Last month, Google officially discontinued the remote control capabilities of its earliest Nest Learning Thermostats, effectively stripping these once highly regarded smart-home devices of a key feature that distinguished them from standard models. However, despite removing these interactive functions, the company has not ceased gathering substantial amounts of data from the very units it has now rendered less intelligent. This ongoing collection process was brought to light through the work of security researcher Cody Kociemba, who conducted an in-depth investigation into the system’s backend operations. His findings reveal that Google continues to receive information from first- and second-generation Nest Learning Thermostats, including detailed reports on manual temperature adjustments, the detection of human presence, and even readings indicating whether direct sunlight is striking the thermostat’s sensors, among other forms of data transmission that remain active behind the scenes.
Kociemba’s discovery occurred as part of his participation in a bounty initiative organized by FULU, an advocacy group that promotes the right to repair electronic devices. The organization was co-founded by Louis Rossmann, a well-known electronics repair specialist and YouTube personality recognized for his outspoken criticism of restrictive corporate repair policies. Through this bounty program, FULU encouraged independent developers to design creative and technically sound methods to revive or re-enable the smart features of discontinued Nest products, which Google no longer supports. In response to the challenge, Kociemba created his own open-source project, aptly titled *No Longer Evil*, which sought to restore these lost capabilities and give users back some measure of control over their own hardware.
While replicating Google’s original application programming interface (API) for use in this custom solution, Kociemba unexpectedly began receiving a massive influx of usage logs from consumer-owned thermostats still connected to Google’s servers. Recognizing the sensitivity of this data, he promptly halted the flow, but the discovery underscored the scope of information the devices were continuing to send. In his remarks to *The Verge*, Kociemba explained that although Google had deliberately disabled all remote-control access, the infrastructure allowing devices to upload operational logs remained intact. These logs, according to his assessment, are extensive and contain numerous data points that provide a surprisingly detailed picture of user behavior and environmental conditions.
Beyond simply removing remote management for early Nest Learning Thermostats—including the European 2014 edition—Google also blocked users from viewing their devices’ current status through the Nest or Google Home mobile applications. Additionally, it curtailed the ability to receive both security patches and software updates. Despite these restrictions, Google has stated that the devices will continue transmitting logs intended for diagnostic purposes, ostensibly to identify technical issues. Yet, as Kociemba points out, since official support has been discontinued, the diagnostic data now collected serves little practical function in assisting consumers. The information may include complex technical parameters, such as heating and ventilation system error codes, but the company no longer processes this data to provide help, even for users experiencing malfunctions or complete breakdowns of their units.
Crucially, Kociemba noted that Google’s data collection still encompasses all sensor-derived information from the thermostats, covering variables such as temperature, humidity levels, ambient light exposure, and motion activity within the surrounding area. He admitted his initial assumption had been that once Google severed the remote management link, the connection between the devices and servers would be entirely terminated. Instead, what his research revealed is a one-directional flow—while Google has removed user control over the devices, it still maintains an open channel through which information flows exclusively toward its servers.
*The Verge* reached out to Google seeking clarification on these findings, but at the time of reporting, the company had not yet provided an official response. In recognition of his technical ingenuity and investigative initiative, FULU awarded Kociemba, along with another participant known as Team Dinosaur, the competition’s $14,772 prize. Their work successfully restored certain smart functionalities to the unsupported thermostats, highlighting both the creativity and persistence of the right-to-repair community in challenging corporate decisions that limit consumer control over their own devices.
Sourse: https://www.theverge.com/news/820600/google-nest-learning-thermostat-downgraded-data-collection
