Warning: *privacy not included with this product
Bose QuietComfort Earbuds
Shove these little buds in your ears and turn out the world around you. Both passive and active noise cancelling will keep the world at bay and the music you're listening to front and center. With four microphones built in, you can talk to your Mom, talk to Alexa, or even just talk to yourself. Connect to the app via Bluetooth and adjust all the sound and noise cancelling settings you want. Pop them in their little case to charge up for 6 hours of use. Just be careful not to lose the little guys, they aren't cheap!
What could happen if something goes wrong?
So, what's going on with Bose's privacy? Well, they can be rather nosey, for a smart speaker/headphone company. They collect a fair amount of personal information, such as your name, email, address, location from IP address and sometimes your precise location too, if you allow them. This is all pretty normal. They also say they can collect information about you from third parties, "such as business partners, marketers, researchers, analysts, social network services, and other parties to help us supplement our records." And then there is all the data Bose says they can collect about you automatically through the use of the smart speakers, headphones, apps, websites, and even in their retail stores. So yeah, Bose hopes to build a pretty good profile on you, which , ugh, why does a headphone company need to build such a profile on you?
To market you stuff, that's why. Bose says they do share or "sell" (under the definition of sell in California's strong CCPA privacy law) some personal information to third party advertising partners to target you with ads. This generally includes your email address as well as the information Bose says they can collect on you automatically through their technologies. That means the use and interaction with their website, apps, devices, and interactions in their retails stores. That includes things like your location, IP address, what media you access, what content you listen to such as "sleep tracks, stations, playlists, artists, albums, songs, or podcasts," and even sensor data from your headphones such as your head orientation and movement, and environmental data such as the noise levels and audio frequencies of sounds around you. That seems like a lot of weird little data points to collect about you. And while this might not reach the crazy level of what a car or your phone can collect and share on you, well, dang people, it's your smart speaker and headphones!. Headphones and smart speakers collecting and then sharing things like your head movement, environmental data like the sounds around you, and what podcats you like to listen to and where you are just seems kinda creepy.
Bose goes on to say they may use or share de-identified personal data for any purpose they choose, without limitation. This actually worries us a good bit because privacy researchers have long pointed out that it is relatively easy to re-identify such data, especially when location data has been collected. To explain this a bit further, when you see a company say they can share anonymous data without limitation, that's generally not as worrisome as that is data that is no longer personal information. But de-identified data could still be personal information, so for Bose to claim they can use your de-identified data "without limitation," that is something that worries us.
Oh, and if you choose to use Amazon Alexa or Google Assistant with this smart speaker, know that Google and Amazon will collect data on the voice requests you make. Amazon and Google aren't exactly known for being bastions of privacy.
How is Bose's track record at protecting and respecting your personal information? A few years back Bose came under fire when it was alleged they were secretly collecting personal information about users through the Bose app. Bose fought the class action lawsuit based on these allegations. And early in 2021, Bose made a good change when they stopped requiring users to create an account to use the Bose Music app that controls their headphones and speakers. They do really push users to make an account though, so beware of that.
What's the worst that could happen with Bose? Well, Bose does collect a fair amount of personal information for headphones -- things like your head movements, email address, IP address, location and what content you listen to. And they do say they can share and even "sell" some of this data for targeted advertising purposes. It would be weird for your headphones to give away to online advertisers the fact that you like to listen to lots of podcasts about how to get better at dating while nodding your head along to them, determine you are single and lonely, and target you with loads of adds for sexy AI chatbots. That could get weird -- and unhealthy -- fast.
Tips to protect yourself
- If you use Alexa or Google Assistant, set up the respective privacy settings.
- When starting a sign-up, do not agree to tracking of your data.
- Do not sign up with third-party accounts. Better just log in with email and strong password.
- Chose a strong password! You may use a password control tool like 1Password, KeePass etc
- Use your device privacy controls to limit access to your personal information via app (do not give access to your camera, microphone, images, location unless necessary)
- Keep your app regularly updated
- Limit ad tracking via your device (eg on iPhone go to Privacy -> Advertising -> Limit ad tracking) and biggest ad networks (for Google, go to Google account and turn off ad personalization)
- Request your data be deleted once you stop using the app. Simply deleting an app from your device usually does not erase your personal data.
What can be used to sign up?
What data does the company collect?
Contact information such as name, address, telephone number, email address. General location information (e.g., city/state) which may be collected or derived from your IP address, some mobile applications will request your precise location information via GPS-based functionality to allow certain features to work such as enabling you to locate a lost or stolen device, providing access to local radio stations) "Information we collect at retail locations, such as information about your mobile device or network when you choose to connect your device to Bose digital displays or scan QR codes in retail locations (e.g., device type, operating system, the name you assigned to your device, IP address)."
Sensor data (e.g., head orientation and movement)
How does the company use this data?
How can you control your data?
What is the company’s known track record of protecting users’ data?
Child Privacy Information
Can this product be used offline?
User-friendly privacy information?
Links to privacy information
Does this product meet our Minimum Security Standards?
Uses encryption in transit and at rest.
Ransomware attack on Bose exposes employee SSNs and financial informationZDNET
Audio maker Bose discloses data breach after ransomware attackBleepingComputer
Bose no longer requires you to make an account just to use its appThe Verge
Bose accused of spying on users, illegal wiretapping via Bose Connect appCSOnline
Bose headphones have been spying on customers, lawsuit claimsWashington Post
A message to our Bose Connect App customersBose
Got a comment? Let us hear it.