smart devices, or a guest network. Test that the choice does not break updates, local control, or anything the household relies on for safety.

Reset anything you did not buy new

A used, returned, or preconfigured device may still be tied to the previous owner. Follow the exact factory-reset and ownership-release instructions for that model. A button press that restarts a device does not necessarily erase it.

Where the service requires the former owner to remove the product from their account, confirm that happened before you rely on the device.

Create and secure the account

Use a unique password kept in a password manager. Turn on the strongest authentication the service offers. Protect the recovery email, recovery phone, backup codes, and any payment method on file.

Then walk the privacy settings:

Update before you enable anything sensitive

Check the installed firmware and the update setting before you turn on recording or remote access. Enable automatic security updates if the maker supports them and someone in the household will notice if they fail. Subscribe to the product's notice channel.

If the maker publishes a support commitment, record the end date. Put an annual review and an expected replacement date on the household calendar. A camera that still powers on is not a camera that still receives patches.

Grant phone permissions narrowly

The app may ask for several permissions:

After setup, reopen the phone's permission screen, switch off what is unused, and test the device to confirm nothing broke.

Place and aim it

For cameras and microphones, stand where the device points and look back. Check doors, windows, mirrors, and work surfaces. Also check the neighbour's property. Check anywhere a visitor sleeps or changes. Narrow motion zones, pan range, audio, and recognition to the purpose you actually have.

For speakers and displays, think about calendars, calls, notifications, and purchase controls. Also consider spoken answers. Put them where household members can see the indicator light and reach the physical controls.

Configure recording and access

Set these one at a time:

Add residents by named role. Test what an ordinary member can watch, change, export, and delete. Give visitors no standing access. List every linked assistant, automation service, monitoring company, and third-party skill.

Run acceptance tests

Use harmless activity and confirm each of these:

Save the configuration, support references, and reset steps in the household inventory. Re-check the device after major updates, a change in who lives there, or an alert you cannot explain.

Common questions

Should I grant every permission during setup and remove them later?

Grant only what the current step needs. Recheck the permission screen after setup, because discovery and pairing permissions are frequently unnecessary once the device is on the network.

Is a factory reset enough for a used device?

Not always. Some services also require the previous owner to unlink the product from their account. Follow the instructions for that exact model, and confirm the unlink happened before you trust the device.

Can an installer keep administrator access?

Only if a documented support need justifies it. Give them a named, limited role, and remove the temporary access once acceptance testing is done.

How often should settings be reviewed?

After major updates, new integrations, household membership changes, and unexplained alerts, plus once a year as part of a device inventory.