Who Owns the Data From the Smart Thermostat? The Messy New Etiquette of Connected Devices in Rental Homes

Who owns the data from the smart thermostat in a rental? Well, almost never the person living with it. The device is usually bought and installed by the landlord or a property management company, paired with the manufacturer’s cloud account, and configured long before a tenant moves in. A tenant nudges the temperature up two degrees, and that adjustment travels to the vendor’s servers, the landlord’s dashboard, and, depending on the fine print, an analytics partner nobody at the kitchen table has ever heard of.

That arrangement is now being tested in court. In December 2025, the ACLU of Northern California and two partner firms sued Equity Residential and SmartRent, alleging that mandatory in-unit devices, including thermostats, turned tenants’ homes into environments of surveillance without meaningful consent. The case is useful to examine, because it exposes exactly where the etiquette of connected rentals breaks down.

A Thermostat Is a Sensor Before It Is a Comfort Device

A modern connected thermostat is a sensor package first. It reads temperature and humidity, tracks when the HVAC cycles, and increasingly infers whether anyone is home from motion, from Wi-Fi signals, from the pattern of setpoint changes over the day.

That inference isn’t hypothetical. Researchers have shown a thermostat’s occupancy signal can be startlingly accurate, and property operators are the ones with dashboard access to it. A device sold to a tenant as a way to shave the heating bill doubles, from the landlord’s side of the login, as a live feed of how the unit is being used.

The Lease Rarely Says Any of This Out Loud

Most residential leases still treat the thermostat as a fixture, like a range hood. The technology addendum, if there is one, tends to authorize “smart home services” in a single paragraph and point to a vendor’s privacy policy hosted somewhere else. That is the document that assigns the data, without ever saying so.

The ACLU suit turns on what the lease never spells out: what the thermostat collects, who sees it, and how long it is kept. The plaintiffs argue that a constitutional privacy right in the home cannot be waived by a lease addendum or a click-through. Whether or not the courts agree, the practical lesson is already clear. If the lease does not name what happens when the tenant moves out, those questions have not been answered — they have been deferred to whoever controls the account.

Regulators Have Opinions; They Just Are Not Uniform

Federal guidance on connected devices has existed for years, generally urging manufacturers to collect only the data they need, to de-identify what they can, and to build security in at the design stage rather than bolt it on. Those are recommendations, not rules, and they aim at device makers rather than the landlord who deploys the device.

Municipal law is starting to fill the space. New York City’s Tenant Data Privacy Law requires owners using smart access systems to publish a retention and privacy policy and obtain express consent, and stops them from using the data to track or harass residents.

A handful of other jurisdictions are moving in the same direction, while most have yet to act. For now, what a landlord is allowed to do with thermostat data varies wildly by city, which is why the etiquette question matters as much as the legal one.

What Reasonable Practice Looks Like

For owners who assumed the technology addendum settled the issue, the Equity Residential case should land as a warning shot that it hasn’t. A better standard is emerging in how careful operators run these devices, and it isn’t complicated.

Disclose the stack. Name the thermostat, the platform, and any integrator in the lease itself, not in a linked policy. If the setup includes occupancy detection, say so plainly.
Split the accounts. Give the tenant their own login for day-to-day control and keep the owner’s account limited to maintenance alerts. Shared logins are the source of most disputes.
Set a retention window. Historical setpoint and occupancy data shouldn’t live forever on a landlord dashboard. A short, written retention period, with deletion at move-out, avoids the argument entirely.
Let tenants opt into extras. Demand-response enrollment, utility data sharing, and third-party analytics should be separate yes-or-no choices, not bundled into the act of moving in.
Say what happens on turnover. The account should be reset, prior schedules wiped, and the new resident onboarded fresh. A thermostat that still remembers the last tenant’s routine is a privacy problem waiting to be noticed.

Owners who want the operational benefits of connected devices without inheriting the legal exposure tend to work with a professional management team that has already written these practices into its standard lease and vendor contracts. That’s the quietly overlooked part of the whole conversation: the etiquette gets easier the moment someone handles it as a policy question rather than a device question.

The thermostat itself isn’t the villain. It’s a small, useful piece of hardware that also happens to keep a diary. Who reads the diary, for how long, and with whose permission, are the questions the next generation of leases will have to answer out loud.