Smart speakers, home cameras and video doorbells: security basics

Securing smart home devices mostly comes down to changing default passwords, keeping them updated, protecting the account behind them, and checking their voice, camera and sharing settings. Smart speakers, home security cameras and video doorbells bring microphones and cameras into the home and connect them to the internet. They’re handy, but they also collect sound and video that most people would want to keep private. This guide explains how to secure smart home devices like these: how they handle recordings, and the settings Google, Apple and Samsung describe for reviewing voice history, turning off microphones and checking who has access. It also covers what the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) says, and Australia’s smart device security standards.

Why it matters

These devices are different from a phone or laptop in a few ways:

• They’re always on. A smart speaker listens for its wake word, and a camera or doorbell may be watching around the clock.
• They’re controlled through an account and an app. Whoever can sign in to that account may be able to see live video, play back recordings or talk through the device. Our guide to what to do if an account has been hacked explains where official guidance says to start.
• They often use simple setups. The ACSC warns that “default usernames and passwords are collected and posted online, leaving your device vulnerable.”
• They stay in place for years. The ACSC describes checking whether a device still receives updates, and considering a replacement once support ends.

How to set up a smart device securely

These apply to any camera, doorbell or speaker, new or already installed. The ACSC’s smart device guidance describes:

1. Change any default password. The ACSC says a device with good security “should have a long, unique, and unpredictable password,” and that newer devices should come with a unique password or let the owner set one.
2. Turn on updates. It describes checking whether the device updates automatically, and applying updates when they’re available.
3. Secure the account behind it. The ACSC’s Easy Steps guide describes turning on multi-factor authentication (MFA), starting with the most important accounts. Our guide to how to secure your online accounts explains how it works.
4. Turn off what isn’t needed. The ACSC describes disabling unneeded features “such as cameras or microphones”, and linked services such as voice assistant integrations or remote access that aren’t used.
5. Put it on its own network. The ACSC describes setting up an additional Wi-Fi network for smart devices only and, if they don’t need to talk to each other, turning on “client isolation”. Our guide to setting up a guest network on a home router covers the router side.
6. Keep remote administration local. The ACSC describes setting a device’s web administration to the local network, “unless you require remote access yourself.”

How voice assistants listen

Voice assistants wait for a wake phrase such as “Hey Google” or “Siri” before they start sending what they hear.

• Google says that while Google Assistant is waiting in standby, it processes short snippets of audio to detect the wake phrase and “won’t send what you’re saying to Google servers or anyone else.” It notes accidental activations can happen when a noise sounds like “Hey Google”.
• Apple says that on HomePod, “Nothing you say is sent to Apple servers until HomePod recognizes ‘Hey Siri’ or ‘Siri’,” or until someone touches and holds the top. A light on top shows when it has heard the wake phrase.

What happens to a request after that depends on the account settings, which is what the steps below cover.

How to review and delete Google Assistant voice history

Based on Google’s instructions (checked October 2026). Google’s pages Manage audio recordings and How Google Assistant works with your data have the latest steps.

Google says Assistant interactions are saved to the Google Account when Web & App Activity is on. Audio recordings are only saved if the extra setting Include voice and audio activity is turned on, which Google says is off unless turned on.

1. Sign in to the Google Account used on the speaker and open Data & privacy.
2. Under History settings, select Web & App Activity, then Manage activity. (Google also describes reviewing activity at myactivity.google.com.)
3. Look for items with an audio icon, which Google says include a recording. It can be played under Details > View recording.
4. To delete one item, select More next to it, then Delete.
5. To delete automatically, Google describes choosing a time limit of 3, 18 or 36 months, after which older activity is deleted on an ongoing basis.
6. To stop saving audio, go back to Data & privacy > Web & App Activity and untick Include voice and audio activity. Google says: “If you turn this voice and audio activity setting off, previously saved audio is not deleted.”

Google also describes voice commands such as “Hey Google, delete my last conversation” and “Hey Google, delete today’s activity”, and saying “Hey Google, that wasn’t for you” after an accidental activation, which it says deletes the last thing sent to Google.

How to turn off the microphone on a Google Nest speaker or display

Based on Google’s instructions (checked October 2026), from How Google Assistant is designed for your privacy and Google Nest commitment to privacy in the home:

1. Find the microphone switch on the back of the speaker, smart display or smart clock.
2. Slide it to off. Google says the switch often shows orange or red when the microphone is off.
3. To turn it back on, slide the switch back.

Google says its devices show “a clear visual indicator such as flashing dots on top of your device or an on-screen indicator” when audio is being sent to Google, and an indicator “such as a green light” when a camera is sending video. On speakers and displays, Google also describes adjusting how sensitive the device is to “Hey Google”.

How to delete Siri history and pause listening on HomePod

Based on Apple’s instructions (checked October 2026). Apple’s page HomePod privacy and security has the latest steps.

1. On an iPhone or iPad, open the Home app.
2. Tap the HomePod, then tap the settings button.
3. Tap Siri History, then Delete Siri History.

To stop HomePod listening for its wake phrase, Apple describes saying “Hey Siri, stop listening.” While it’s off, Siri can still be used by touching and holding the top of the HomePod.

Apple’s Siri privacy page says “Unless you opt in to Improve Siri and Dictation, your audio data is not stored by Apple.” On an iPhone, it describes deleting the history through Settings > Siri > Siri & Dictation History > Delete Siri & Dictation History. The exact menu name can differ between iOS versions.

How to review voice settings on a Samsung TV with Bixby

Samsung’s voice assistant, Bixby, is built into many Samsung TVs. Based on Samsung Australia’s instructions (checked October 2026). Menus differ between model years; Samsung’s guide How to use Bixby on a Samsung Smart TV has the latest steps.

1. Open Settings, then All Settings.
2. Select Advanced Features (on models before 2025, General and Privacy), then Voice, then Bixby Settings.
3. Open Privacy. Samsung says this controls whether audio recordings can be reviewed and whether Bixby is personalised.
4. To stop the remote’s microphone listening for the wake phrase, open Voice Wake-Up in Bixby Settings and turn off hands-free wake-up.

Samsung says Bixby can’t be turned off completely, and can still be used by holding the microphone button on the remote.

More on smart TVs is in our guide to smart TV security and privacy settings.

How to check who can see cameras and doorbells

Camera and doorbell apps let several people share access to one home. Over time, that list can include people who no longer live there. Based on Google’s instructions for the Google Home app (checked October 2026), from Manage people and permissions in the Google Home app:

1. Open the Google Home app.
2. Tap the profile picture or initial at the top right, then Home settings.
3. Look at the people listed under the home name. Each is shown as an Admin or a Member.
4. To remove someone, an Admin taps their profile icon and then Remove this person.

Google says a removed person loses access to the home and its devices and services, and to Nest Aware features such as video history. It also says Admins have full control, while Members have an Activity permission, which covers camera and lock history, and a Settings permission. Other camera and doorbell makers describe their own sharing settings in their help pages.

Australia’s smart device security standards

The Department of Home Affairs explains that the Cyber Security (Security Standards for Smart Devices) Rules 2025, made under the Cyber Security Act 2024, commenced on 4 March 2026. According to Home Affairs, they apply to most smart devices made on or after that date for personal, domestic or household use. The three requirements are:

• “No universal default passwords”: passwords must be unique per product or set by the user
• a published way to report security issues
• published information about how long the device will be supported, including an end date.

Home Affairs says products made before 4 March 2026 don’t have to comply. It lists desktop computers, laptops, smartphones and tablets as excluded, with the full list of exemptions in the Rules themselves.

Things to watch for

• Old shared access. People who once had access to a camera app may still have it until they’re removed.
• Saved recordings. Turning off a recording setting doesn’t always delete what was already saved. Google says this about its audio setting.
• Devices that no longer get updates. The ACSC says: “Manufacturers are required to publish the end of support life (EOSL) period for their smart devices.”
• Cameras that see past the boundary. The OAIC says “The Privacy Act doesn’t cover a security camera operated by an individual acting in a private capacity,” but that state and territory surveillance laws also cover surveillance devices.
• Giving a device away. The ACSC describes doing a factory reset, deleting the online account if it’s no longer needed, unpairing the device from phones and removing memory cards. Apple describes removing a HomePod from the Home app before selling or giving it away. Our guide to selling, giving away or recycling a device covers this.

Common questions

How do I secure my smart home devices?

The ACSC’s smart device guidance starts with changing any default password, turning on updates and securing the account behind the device with multi-factor authentication. It also describes turning off features that aren’t needed, such as cameras, microphones or remote access, and putting smart devices on their own Wi-Fi network. Whoever can sign in to the account may be able to see live video or play back recordings. See how to set up a smart device securely.

Is my smart speaker always listening?

It listens for its wake phrase, but Google and Apple both say what’s said isn’t sent to their servers until the wake phrase is heard. Google says Assistant processes short snippets of audio in standby to detect “Hey Google”, and notes accidental activations can happen. Apple says nothing is sent from HomePod until it recognises “Hey Siri” or “Siri”, or someone touches and holds the top. What’s stored after that depends on account settings. See how voice assistants listen.

How do I delete my Google Assistant voice recordings?

Through the Google Account’s activity settings. Google describes opening Data & privacy > Web & App Activity > Manage activity, where items with an audio icon include a recording, then deleting them one at a time or automatically after 3, 18 or 36 months. Unticking Include voice and audio activity stops new audio being saved, but Google says “previously saved audio is not deleted.” Steps: how to review and delete Google Assistant voice history.

What do I do if someone who moved out can still see my cameras?

An Admin can remove them in the camera or doorbell app. In the Google Home app, Google describes tapping the profile picture, then Home settings, then the person’s profile icon and Remove this person. Google says a removed person loses access to the home, its devices and features such as video history. Other makers describe their own sharing settings in their help pages. See how to check who can see cameras and doorbells.

What are Australia’s new security rules for smart devices?

According to the Department of Home Affairs, smart device security standards made under the Cyber Security Act 2024 commenced on 4 March 2026, and apply to most household smart devices made on or after that date. They require no universal default passwords, a published way to report security issues, and published information about how long the device will be supported. Home Affairs says products made before that date don’t have to comply. See Australia’s smart device security standards.

Can I record my neighbour’s yard with a home camera?

That depends on state and territory laws and the circumstances, so the official bodies are the places to ask. The OAIC says “The Privacy Act doesn’t cover a security camera operated by an individual acting in a private capacity,” but that state and territory surveillance laws also apply. Its security cameras page lists where to go with concerns, including the state or territory Attorney-General’s department, mediation centres, the local council and, for safety concerns, police.

Where to get official help

• The ACSC’s IoT device guidance is the official version of the security points above.
• Home Affairs explains the smart device security standards.
• The OAIC’s security cameras page lists where to go with camera concerns.
• Google’s Assistant privacy page and Apple’s HomePod privacy page describe each maker’s settings.