After Nest Support Ends, Old Smart Thermostats Keep Sending Logs

While Google may have nixed remote control with the first- and second-generation Nest Learning Thermostats, they’re not just going to sit there collecting dust. A security researcher discovered that many of these legacy models continue to send copious logs back to Google’s servers, and the revelation has reignited debate about end-of-life questions, minimal data policies, and what consumers are owed when connected products lose a vital feature.

What Has Changed for Owners of Legacy Nest Devices

Early Nest owners were hit with a significant downgrade when remote app controls were disabled. This led the security researcher Cody Kociemba to develop an open-source workaround named No Longer Evil. Per reporting by The Verge and comments from Kociemba, the project was jumpstarted with a bounty contribution from FULU, which is a right-to-repair group co-founded by repair advocate and YouTuber Louis Rossmann.

To regain full capability, Kociemba reimplemented Google’s API so he could again control older devices remotely. But in the process, he got deluged with telemetry logs from user devices that showed how much data the thermostats were still sending upstream. He then disabled these reports on his end.

The Data Still Flowing From Legacy Nest Thermostats

Even after support was discontinued, the thermostats reportedly still upload detailed logs consisting of manual temperature changes, signals sent by presence detection indicating when users enter and exit rooms, sunlight exposure impacting how its temperature algorithms work, and whether homeowners have set a thermostat to “away.” Google has publicly said legacy devices would continue to report logs for purposes of diagnostics, even though they were no longer receiving software or security updates.

Kociemba’s bottom line is blunt: even with remote features turned off, telemetry was still active. The effects have two sides — the users get a losing product (I paid for this at some point) and the company gets a steady stream of behavioral and technical data about those devices.

Why It Matters for Privacy and Policy in Smart Homes

Data minimization — taking only what is necessary — is a foundational principle in modern privacy frameworks. From the Federal Trade Commission to EU regulators, enforcement officials stress that restricting data after a service changes or ends is crucial. And if an organization ceases to provide remote support or troubleshooting, the question will become why ongoing telemetry can still be supported.

The “NIST guidance for IoT and what the industry tells us is best,” Poell added, suggests easy-to-understand end-of-life policies, such as how data flows continue when features are lost. No clear, granular controls mean users are kept in the dark about which signals are still being harvested, for how long, and under what rationale.

The stakes are not theoretical. Smart thermostats are the heart of home energy use, occupancy signals, and comfort behavior. Parks has said adoption of smart thermostats in U.S. broadband households is in the high teens, indicating millions of homes might be impacted by how vendors handle end-of-support situations and data practices.

A Smart Home Pattern We’ve Seen Before, Repeating

The situation harkens back to previous smart home brouhahas in which products lost essential difference-making features, or were killed outright, leaving e-waste and broken dreams. Previous instances include the Revolv hub’s shutdown and the blowback around aging speakers and wearables being put out to pasture against their will. Each episode highlights the gap between the long life of rugged hardware and the short life of cloud services that run on it.

Groups advocating for a right to repair, like FULU, say users should have the tools to keep devices functioning once official support ends. Consumer advocates such as organizations like the Electronic Frontier Foundation also urge commitments on data portability, deletion, and predictable lifecycle disclosures prior to purchase.

What Consumers Can Do Now to Protect Their Privacy

If you are a user of the first- or second-gen Nest devices, consider checking account-level privacy settings and asking for access or deletion under existing law like GDPR or CCPA.

• Use router controls or DNS blocking to limit device telemetry, understanding this may adversely affect existing functions.
• If you try third-party solutions such as No Longer Evil, be cautious: audit the code and understand the security trade-offs.
• Prepare for end-of-life replacement if devices with robust offline modes, local control choices, and clear end-of-life policies are not in place.
• Seek manufacturers that promise long-term support timelines and publish how they retire cloud dependencies and telemetry.

The Bottom Line on Legacy Nest Data and Trust Issues

Google’s decision caused an unusual fork: the service came to a close for legacy Nest thermostats, but the data stream continued. Kociemba’s discoveries speak to a larger smart home paradox — when cloud support ends, users assume that both functionality and data-gathering will taper off in sync. Until retailers provide that symmetry, trust in the connected home ecosystem will continue to feel a few degrees colder than advertised.