Ring's cameras come with privacy concerns. What about the smart lights?
Ring's smart lights don't include cameras or microphones at all. Does that make them any easier to trust?
- 10 years product testing experience with the CNET Home team
Ring, the Amazon-owned video doorbell startup, is out with a new spring lineup of outdoor light fixtures, including weatherproof smart bulbs and solar-powered pathlights with built-in motion detectors you can control from your phone. There was a lot to like when I tested out Ring's initial run of smart lights last year -- but growing concerns over the company's handling of user privacy led CNET to withdraw our recommendations of Ring products across the board.
In addition to an incident in December that resulted in compromised accounts for thousands of Ring users (as well as other such security lapses), those concerns focused largely on Ring's controversial partnerships with law enforcement, and the ways in which the company shares user video with police departments. A number of Ring users have also reported instances of hackers taking control of Ring cameras and abusing the two-way talk feature to harass homeowners. In one video shared with the Washington Post, a hacker hurled racial slurs at an 8-year-old girl while watching her in her bedroom through a Ring camera.
"Seeing that, that video of that girl, made me cry," Ring CEO Jamie Siminoff told CNET in January. "And every time I think about it, it makes me sad."
For its part, the company has responded to concerns like those by adding must-have security features like two-factor authentication, and by introducing an app-based Control Center in January that lets users better manage their privacy, security and video sharing settings. That multi-faceted response is part of the reason why we've decided to reopen Ring products for recommendation, starting with the new Ring Video Doorbell Plus 3.
And perhaps the smart lights are something of a response, too. Though several of the outdoor lights feature built-in motion sensors, none of them include cameras, microphones or speakers. There's no camera footage to be shared with police, and no poorly secured two-way talk feature for a stranger to abuse. On paper, that's a much easier pitch for a company that's operating at a trust deficit with some consumers.
Still, I wanted to take a closer look.
Shine some light
Ring's newest outdoor smart lights include its first two smart bulbs, as well as solar-powered versions of the motion-activated pathlights, floodlights, and step lights we tested out last year. None of them include cameras or microphones at all, and, in keeping with last year's launch, all of them are priced to sell.
Case in point: The Ring Pathlight Solar. At $35 each -- just $5 more than last year's battery-powered version -- it's an attractive means of bringing motion awareness to the areas outside your home. Sticking one in the ground near an outdoor pool would be an easy way to receive an alert on your phone if a young child wanders too close to the water, for instance.
Motion-activated smart lights generate a data point whenever they sense something nearby, and you can track that data in the Ring app to see when, specifically, your light noticed movement. A savvy observer might be able to pore through that data to make an educated guess about whether or not you'll be home at a given time, but that's only if they gained unauthorized access to your account. Ring's recent moves to require two-factor authentication and to notify users of new logins offer strong protection against that hypothetical.
Aside from that, the lights don't present any unique privacy concerns, but using them does require you to share your data with Ring, including entering your home's location when setting up the system. A Ring spokesperson pointed out that none of the company's devices include GPS functionality, and suggested that users who wish to keep their location private can simply enter a randomized address. You can also deny the app permission to access your location through your phone.
The fine print on privacy
"Ring will continue to innovate on behalf of our neighbors to help make their neighborhoods safer," reads the company's privacy overview. "We will do so with our neighbors, their privacy, and the security of their information at the top of our priority list.
Not surprisingly, most of Ring's forward-facing privacy declarations center around its cameras -- but the lights aren't irrelevant here. Though most of Ring's lights don't include cameras of their own, they can be linked to other Ring products that do. That's something to be aware of if you own devices like those and want to be mindful of how much footage is winding up on Ring's servers. For instance, if you have a Ring Protect Plan and you activate Ring's Linked Devices features, the company will record and store video whenever your cameras are triggered by one of your system's network of motion sensors, including the sensors built into Ring's lights.
The company's full privacy notice offers a look at Ring's policies that's deeper and more detailed than the broad language of its main privacy statement. It notes that the data Ring collects includes environmental data from devices with motion sensors, and follows up with the usual rundown of ways in which the company may use and share that data. With respect to the lights, none of those data disclosures seem egregious or out of line with industry standards.
The other concern is whether Ring is doing enough to keep people's data secure. The privacy notice offers just one sentence on the topic.
"We maintain administrative, technical and physical safeguards designed to protect personal information against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use," it reads.
I wouldn't expect any company to outline its security efforts in any great detail, but some additional specifics would be nice here given that the company has a spotty track record with data security.
For instance, after more than 3,000 Ring users' personal information, including their passwords, wound up exposed on the web in December. The company deflected blame to "other companies' data breaches," and insisted that none of Ring's own servers had been breached.
That's good to hear, but it calls Ring's data-sharing practices into question. And, while the notice makes sure to point out that Ring isn't responsible for the information practices of its third-party partners, it says nothing about what Ring does to vet those partners before sharing your data with them. Language like that would be a welcome addition after December's leak.
App controls
The last thing worth looking at is the privacy controls offered on the Ring app. This was a point of focus for the company in January at CES 2020, when it showcased a new app-based Control Center where you can monitor and adjust your privacy settings.
Specifically, the Control Center lets you choose between email- and text-based two-factor authentication, view the third-party services you've linked to your Ring account, and manage shared users of your system, as well as the specific devices authorized to log into your account. You can also opt out of receiving personalized ads for Ring products based on data the company shares with third parties.
If you're using Ring devices with cameras in them, you can also choose whether or not you wish to be notified when local police are looking for footage that might be relevant to their investigations. As is the case with Ring's personalized ads, the option is enabled by default.
"Public safety agencies do not have direct access to user videos or data," a Ring spokesperson tells CNET. "They can use the video request feature to ask for assistance when investigating an active case, and it is entirely up to the user whether or not to share a video."
Of course, most of Ring's smart lights don't include cameras -- and Ring tells me that its partnerships with law enforcement extend to those video requests only. They don't give the police any extra access to things like a light's motion history, or other user data.
"Absent an exigent or emergency circumstance, Ring does not disclose customer information in response to government demands unless required to do so to comply with a legally valid and binding order, such as a search warrant," said the spokesperson.
At any rate, the Control Center seems like a good start to me, and I hope that Ring continues to build on it. For instance, it'd be great if you could use the Control Center to opt out of sharing your home's location data and street address. Right now, you can't.
The bottom line
Despite the company's controversies, Ring's smart outdoor lights are an appealing entry point into the ecosystem, and a more affordable option than smart lights from pricier competitors such as Philips Hue. And, without cameras or two-way talk in the mix, there's less to wrap your head around from a privacy perspective. Recent efforts to shore up on security with two-factor authentication and app login notifications offer reassurance, though there's still more the company can do to build trust.
As for the merits of the lights themselves, we're still testing them out and will report in full once we're finished. Stay tuned for that in the weeks ahead. In the meantime, be sure to read our review of the new Ring Video Doorbell 3 Plus for our latest thoughts on the product line.