TP-Link Privacy Notice
TP-Link reorganized and largely rewrote its privacy notice. The most consumer-negative change is to the marketing section: the old text let TP-Link give marketing partners only "aggregated anonymized" information, and the new text drops both words and adds personalized advertising. The long, detailed lists of what TP-Link collects (IP and MAC address, Wi-Fi credentials, Parental Control browsing history, blocked-URL logs, phone IMEI through the User Experience Improvement Program) were deleted and replaced with a much shorter section that mostly describes account signup, device binding, an app permissions table, and feedback data (including Tether device names and logs). The notice now names specific companies it shares data with — including Amazon Alexa and Google Assistant, which can receive live camera broadcast data with your consent — and adds a retention section, a clearer list of privacy rights, and several advertising opt-out links. On the downside, the one-click account-deletion web link was removed, the cross-border protection promise was softened, and the children's section now covers only "websites" instead of all Services.
The described way to opt out of the data-sharing program is gone
The old notice explained the User Experience Improvement Program, said it was based on your consent, and told you exactly where in the app to switch it off. That whole explanation, including the opt-out instructions, was deleted. The new notice does not describe the program at all, so if it still runs there is no documented way to turn it off.
“When you join our User Experience Improvement Program, we collect and process your general information of the mobile phone, including IMEI number (MEID number), system version number, SDK version number, system information, etc.”
What you can do — Email privacy@tp-link.com to ask whether the User Experience Improvement Program still runs on your devices and how to withdraw consent, and use the rights list in Section 7 to object to that use.
Marketing partners can now get your information without it being anonymized first
The old rule was narrow: TP-Link could pass information to marketing companies only after lumping it together and stripping out identities. The new rule drops "aggregate," "anonymized," and "only," so plain "user information" can go to marketing service providers, and a new sentence allows sharing with advertising and analytics companies to target ads at you. That is a real loosening, not just a rewrite.
“We may provide user information to our third-party marketing service providers for our promotional and/or marketing practices. We may also disclose information that does not directly identify you to advertising and analytics providers to serve personalized ads for the Services and to better understand your use of the Services.”
What you can do — Use the new opt-out link in Section 7 (privacy.tp-link.com/app/Do-Not-Sell-My-Info/others) to opt out of targeted advertising, and also use the NAI and DAA opt-out pages listed there.
The detailed list of what TP-Link collects was deleted
You can no longer see in this notice that TP-Link collects your IP and MAC address, Wi-Fi credentials synced between devices, browsing history and access times when Parental Control is on, the web addresses your device tries to reach when Real-Time Protection is on, or your phone's IMEI through the User Experience Improvement Program. Nothing in the diff says any of that collection stopped — only the disclosure is gone. The replacement section is also written around specific apps (it names tpCamera, Tapo Cam screenshots, and Tether device data), so it is unclear what now applies if you use a router, Deco mesh, or other TP-Link products.
“We collect personal data to the minimum scope which is necessary for the provision of our Services.”
What you can do — Email privacy@tp-link.com and ask for a copy of the personal data held about you and a current list of what each of your TP-Link products collects.
Named outside companies, including ones that can receive your live camera feed
The notice now names who receives data. Amazon Alexa and Google Assistant can get your account credentials, device list, device alias, and the camera's live broadcast data that can be viewed in third-party players. Stripe and PayPal get your email, nationality, and address. OhmConnect gets device status and power usage. AWS hosts the data. Naming these is more honest than before, and it is described as consent-based with a stated way to withdraw, but it also confirms that sensitive camera data can leave TP-Link's systems.
“We provide account credentials, device list, device alias, and the camera's live broadcast data which can be viewed via third-party players with such third parties based on your consent.”
What you can do — In your app's smart-home or integrations settings, unlink Alexa, Google Assistant, or OhmConnect if you do not use them, and follow Section 7 to withdraw consent.
New retention rules with no time limits and a "we may not be able to delete it" escape hatch
The new retention section never gives a number of days, months, or years. It keeps data as long as TP-Link says it is needed, longer if a law requires it, and adds that technical or operational reasons may stop TP-Link from fully deleting or de-identifying your data — in which case it only promises "reasonable measures" to stop using it further. In practice, some of your data may stay on file indefinitely.
“There may be technical or other operational reasons where we are unable to fully delete or de-identify your personal data.”
What you can do — When you ask for deletion, ask in writing for confirmation of what was deleted and what was kept, and why.
The one-click account deletion link was removed
The old notice gave a direct web page where you could request data deletion yourself. That link is gone. Deletion is still listed as a right, but you now have to contact TP-Link, may be asked to prove your identity, and the request can be refused, with an appeal if it is denied. Same right, more friction.
“Request data deletion at [https://account-delete.tplinkcloud.com/](https://account-delete.tplinkcloud.com/).”
What you can do — To delete your account or data, email privacy@tp-link.com and keep a copy of the request and the date.
TP-Link can change the policy at any time and only "may" tell you
The new Section 1 says the policy can change at any time and that TP-Link may post a notice on the Services — notice is optional, not promised. The burden is on you to check frequently, and if you disagree with a new version your only stated option is to stop using the Services, even for hardware you already bought. The introduction already asked users to check the policy periodically, so this is a restatement plus a weaker notice commitment, not an entirely new burden.
“This Policy may change at any time as we improve and change our Services.”
What you can do — Bookmark the archive of past versions linked in Section 1 and check it every few months so you can compare versions yourself.
Weaker promise for data sent to other countries
TP-Link used to say it would take appropriate measures to guarantee an adequate level of protection when your data is sent to a country with different privacy laws. Now it just says it will take measures to protect the data. The warning that foreign governments and law enforcement may access it is unchanged, but the strength of the promise dropped.
“However, we will take measures to protect your personal data if it is transferred to these countries.”
The cookies explanation and the Cookie Policy link were removed
The section describing what cookies are, the purposes they served (including promoting products to you and measuring third-party sellers), and the link to the separate Cookie Policy was deleted. The new notice only mentions that you can set your browser to refuse cookies. Cookies are almost certainly still used; you just have less information about them in this document.
“For detailed information on the cookies we use and the purposes for which we use them, see our _**[Cookie P](https://privacy.tp-link.com/web/cookie/policy)olicy**_.”
What you can do — Check TP-Link's separate cookie policy page directly and set your browser to block third-party cookies.
Children's privacy promise now covers only websites
The promise not to knowingly collect children's data used to apply to all Services — apps, support, and subscriptions. It now says "websites." On its face, that leaves the mobile apps and connected devices, where families are most likely to use cameras and parental controls, outside the wording of that promise.
“Our websites are not directed to, or intended for, children as defined by local legal requirements, and we do not knowingly collect personal data from children.”
Last Updated on: Oct 14, 2024.
General rules and definitions
TP-Link Systems Inc. (collectively, "TP-Link" "we" "us" or "our") takes your privacy seriously. We abide by applicable privacy laws and regulations to protect your personal data. Accordingly, we developed this privacy policy ("Policy") in order for you to understand what types of personal data we collected, how we use it, for what reason do we need to process your personal data, who we share it with, when and how we delete it, what rights do you have concerning your personal data and what measures we take to protect it.
TP-Link provides:
(1) software that may be downloaded to your smartphone or tablet to access services ("Mobile Apps" such as Tether, Deco, Tapo etc.),
(2) services, including technical support and services accessible through the Site(s) ("Support"),
(3) subscription services, including services that can be accessed using the Support and Mobile Apps ("Subscription Services", such as TapoCare/KasaCare). The term "Services" means the Sites, Support, Mobile Apps, and Subscription Services, which may be used in conjunction with hardware products provided by TP-Link affiliates and in other ways provided by TP-Link. Some Services of TP-Link can be used together or in ways that integrate with products and services from third parties.
The list of example subscription services no longer mentions HomeShield; only TapoCare/KasaCare remain. The definition of Services was also tweaked to say it can integrate with third-party "products and services."
The Sites mentioned in (2) do not include pages linked from the Websites which are operated by local partners, such as https://www.tp-link.com/us. Supplemental data protection information is available where our partners (including affiliates) operate or provide TP-Link branded web pages or products.
You accept and consent to the practices and policies outlined in this Privacy Policy. This Privacy Policy incorporates herein the Terms of Use; both statements should be read in conjunction with each other. This Privacy Policy may change from time to time. Your continued engagement with our Services after such revisions indicates that you accept and consent to them, so please check the Privacy Policy periodically for updates. Your use of the Products is governed by the applicable privacy policy made available to you when you download or access such Products, including on any page where you log in to a cloud account which may be linked from the Websites. For further information regarding our partners' data protection practices in a specific country and/or region, please refer to the privacy policy tailored for that specific country and/or region via https://www.tp-link.com/en/choose-your-location/. You may consult the respective privacy policy for your country/region of residence or check the policy posted on the page you are viewing to read the data protection practices that apply.
1. Changes to our privacy notice
This Policy may change at any time as we improve and change our Services. We may notify you by placing a prominent notice on our Services . You should check the Services frequently for updates. Prior versions of this Policy will be kept in an archive for your review and are accessible here. If you do not agree with the terms of the updated Policy, you must stop using the Services.
A new Section 1 says the policy can change at any time, that TP-Link "may" post a notice, that you should check often, that old versions are archived at a link, and that you must stop using the Services if you disagree.
2. Sources and categories of personal data we collect
We collect personal data to the minimum scope which is necessary for the provision of our Services. The personal data we collect may be freely provided by you, received from third parties under your authorization, or, in case of usage data, collected automatically when using our Services.
2.1 Personal Data You Knowingly Provide to Us
When you register or update your TP-Link account(TP-Link ID), we collect or process your email, location, user avatar, user nickname, user country code, user mobile phone identifier, etc.
The replacement section says TP-Link collects the minimum needed, then describes account details (email, location, avatar, nickname, country code, phone identifier), device binding data, and feedback data that includes Tether device names and logs. It also states that TP-Link does not receive data from third parties when you use tpCamera.
When you enable device binding, we collect or process your TP-Link ID, device identifier and credentials, user personalized settings (such as device avatar, device family management, etc.).
Besides, if you skip TP-Link ID register and device binding, you can only operate cameras locally.
2.2 Personal Data We Receive from Third Parties
We do not receive personal data from third parties when you use tpCamera.
2.3 Personal Data We Collect Automatically
When you report abnormal problems through the feedback function for the purpose of customer support, we collect your email address, user country code, user collection data (including mobile platform, platform version, etc.), Tether device data (including device name, device logs, etc.).
In addition, we may also request related access permissions for the execution of related functions and services in the case where you use our Services, especially where you install and launch our Services.
A new table lists the phone permissions the app asks for and why: local network (iOS) for device administration, notifications (iOS), account deletion, storage for saving camera screenshots and videos, microphone for live voice calls with the camera, and camera and photos for setting a profile picture.
| Access
|
Purposes
| | --- | --- | |
Local Network (iOS only)
|
Local device administration
| |
Notifications (iOS only)
|
Receiving iOS system notifications
| |
Account Deletion
|
TP-Link Account deletion and related information
| |
Storage
|
Local storage Tapo Cam screenshots or videos
| |
Microphone
|
Live voice call between Camera and App
| |
Camera
|
Photo taking for TP-Link Account custom avatar function
| |
Photos
|
TP-Link Account custom avatar function
|
3. How we share personal data
We may share your personal information internally and externally with suppliers, advisors, or partners for our legitimate business purposes, and only on a need-to-know basis. When sharing personal information, we implement appropriate checks and controls to confirm that the information can be shared in accordance with applicable laws. Here's more detail about who we may share your information with and in what kinds of situations:
(1) With Our Authorized Partners: We may share your information with our authorized partners, including affiliates. We share information with our authorized partners to:
The reason "personalize offers, ads and other sponsored or commercial content" was removed from the list of why TP-Link shares with authorized partners, and "provide customer service and technical support" was added. Partners are now explicitly said to include affiliates.
• promote safety, security, and integrity and comply with applicable laws; • develop and provide features and integrations; • provide customer service and technical support; • understand how customers use and interact with our Services.
(2) Service Providers: To assist in our business operations and better provide our Services (e.g., for software maintenance services, advertising technologies, e-mail services, delivery services, database management services, web analytics, and other services), we may share your information with service providers.
(3) Other Entities with Your Consent: You may choose to integrate certain third-party services with our Services. By doing so, you authorize us to transmit your personal information to third parties when you choose to integrate their services with our Services. Information collected by such third-party services is subject to their own terms and policies, all of which you should carefully and diligently review.
The Services may include links to third-party websites whose privacy practices may differ from ours. Your usage of any such websites is governed by the privacy policies of those websites and not this Privacy Policy. You should carefully review the privacy policy of any website you visit. We will consider your decision to use those third-party products and services with the Products or our Services to be a representation to us that you have consented to the third parties' terms and practices.
The old standalone "Third Parties" section was folded into the sharing section, with wording covering third-party "products and services" as well as websites.
We have engaged:
• Google Assistant and Alexa, virtual assistant technology service providers, to provide device discovery, device management, device control, and live view services for platform users. We provide account credentials, device list, device alias, and the camera's live broadcast data which can be viewed via third-party players with such third parties based on your consent. If you wish to withdraw your consent, please go to Section 7. Your Choices. We suggest you check the privacy policy of Google Assistant and Alexa. • Google Play and App Store, application distribution platforms and payment channels, to provide payment services and distribute applications to platform users. • AWS as our cloud storage and computing service provider. We suggest you check the privacy policy of AWS. • Stripe and PayPal, third-party payment channels to provide web payment services for platform users. We provide your email address, nationality and address with such third parties. We suggest you check the privacy policy of Stripe, PayPal. • OhmConnect, energy saving project platform, for the energy consumption statistics. We provide account credentials, device list, device status, device alias and device usage power data with OhmConnect.
The notice now names who gets data: Google Assistant and Alexa (account credentials, device list, device alias, and the camera's live broadcast data, based on your consent), Google Play and the App Store, AWS for cloud storage, Stripe and PayPal (email, nationality, address), and OhmConnect (device status and power usage data).
We will not provide your personal data to the third party without your clear consent unless such provision approved by relevant laws.
A new sentence says TP-Link will not give your personal data to a third party unless you clearly agree or the law allows it.
(4) Marketing and Advertising: We may provide user information to our third-party marketing service providers for our promotional and/or marketing practices. We may also disclose information that does not directly identify you to advertising and analytics providers to serve personalized ads for the Services and to better understand your use of the Services.
The old notice said TP-Link would combine and anonymize user information before giving it to marketing partners, and only for promotion or marketing. The new wording drops "aggregate," "anonymized," and "only," and adds sharing with advertising and analytics companies to serve personalized ads.
(5) Change of Control: We may be required to share your information as part of a merger, acquisition, asset sale, asset purchase, financing, bankruptcy, or other change of control.
(6) Responding to Legal Requests: We may share information where we have a good faith belief that such disclosure is necessary to (a) comply with an applicable law or legal process or (b) respond to actual or potential complaints or legal claims, like search warrants, court orders, production orders, or subpoenas. These requests come from third parties such as civil litigants, law enforcement, and other government authorities. Or (c) where otherwise necessary to protect our rights, interests, and/or property (including, without limitation, to enforce our agreements), or the rights, interests, and/or property of our agents, independent contractors, customers, and others.
4. Security of personal data
When you browse community or other websites, you may need to register a TP-Link ID to get all features.
We have implemented measures, including encryption and TLS technology, designed to secure your personal data from accidental loss and from unauthorized access, use, alteration, and disclosure. In addition, we restrict the number of staff in charge with access to your personal data to the minimum level and frequently conduct training and education so that they comply with the confidentiality obligations with respect to your personal data.
Your account's privacy and security are protected by your password. In order to prevent unauthorized access to your account and personal data, you should select a strong password and protect it by limiting access to your computer, device, browser, or application and by signing off after you have finished accessing your account. If you use a third-party service to sign into your account, you should protect that account accordingly as well.
While we strive to always protect the privacy of your account and personal data in our records, we cannot always guarantee it will be completely secure. The security of your personal data may be compromised by unauthorized entry, unauthorized use, hardware failure, software failure, and other factors at any time.
Here are some best practices to protect your TP-Link ID account:
• Use complex passwords (a mixture of upper and lower letters, numbers, and symbols) when signing up. • Use a unique password different from other website accounts to avoid being involved in their accidental data breaches. • Change your passwords regularly. • Use 2 Factor Authentication (2FA) if possible.
5. How we store and process your personal data
Your personal data will be transferred or transmitted to, or stored and processed in the following circumstances in accordance with the purposes stated within this Privacy Policy:
• Places we have infrastructure or data centers, including the United States, Ireland, and Singapore, among other countries where our Services are available. Typically, the primary storage region is the region that is closest to the customer's region, often with backups to data centers in another region. The storage location(s) are chosen in order to operate efficiently, to improve performance, and to create redundancies in order to protect the data in the event of an outage or other problem. • Other countries where our partners, vendors, service providers and third parties are located outside of the country where you live, for purposes as described in this Privacy Policy.
These countries may have different privacy standards that differ from those where you are. Please note that data processed in another country may be subject to different laws and may be accessible to government, judicial, law enforcement, and regulatory agencies in those countries. However, we will take measures to protect your personal data if it is transferred to these countries.
The old text said TP-Link would take appropriate measures to guarantee an adequate level of protection for data sent abroad. The new text just says it will take measures to protect the data. The reference to data centers being "on AWS" was also dropped from this section.
6. Retention of your personal data
We retain personal data for different periods of time depending on the purposes for which we collect and use it, as described in this Privacy Policy. We will delete or de-identify personal data when it is no longer needed to fulfill these purposes unless a longer retention period is required to comply with applicable laws. There may be technical or other operational reasons where we are unable to fully delete or de-identify your personal data. Where this is the case, we will take reasonable measures to prevent further processing your personal data.
There is now a retention section. It gives no time limits and says data is kept as long as it is needed, plus it admits TP-Link may not always be able to fully delete or de-identify your data.
7. Your Choices
Depending on where you reside, you may have legal rights to request the following by contacting us as detailed in the "Contact Us" section:
• Access to, or a copy of, your personal data • Confirmation that we are processing your personal data • Correction or amendment of your personal data • Deletion of your personal data • Transfer of your personal data to a third party • Restriction or objection to certain uses of your personal data
You can also opt out of our processing or sharing of your personal data for online targeted advertising purposes by following the instructions here.
The new section lists rights to access, confirm, correct, delete, transfer, and restrict or object to use of your data, and adds opt-out links for targeted advertising, Google Analytics, and industry ad programs, plus an appeal process if a request is denied. The direct account-deletion web page link was removed, and requests may now require identity verification.
You also have other choices to manage your personal data. For example, you can:
• Opt-out of our email marketing messages by clicking the "unsubscribe" link at the bottom of our emails. • You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. • Opt out of the use of data by Google Analytics in supporting browsers here. • Opt out of interest-based advertising by companies participating in the National Advertising Initiative and/or the Digital Advertising Alliance opt-out mechanisms here and here. Participating companies will place opt-out cookies on your browser to recognize your choice. Note that your choice may not be recognized if you block or clear cookies. If you use different computers or browsers, you may need to replicate your choices across those computers and browsers.
You may also send us an email to privacy@tp-link.com to request to exercise your rights described above regarding personal data. However, note that we cannot delete the email address used for administrative emails to you (e.g., emails about your transactions, policy changes, forgotten password, and confirmation emails) except by also deleting your user account.
We may ask you to provide us with information necessary to reasonably verify your identity before responding to your request. Certain information may be exempt from such requests. For example, we may not accommodate a request to exercise certain rights if we believe doing so would violate any law or legal requirement or negatively impact the information's accuracy. If we deny your request in whole or in part, you may have the right to appeal the decision. In such circumstances, we will provide you with information regarding the appeal process.
8. Children's Privacy
Our websites are not directed to, or intended for, children as defined by local legal requirements, and we do not knowingly collect personal data from children. If you believe that we have any such data, please notify us immediately using the contact information provided in the "Contact Us" section and we will delete it as quickly as possible.
The promise not to knowingly collect children's data used to apply to all "Services" (apps, support, subscriptions). It now applies to "websites."
9. California Consumer Privacy Act
Click here to read additional disclosures required under the California Consumer Privacy Act.
10. Notice Concerning Do Not Track
"Do Not Track" is a privacy preference that users can set in certain web browsers. We do not currently recognize or respond to browser-initiated Do Not Track signals. Learn more about Do Not Track.
11. Updates To Our Privacy Policy
This Privacy Policy may change from time to time, and we may notify you by updating the Privacy Policy's effective date above. If there are material changes, we will place a prominent notice on this website or provide notice through other means. We encourage all users to occasionally refer to this Privacy Policy so that they can remain aware of our current practices. If you do not agree with the terms of the updated Privacy Policy, you must stop using the Services. Your continued use of the Services after any Privacy Policy changes means that you agree to the updated Privacy Policy.
12. Contact Us
If you have any questions or need further assistance, please email us at privacy@tp-link.com
TP-Link Systems Inc.
10 Mauchly, Irvine, CA 92618
ALSO IN THIS CHANGE, NOT TIED TO ONE PASSAGE
- − REMOVEDThe detailed "what we collect" sections were deleted
Old sections 1.1, 1.2, and 1.3 listed specific data: IP and MAC address, location, Wi-Fi credentials synced from devices, images and videos in cloud storage, browsing history collected under Parental Control, attempted web addresses logged under Real-Time Protection, and phone IMEI/MEID collected through the User Experience Improvement Program. All of that text is gone.
We will collect a device's browser history and access time when the device is under the control of the Parental Control feature
- − REMOVEDThe cookies section was removed
The section explaining what cookies are, the seven purposes they were used for, and the link to the separate Cookie Policy is gone. All that remains is a bullet telling you that you can set your browser to refuse cookies.
Cookies are small pieces of text used to store information on web browsers.
- ± CHANGEDCalifornia privacy rights link changed
The web address for the extra California Consumer Privacy Act disclosures now points to privacy.tp-link.com instead of tp-link.com.
[here](https://www.tp-link.com/en/about-us/privacy/your-california-privacy-rights/)
[here](https://privacy.tp-link.com/app/official/your-california-privacy-rights)