Matter / Thread and privacy - can we prevent devices from phoning home and spying?

Configuration Matter/Thread
20

I ran the spec through chatgpt. Here’s it’s analysis of privacy with matter.

The Matter 1.5 specification provides no mechanisms to prevent devices from “phoning home,” no requirements for local-only operation, and no rules limiting a manufacturer’s ability to collect data once the device is commissioned.
The only privacy protections in the spec apply to the commissioning/advertising phase (rotating IDs, limited metadata). After joining the network, a Matter device behaves like any other IPv6 device and may freely contact external servers unless restricted by the user’s own firewall or network configuration.

and for local control the analysis is

What the spec does NOT say:

1. No clause requires that all operational features work offline

There is no mandate that:

  • All features must work without Internet
  • Control must be possible offline
  • Cloud lock-in is prohibited
  • Devices must remain operational forever offline once commissioned

There is no “right to offline operation” defined anywhere.

2. No clause prohibits a manufacturer from crippling devices without cloud connectivity*

Nothing prevents manufacturers from:

  • Requiring cloud authentication for control
  • Requiring periodic check-ins
  • Disabling major functions when offline
  • Preventing local control if cloud services are unavailable

The spec simply does not address—let alone forbid—these patterns.

3. No clause guarantees local control in perpetuity

There is no requirement that:

  • Local commands must always work
  • Cloud services cannot be required post-commissioning
  • Firmware cannot introduce cloud dependencies in the future

Matter is a local protocol, but the spec does not guarantee local autonomy.>

What the spec does enforce

Secure, local protocol mechanics

After commissioning:

  • Devices publish local IPv6 addresses for direct control(AAA records listing addresses they accept operational messages on)
  • Matter messaging is fully local, via secure PASE/CASE sessions
  • Operational discovery is local (DNS-SD/mDNS)
  • Controllers communicate directly with the device locally

But none of this stops a device from requiring cloud involvement at a higher level.

A device can always:

  • Reject local commands unless authenticated via cloud
  • Turn local endpoints “off” unless online
  • Require a cloud-driven policy engine
  • Disable functionality via firmware

The protocol only ensures that local transport is possible , not that local control must be honored .

and about commissioning that’s conditioned upon manufacturer’s app/website (you don’t own it and can’t commission it without their permission)

:heavy_check_mark: The spec does allow Matter devices that cannot be commissioned without manufacturer involvement.

:heavy_check_mark: The spec allows the manufacturer to require a cloud / website / app for commissioning.

:heavy_check_mark: Therefore, a manufacturer can effectively “brick” a device by shutting down the required commissioning service.

There is no requirement in the Matter 1.5 Core Spec that every device must support a local or offline commissioning path.

So unfortunately the conclusion seems to be no guarantee of privacy, local control, or even pairing a device without the approval of the manufacturer.

I guess I’ll stick to zigbee/zwave then!

4 Likes