Your Home Router Is Watching You — And Your Internet Provider Isn't the Only One Cashing In
When people think about home network privacy, the conversation almost always lands on the internet service provider. Comcast knows what you're doing. AT&T sells your data. Verizon tracks your browsing. All true, all worth caring about. But there's another device in your home that gets almost no scrutiny, sits on your network 24 hours a day, and has direct visibility into every connected device you own.
Your router.
Not the one your ISP rents you — though that's a whole separate problem — but the consumer router you bought at Best Buy or ordered off Amazon because you wanted better Wi-Fi coverage. That Netgear, that TP-Link, that Eero. The one you set up once and haven't thought about since.
It's time to think about it.
What Consumer Routers Are Actually Tracking
Modern consumer routers are running full operating systems with persistent internet connections. They're not passive hardware — they're active network participants, and many of them are configured to collect and transmit data by default.
The types of data commonly collected include device inventory (every device on your network, including MAC addresses and device names), DNS query logs (essentially a record of every domain your household tries to reach), traffic metadata (volumes, timing, and frequency patterns), and in some cases, deep packet inspection data that goes further than most users would be comfortable with.
TP-Link, one of the most widely sold router brands in the US, has faced serious scrutiny over its data practices. A 2024 congressional investigation flagged TP-Link's ties to Chinese state entities and raised concerns about what data the company's infrastructure might be accessing. The company has pushed back on those characterizations, but the investigation resulted in enough concern that a potential US ban was being discussed at the federal level.
Netgear's privacy policy, if you read it — and almost nobody does — explicitly reserves the right to collect network usage information and share it with third-party partners for analytics purposes. Eero, now owned by Amazon, has a privacy policy that ties directly into Amazon's broader data ecosystem. If you have an Alexa device and an Eero router, you're giving Amazon a remarkably complete picture of your household's digital behavior.
None of this is hidden, exactly. It's in the terms of service. But "disclosed in a 47-page privacy policy" and "transparent" are not the same thing.
The Monetization Model Nobody Explains at the Point of Sale
Here's why routers at the $80–$150 price point can offer features that used to cost three times as much: the hardware isn't always the primary revenue stream.
Some manufacturers operate on what's effectively a data subsidy model. The router collects anonymized (they say) network behavior data, aggregates it, and sells insights to advertising networks, market research firms, or other data brokers. Your household's traffic patterns — when you stream, what services you use, how many devices you run, when you're home — has real commercial value.
Others monetize through partnerships baked into the firmware. Some routers come pre-configured to use specific DNS providers that log queries. That DNS provider might offer the router manufacturer a revenue share in exchange for being the default. You never opted into this. You never knew it was happening.
ISP-provided routers are often the worst offenders here since the ISP already has financial incentives to maximize data collection, and their hardware is purpose-built to facilitate that. But even third-party routers purchased specifically to escape ISP hardware aren't automatically clean.
Why Firmware Updates Aren't a Complete Fix
When a router vulnerability gets disclosed, the standard advice is to update your firmware. It's good advice as far as it goes. But it's worth understanding what firmware updates actually fix — and what they don't.
Firmware updates patch known security vulnerabilities. They don't change the data collection architecture. They don't alter the privacy policy. And critically, they don't address the reality that many routers stop receiving updates entirely after two to three years, leaving known vulnerabilities permanently unpatched on millions of active home networks.
A 2023 study from the American Consumer Institute found that a significant portion of home routers in active use were running firmware that hadn't been updated in over a year, and many were running versions with publicly disclosed vulnerabilities. These aren't edge cases — they're the norm for how most Americans manage home networking hardware.
Factory resets are similarly limited. They restore your configuration to defaults, which can remove malware or unauthorized access if your router was compromised. But a factory reset doesn't change what the manufacturer's firmware is designed to collect. You're resetting to the data-collecting baseline, not to a clean privacy state.
How to Actually Audit Your Home Network
The good news is that you don't have to be a network engineer to take meaningful stock of what your router is doing.
Start with the admin panel. Log into your router's admin interface (usually 192.168.1.1 or 192.168.0.1) and look for any cloud reporting, telemetry, or remote management settings. These are often enabled by default. Disabling them won't necessarily stop all data collection, but it reduces the surface area.
Check your DNS settings. If your router is using your ISP's default DNS servers, your ISP is logging every domain lookup from your household. Switching to a privacy-respecting DNS provider like Cloudflare's 1.1.1.1 or Quad9 is a meaningful improvement. You can configure this either on the router itself or on individual devices.
Audit connected devices. Most router admin panels have a connected devices list. Go through it. Unknown devices on your network are a red flag. Older smart home gadgets are common vectors for network compromise.
Look up your router model's support status. Manufacturers publish end-of-life dates for firmware support. If your router model is past that date, you're running hardware that will never receive another security patch. That's a real problem worth solving.
Privacy-Focused Router Alternatives Worth Considering
If you're ready to move beyond the standard consumer router ecosystem, a few options stand out.
GL.iNet routers run OpenWrt-based firmware and are designed for users who want granular control over network behavior. They're not plug-and-play for non-technical users, but they're among the most transparent options available at a reasonable price.
Firewalla takes a different approach — it's a network security device that sits alongside your existing router and provides monitoring, ad blocking, and traffic analysis tools that actually give you visibility into what's happening on your network rather than obscuring it.
pfSense and OPNsense are open-source router/firewall platforms that run on dedicated hardware. They're the gold standard for privacy and control, but they require meaningful technical investment to set up and maintain.
For most households, the honest recommendation is to combine a mid-range router from a brand with a cleaner privacy track record (ASUS has historically been more transparent than most) with a Pi-hole DNS sinkhole to block tracking queries at the network level.
The Bigger Picture
Your router is infrastructure. It's the thing everything else in your home connects through, which makes it uniquely valuable as a data collection point — and uniquely dangerous as a security vulnerability.
The privacy theater element here is real: we've been trained to worry about apps, browsers, and social media while the device routing all of that traffic sits in the corner, largely unexamined, doing whatever its manufacturer configured it to do.
You don't have to go full network engineer to meaningfully improve your situation. But you do have to stop treating your router as a set-it-and-forget-it appliance. Because the companies that made it definitely haven't forgotten about it.
