Cybernews researchers analyzed the privacy policies of 25 major consumer router manufacturers in the US market. The study focused exclusively on public documentation rather than technical testing of firmware or network traffic. A key finding is that many companies use a single, generic privacy policy for all their products, including smart home devices and mobile apps, making it difficult to identify rules specific to routers.
None of the 25 manufacturers explicitly state whether their routers log DNS queries, which can reveal user activity patterns. Regarding Deep Packet Inspection (DPI), 20 companies provide no clear information. While Google Nest and Ubiquiti Cloud confirm they do not use DPI, Amazon Eero, MSI Radix, and AT&T Turbo Hotspot allow it in certain configurations.
Standard personal data collection is detailed more clearly: 84% of companies collect email addresses and account names. Regarding location data, seven companies allow tracking of precise device location, and six more do so under specific conditions. Only D-Link and Amazon Eero explicitly mention collecting identifiers for neighboring Wi-Fi networks, such as SSID and BSSID.
The researchers assigned scores from 0 to 66 based on policy transparency, where higher scores indicate greater uncertainty or data collection volume. D-Link scored 56, Omada by TP-Link 55, and Amazon Eero 53. The lowest scores, indicating more clarity or less data collection, were assigned to Asus with 34, MSI Radix with 38, and Google Nest with 39 points.
