Securing Smart TVs and IoT at Home: Plain-English Guide

Smart TVs, speakers, plugs and other connected gadgets can quietly collect data about your home and, if left on their default settings, can give criminals a way onto your Wi-Fi. "IoT" stands for the Internet of Things, which simply means everyday objects that connect to the internet: TVs, voice assistants, light bulbs, thermostats, robot vacuums, smart plugs and children's toys. This guide explains, in plain English, how to choose these devices, set them up safely, switch off the tracking you did not ask for, and spot when something is wrong. It is written for households, older people, carers and very small businesses, and you do not need any technical knowledge to follow it. Cameras and video doorbells have their own page, the Securing Home Cameras Guide.

Key takeaways

Your account matters more than the gadget. Most smart devices are controlled through an app and an online account, so a strong, unique password and two-step verification on that account are the most important things you can do.
Check the support end date before you buy. Since 29 April 2024, UK law requires makers of smart products to say how long they will provide security updates. The NCSC suggests treating that date like a "use by" date.
Your TV may be recording what you watch. Many smart TVs use a feature called automatic content recognition to identify what is on screen. You can usually turn it off in the privacy settings.
Turn on automatic updates and turn off what you do not use. Updates fix security holes. Features you never use, such as remote access or voice shopping, are best switched off.
Reset before you sell, give away or recycle. A factory reset removes your accounts and personal data so the next owner cannot see them.

Why smart devices need a little care

A smart device is a small computer. It runs software, connects to your Wi-Fi, talks to the maker's servers over the internet and is usually linked to an online account. That brings three kinds of risk for an ordinary household.

Break-ins through weak passwords: older devices often shipped with the same default password on every unit, which criminals could look up. If someone gets in, they may be able to control the device or use it to reach other things on your home network.
Privacy: TVs, speakers and assistants can collect what you watch, what you say to them and when you are at home. Some of this is needed for the device to work. Some is used for advertising and can be turned off.
Abandoned devices: when a maker stops sending updates, any new security flaw found in that product will never be fixed.

For organisations managing connected devices at scale, see the IoT Security Guide.

Before you buy: what to look for

The UK Product Security and Telecommunications Infrastructure (PSTI) product security regime came into force on 29 April 2024. It is enforced by the Office for Product Safety and Standards. For consumer smart products sold in the UK, it sets three basic rules:

No shared default passwords: passwords must be unique to each product or set by you, and must not be easy to work out (for example, based on a counting sequence or public information).
A way to report security problems: the maker must publish how to report a security issue and how quickly they will respond.
A stated update period: the maker must publish the minimum time it will provide security updates, with an end date.

The NCSC adds some simple buying advice: read reviews of both the product and the maker, check what you need to run it (usually a phone app and an online account), and avoid models that are already out of support or close to it.

Be extra careful with very cheap, unbranded devices from online marketplaces and with second-hand devices. If you cannot find the maker's website, a support page or an update period, choose something else. For the full standard behind these rules, see the ETSI EN 303 645 Consumer IoT Guide.

Set it up safely in 10 minutes

Follow the maker's own instructions first, which may be in the box, in the app or on the support website. Then work through these steps. Menu names differ between brands and change over time, so look for similar words if yours does not match.

Secure your Wi-Fi first. Your router is the front door for every device. The US Federal Trade Commission (FTC) advises using WPA3 or WPA2 encryption, changing the router's default admin password, keeping its software updated, and turning off remote management, WPS (a push-button pairing feature) and UPnP (a feature that lets devices open connections through your router on their own) unless you need them. See the Securing Your Home Router Guide.
Consider a separate network for gadgets. Many routers offer a "guest network". The FTC recommends one for visitors. Putting smart plugs, bulbs and the TV on it too can keep a hacked gadget away from your laptop and phone. Some devices need to be on the same network as your phone to set up, so test this before you move everything.
Create a strong password. If the device or app asks for a password, use a new one you have not used anywhere else. The NCSC suggests three random words. A password manager can create and remember it for you; see the Password Managers Explained for Everyone Guide. If an older device came with a default password, change it straight away.
Turn on two-step verification. Two-step verification (2SV, also called two-factor authentication or MFA) asks for a second check, such as a code from an app, when someone signs in. The NCSC says this makes it much harder for criminals to get in even if they know your password. See the Two-Factor Authentication for Everyone Guide.
Turn on automatic updates. Look for "software update", "firmware" or "system update" in the settings. Install any updates you are prompted about.
Switch off remote access if you do not need it. The NCSC advises turning off remote access if you never need to control the device when you are away from home.
Go through the privacy settings. The next section shows what to look for on TVs and voice assistants.

Smart TV privacy settings to check

Many smart TVs use automatic content recognition (ACR). This means the TV takes small samples of what is on screen, including from a games console or set-top box plugged into it, and matches them to identify what you are watching. The data is often used for advertising. In 2026 Samsung settled a case with the Texas Attorney General and agreed to stop collecting ACR data from Texans without clear, informed consent; the Attorney General had also sued Hisense, Sony, LG and TCL over ACR.

You can usually turn ACR off. The table below shows the setting names reported for common brands at the time of writing. Menus vary by model and year, and makers change them, so if you cannot find the setting, search the maker's help pages for the name in the middle column.

TV system	Setting to look for	Where it usually is
Samsung	Viewing Information Services (also consider Interest-Based Advertising and Voice Recognition Services)	Settings, then Support or General & Privacy, then Terms & Privacy, then Privacy Choices
LG (webOS)	Live Plus (also Limit Ad Tracking)	Settings, All Settings, General, System, Additional Settings
Roku TV (including some TCL and Hisense)	Use info from TV inputs (under Smart TV Experience) and Personalize ads	Settings, then Privacy
Sony (Google TV)	Samba Interactive TV, and usage and diagnostics reporting	Settings, then Privacy or Device Preferences
Vizio	Viewing Data	Menu, System, Reset & Admin

While you are in the TV menus, also:

Check the microphone and camera: if your TV or remote has voice control you do not use, turn voice recognition off. If the TV has a built-in or add-on camera, unplug it or cover it when not in use.
Remove apps you do not use: each app is another account and another set of permissions. Only install apps from the TV's official app store.
Sign out of accounts on shared TVs: in a holiday let, office or shared house, sign out of streaming accounts when you leave.

Voice assistants, speakers and other gadgets

The FTC gives clear advice for voice assistants and smart speakers that works for most brands:

Use the mute button: most speakers have a physical button or switch that stops them listening. Turn on the light or sound alert that shows when the assistant is listening.
Control your recordings: check how long voice recordings are kept, turn on auto-delete if it is offered, delete old recordings, and opt out of human review of recordings if you can.
Stop surprise purchases: add a PIN to voice shopping or turn it off, so visitors or children cannot buy things.
Use guest mode: limit what visitors can access or buy.
Protect linked accounts: if your assistant can read your email or calendar, add an extra passcode where offered.

For smart plugs, bulbs, thermostats, robot vacuums and similar devices, the same setup steps apply: strong unique password, 2SV on the app account, automatic updates, and remote access off if you do not need it. Robot vacuums with cameras and children's connected toys deserve the same privacy check as a TV. For a parent's view of connected toys and apps, see Protecting Children Online: A Parent's Guide.

Signs something is wrong and what to do

Warning signs include settings changing on their own, the device turning on, speaking or moving when nobody touched it, unknown users or devices appearing in the app, emails saying someone signed in to your account, or your internet becoming unusually slow.

Change the account password from a phone or computer you trust, and turn on 2SV if it was off.
Remove unknown users and devices listed in the app's account or sharing settings.
Check the maker's website for advice. The NCSC suggests this first if a device is not working properly or may have been affected by a cyber incident.
Reset the device using the maker's instructions if you think someone has taken control of it, then set it up again with new passwords.
Change your Wi-Fi and router admin passwords if you think someone reached your home network.
Report it using the services listed in "Where to get help" below, especially if money was taken or you are being threatened.

Selling, giving away or recycling a device

The NCSC advises a factory reset before you sell or give away a smart device. This returns it to its original settings and should remove your personal data. Before you reset, remove the device from your app account, and sign out of streaming and shopping accounts on a TV. After the reset, check the device no longer appears in your app. When you buy second-hand, reset the device yourself before using it, in case the previous owner left it linked to their account.

Common failure patterns

Reusing an old password for the device app. If that password leaked from another website, criminals can try it on your smart home account.
Leaving two-step verification off because setup asked you to skip it. Go back and turn it on.
Ignoring update prompts or keeping a device years after its support has ended.
Clicking "Accept all" on the TV's first-start screens and never revisiting the privacy choices.
Turning on UPnP or port forwarding on the router because a guide online said so, without knowing why it was needed.
Passing on a device without a reset, leaving the new owner with access to your account, or you with a device still linked to someone else's.

Where to get help

UK, device advice: the National Cyber Security Centre (NCSC) smart devices guidance.
UK, reporting fraud and cyber crime: Report Fraud (formerly Action Fraud), the national fraud and cyber crime reporting centre for England, Wales and Northern Ireland. In Scotland, report to Police Scotland on 101.
UK, product rules: the GOV.UK PSTI product security regime page. The NCSC also points people to Citizens Advice and Which? for consumer rights questions.
US: the FTC's advice on securing your home Wi-Fi and voice assistants, and ReportFraud.ftc.gov for reporting scams.

Practitioner checklist

Before buying, find the maker's security update end date and check it is at least a few years away.
Secure your router: WPA2 or WPA3, a new admin password, updates on, WPS, UPnP and remote management off.
Give every device app account a unique password, ideally stored in a password manager.
Turn on two-step verification on every smart device account that offers it.
Turn on automatic updates on each device and the TV.
On the TV, turn off ACR (Viewing Information Services, Live Plus, Viewing Data or similar) and personalised ads.
On speakers, set recordings to auto-delete and add a PIN to voice purchases.
Switch off remote access and voice features you do not use.
Twice a year, check the apps for unknown users or devices and remove anything you no longer use.
Factory reset and remove from your account before selling, giving away or recycling.

Securing Smart TVs and IoT at Home Guide: Plain-English Steps to Stay Safe