The holidays are upon us yet again, which must mean it’s time for my annual gift guide! And this year, I’ve included some fun tips from some friends at Consumer Reports!
Special Podcast Edition!
In years past, I’ve given just an overview of my gift guide on my podcast as a 5-10 minute “Tip of the Week”. But I’ve been wanting to turn it into a full episode and bring in a panel of kick-butt experts to help… and this year, I pulled it off! You absolutely owe it to yourself to listen to my Best & Worst Gift Guide podcast with three amazing and entertaining professional product reviewers from Consumer Reports: Yael Grauer, Stacey Higginbotham and Jeff Landale. While I’ve tried to capture their main recommendations here, it doesn’t begin to capture all the great tips and strategies we covered in the show. You can listen just using your web browser here. Also, CR has given me a $10 off coupon for a one-year subscription – see below! (NOTE: This coupon has expired.)
Overall Strategies
There are two major trends with tech products today that have serious implications for your cybersecurity and privacy: connecting devices to the internet and adding artificial intelligence (AI) features. With the rise of the Internet of Things (IoT), we’ve been connecting everyday, mundane things to the internet to make them “smart”. While this can add some fun and even useful “cloud” features, it’s also ripe for abuse. The makers of these devices can often update their software automatically, and they’ve used this power to add sneaky data gathering and unsolicited advertising. To make matters worse, many cloud-connected devices are now using that connection to purposely limit or charge for functionality – a practice called software tethering. (This $2700 smart mattress stopped working during the recent AWS outage.)
The more recent troubling trend is adding AI to all these connected devices. Again, AI can add some fun features, but it’s a privacy nightmare, especially in the absence of strong data privacy laws. AI features take a lot of computing power and most connected devices do AI processing in the cloud. Even software apps we’ve been using for years without AI features are now sending our data (including documents and photos) to the cloud. And it’s not just that your private data is being sent to the cloud for processing, in many cases it’s also being used to train future AI models. Many of these AI features have been added without your consent and have automatically opted you in for data sharing (like Microsoft Windows/Office, LinkedIn and Meta/Facebook).
Here are my top strategies for giving gifts that won’t undermine the privacy and security of your recipients:
- Avoid unnecessary AI features. If you are going to give someone a gift with AI features, look for devices that do AI processing locally (on device only). Also, prefer products made by a brand name company with a reputation to protect. You might do a little research on how to configure the device to opt out of data gathering or training their AI based on user data. (See this article for help.)
- Avoid unnecessary internet features. Pretty much the same argument as above, but you should also be looking for devices that have a dedicated support plan. Will the device continue to work without the internet or if the company stops supporting the device?
- Consider buying dumb, analog “retro” gifts. There’s a growing “techlash” against all of these modern connected devices. Consider buying classic and classy unconnected devices instead. (There are some specific recommendations below.)
- Replace bad products with better ones. If you know that someone has a cheap IoT device with sketchy security or a connected product that collects and abuses personal data, maybe you can buy them a replacement device that’s better (and help them set it up).
By spending money on products that are more secure and private, we’re not only supporting companies that are trying to do the right thing, we’re telling the other companies that their is a market for secure and private products and they need to up their game to compete.
Naughty List (Worst Gifts)
Let’s call out some popular products that are particularly bad for privacy or security.
- DNA testing kits. Companies like 23andMe and Ancestry.com sell DNA kits that can help you find lost relatives, trace your lineage, and supposedly even help you find congenital medial problems. There’s arguably nothing more personal than your DNA – your genes are you. 23andMe went bankrupt in March and was sold to another company, along with the user genetic data. It’s still not clear what they buyer will do with it, but you can (at least for now) still request that your data be deleted. Also, as Yael points out in the podcast, DNA tests can sometimes produce some uncomfortable genealogical surprises. Check this article from Consumer Reports for more info.
- Smart devices from Google, Amazon & Facebook. These companies make a ton of money from advertising and promoting products, which drives them to collect as much user data as possible. While they tend to be good about security, there’s a huge conflict of interest when it comes to your privacy. Note that this includes devices from companies that are now owned by them, including Ring, Nest, Fitbit, Waze, Blink, Eero, Twitch, and others. I’m not saying all of these products are the same or all horrible for privacy. But I am saying that even if they’re not monetizing your data now, they will be under enormous pressure to do so at some point. I would specifically stay away from Meta’s smart glasses.
- Cheap, off-brand IoT devices. This is a judgment call and it’s not always obvious which makers are shady. You may need to do some research on the manufacturer. But generally speaking, if the device is super cheap, security was likely not a priority and/or data monetization is being used to subsidize the cheap cost. Well-known brands will usually be more incentivized to protect their reputation.
- Connected toys for kids. I would particularly avoid giving internet-connected devices to children, particularly if they have built-in microphones, cameras or location tracking. These toys can (and have been) hacked, but it’s also just really creepy.
- Connected toys for adults. There have been several horror stories about smart sex toys revealing personal information. Buy traditional, unconnected devices. And if you want to keep that purchase private, I would pay cash in person and avoid buying online.
- Modern cars. Mozilla released a hair-raising report last fall on how much data is being collected and shared by newer cars. And the NY Times exposed how car data gathering has led to higher insurance rates for unsuspecting drivers – and sold for a pittance. It’s absolutely horrific – and right now there’s very little you can do to stop it – though some auto makers allow you to opt out, if you can figure out how. Privacy4Cars has a helpful tool called Vehicle Privacy Report.
One quick note about TP-Link routers, which have been in the news a lot lately (the US has threatened to ban them for national security reasons). Many popular home routers also source hardware and software from China, though it’s possible that TP-Link is more concerning than others. While home routers are prime targets for cyber criminals and nation state hacker groups, it’s mostly to conscript them into botnets – not to attack the owners directly. Your best defense is to keep the router firmware updated, change the default admin password, and turn off any remote access or management features. See below for a specific router recommendation. The Router Security site has a ton of useful info.
Nice List (Best Gifts)
- Opt out of data collection. You should delete as much of your information as possible from people search sites and data brokers. The best bang for your buck is EasyOptOuts – not just according to me, but also Consumer Reports, Privacy Guides and Wirecutter. (I interviewed the co-founders last year.) Give this as a gift to yourself and your loved ones.
- iPhone 17 or 17 Pro. I’m an Apple guy, I admit it. But the brand new iPhone for 2025 has a new security hardware feature that’s really a game-changer. It’s pretty technical, but it makes iPhones extremely difficult to hack. (Google Pixel has a limited version of this feature and may catch up eventually.)
- Open-source WiFi router. Your home router is the gatekeeper for your entire home network and you want it to be as secure as possible. But many people get their router from their internet service provider (ISP). While this may be secure enough, it also means your ISP can see your internal network traffic. I suggest that you buy your own router – and I recommend models that come with or can be updated with open source software like OpenWRT. The GL.iNet Flint routers are good options – I have the basic model, and it works great and doesn’t cost much.
- Private home automation. For smart speakers, home assistants and other home automation, I personal like Apple products like HomePod and Apple TV. But you might also look at Homey or the more do-it-yourself, open source Home Assistant. (Thanks to Consumer Reports’ Stacey Higginbotham for those last recommendations.)
- A screen privacy visor. If you’re often working on your laptop in public places (coffee shops, airlines, airports, etc.), there’s a simple way to make your screen a lot harder to see from any angle other than straight on: a privacy screen. You need to find the one that matches your specific laptop (just like getting a phone case). I just bought a SightPro model which magnetically snaps on to my MacBook Air screen. (Thanks to Yael Grauer from Consumer Reports for this recommendation.)
- A privacy-respecting VPN service. A virtual private network will protect your web traffic from your internet service provider (ISP). When you’re in a hotel, coffee shop, hotel, airplane, or some other place with free WiFi, then they are your ISP. (And on mobile devices, your carrier is your ISP.) Wirecutter has a very good write-up on the best VPNs. I would recommend Proton VPN, IVPN or Mullvad. NOTE: Be careful when reading VPN reviews – many are written by the same companies that own the service.
- Password Manager. The first thing you should do to protect your online accounts is to use a strong, unique password for each one. The human brain just cannot do this – you need a password manager. I recommend BitWarden or 1Password. (At this point, I would steer clear of LastPass.) You can buy someone a one-year subscription or include them in a family plan.
- NextDNS. A nifty solution for blocking internet tracking and avoiding malicious websites is a privacy-oriented DNS service. The basic plan is free, which will work for most people. But if you have a ton of smart devices like me, you’ll probably need to pay for a plan.
- Apple AirTags. If you lose stuff a lot, AirTags can be a life-saver. They’re amazingly good at tracking things – luggage, purses, wallets, key rings, bikes, backpacks and even cars. NYPD even gave out AirTags to try to thwart rampant auto theft. One more bonus: Apple now let’s you share AirTag locations with airlines, so they can use it to find lost luggage, too.
- Firewalls Don’t Stop Dragons. My book is pretty big (almost 600 pages and over 200 tips), so it’s not going to fit in someone’s stocking – but it’s a great gift for just about anyone who wants to improve their security and privacy. Don’t let the size put you off – about half of those pages are screenshots and the tone is intentionally conversational and accessible for non-technical people.
Non-Tech Gift Options
In my recent interview with Yael Grauer, Stacey Higginbotham and Jeff Landale from Consumer Reports, we discussed several non-tech, analog, and “retro” gifts that you might finding interesting.
- Yael had a lot of fun suggestions including Lola blankets, Darn Tough socks, DragonFjord puzzle a day game, and fun techy nail polish from Mooncat.
- Stacey recommended a subscription to The Onion, which will actually send you a paper edition. She also mentioned these really cool mountain tumbler glasses and the Kobo eReader. (And you might check out the Calibre app for managing your ebooks.)
- Jeff recommended buying traditional media, like DVDs, CDs and vinyl albums. Not only will your media watching and listening habits be kept private, but you will actually own your content instead of leasing it.
- We all recommended buying real, physical books. Some top recommendations:
Consumer Reports Discount
To celebrate our collaboration for my Best & Worst Gifts podcast, Consumer Reports set up a coupon code for my audience that will knock $10 off your annual subscription. It’s great to support the work these guys are doing – and now you can do it for 25% less than normal!
(NOTE: This coupon has expired.)
You should also check out a couple fantastic Consumer Reports tools:
And again, the podcast with Yael, Stacey and Jeff was a ton of fun and chock full of gift-giving advice – check it out!
Need practical security tips?
Sign up to receive Carey's favorite security tips + the first chapter of his book, Firewalls Don't Stop Dragons.
Don't get caught with your drawbridge down!
