TelemetryfirmwareIoTnetwork devicevehiclestatus active
Not a vulnerabilityNothing is exploitable and nothing is broken. The device does what its builder intended, and the objection is to that intention. A vulnerability register has no place to put this, which is why it has gone unrecorded.
What it is
Firmware opens connections to hosts that serve no function the owner asked for: a fixed endpoint contacted at boot, at intervals, or on every state change. The payload may be status, configuration, usage patterns or an identifier of the device or its owner.
Why it is a separate entry
The owner bought a device, not a subscription to being observed. Unlike a website there is no browser to inspect it with, no consent dialogue, and often no way to switch it off without breaking the product. The traffic continues for the life of the device, which for a router or a car is a decade.
How it arises
vendor telemetry enabled by default with no setting to disable it
chipset SDK contacting the chip maker rather than the device brand
update or time service pointed at a fixed host in the vendor's home jurisdiction
Not to be confused with
A firmware update check against the vendor is expected behaviour and not this entry. What distinguishes it is traffic without a function the owner asked for, or a destination that has nothing to do with the product.
How to establish it
Outbound connections from the device to hosts that persist when every user-facing function is idle, established from a network capture at the gateway rather than from the device itself.
method network-observedQoD 90
Requirements on the measurement
capture upstream of the device, on the router or an inline tap; the device cannot be trusted to report its own traffic
idle baseline first: leave the device untouched and record what it does anyway
record firmware version and region setting; behaviour frequently differs per region
establish the destination by address and routing, never by where the vendor is headquartered
What would refute it
by handThe traffic serves a function the owner enabled, such as remote access or cloud backup.finding falls
by handThe endpoint is a content delivery network fronting a service in another jurisdiction.Where an operator is based says nothing about where the data goes. Establish the destination, not the origin of the company.reclassify
by handThe connection carries no data beyond what is needed to check for updates.weakens
by handThe behaviour can be switched off in the interface and was left on.Still relevant if it is on by default, but it changes the finding from cannot to did not.weakens
Where this plugs into existing processes
The one question that surfaces itUnplug everything it does and tell me what it still talks to.
In a DPIA, verify this
Verify what the device contacts while idle, rather than accepting the telemetry section of the manual.
As a procurement clause
The device contacts no host that serves no function the owner enabled, demonstrated by an idle capture.
With a complaint, hand over
An idle capture at the gateway, with firmware version and region, and the destinations established by routing.
Reproduction
repro/homecall/MANUAL.md · by hand · connections to hosts unrelated to any function the owner enabled, while the device sits idle
Legal framing
eu-gdpr-44
eu-gdpr-6-1-a
Objections, and the answer
“This is anonymous diagnostic data.”
A device identifier tied to a household is not anonymous, and diagnostics that report usage patterns describe the people using it. Establish what is in the payload before accepting the label.
“It is in the terms and conditions.”
Consent must be specific and freely given. A term buried in a document accepted once at setup, with no way to refuse and keep the product working, is neither.
“The servers belong to our chip supplier, not to us.”
The party placing the product on the market chose that component. Responsibility for what a shipped device does is not transferred by subcontracting it.
What this does not establish
harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
unlawfulness; that is for a supervisory authority or a court
intent; a fault is usually a build decision, not a plan
absence: not finding it in one capture is not evidence that it is not there
DPE Catalogue. DPE-2026-0012: Device telemetry without function. Schema 2.0, entry status active. Retrieved from https://totaledigitalewaarborging.nl/register/DPE-2026-0012
Measurement
When you publish a finding, cite the method version alongside the entry: “DPE-2026-0012, established under DPE Measurement Method 1.0”
Identifiers are permanent and are never
reused. An entry that is deprecated keeps its number and its address, with the reason attached, because
references to it exist elsewhere.