EV Charger Maker Ohme Drops Its “Never Sell Your Data” Promise

What Changed in the Policy

Three changes stand out in Pope’s comparison:

• The no-sale promise is gone. The 2024 policy ruled out sharing or selling personal data “to third parties for marketing purposes”. The new one is silent on selling.
• Retention got vaguer. According to Pope, the old policy kept data for seven years after an account closed or went inactive. Now Ohme keeps it for “a reasonable period after the end of the relationship”.
• Future changes are Ohme’s call. The new policy says it may be amended “at our sole discretion”, with notice by email, in the app or on the page when Ohme plans to use your data in a “significantly different” way.

To be fair to Ohme, the new policy doesn’t say it sells data either. Its list of recipients covers installers, payment providers, energy companies and “advertising and digital media platform partners”. Business partners that introduced you to Ohme may get your details to “contact you about their products, offers and/or services”, with your consent “if required”.

Still, a promise that disappears with an email about a policy update was always more of a mood than a guarantee.

What an Ohme Charger Knows About You

Smart charging works by watching your car, your tariff and your meter, so the list in the policy is long. According to the current policy, Ohme can hold:

• your charging data and “the location of your Ohme cable when it is plugged in”, which together show when you’re home
• your car’s make, model and Vehicle Identification Number (VIN)
• your login for your car maker’s app, where Ohme supports it
• your energy supplier, tariff, meter number and, where applicable, half-hourly electricity consumption for the whole household
• your phone’s IP address, device identifiers and advertising IDs (IDFA on iPhone, AAID on Android)
• photos or videos of your property and fuse box from the installation survey, and your electrical installation certificate

Half-hourly meter readings say more than the charging does. They can show when a household wakes up, cooks and goes to bed. Pope also notes that mileage isn’t on the list, though the charging data would probably give it away. We covered how much connected devices give away in our guide to smart home risks.

The App Terms Changed on the Same Day

Ohme’s website shows that its general terms and its mobile app terms were also changed on 9 November, a minute or two after the privacy policy. We haven’t compared the app terms with their earlier version, so we can’t say which clauses are new. What they say now is worth knowing:

• Ohme says it owns “any data or information generated during or in connection with your use of the App and the Service”.
• The app may check whether your phone is rooted or jailbroken, whether it runs “an official, unmodified operating system”, and whether the app is accessed by “automated tools, bots, scripts, or unauthorised third-party software”.
• More than 200 calls in 24 hours, kept up for 72 hours, “is not a reasonable amount of data to use by a reasonable consumer”.
• You must not let any third party access the app, the service or your data “by using your credentials or by any other means”.

That last pair matters to smart-home users. Home Assistant’s official Ohme integration logs in with your Ohme email and password and checks Ohme’s cloud every 30 seconds, about 2,880 times a day. Read literally, the “unmodified operating system” check would also catch phones running privacy-focused Android versions such as GrapheneOS.

Ownership language in app terms doesn’t cancel your data protection rights. Section 10 of Ohme’s own privacy policy still lists them.

What You Can Do If You Own an Ohme Charger

Pope isn’t ripping out his charger. His plan is a reasonable template:

• Opt out of marketing. Use the unsubscribe link in any Ohme email or write to [email protected], the address the policy gives for its Data Protection Officer.
• Cut off the advertising ID. On an iPhone, turn off Settings > Privacy & Security > Tracking > Allow Apps to Request to Track. On Android, delete it under Settings > Privacy > Ads (menus vary by phone maker).
• Ask for your data. A subject access request under UK GDPR shows what Ohme actually holds. Anyone can make one, and companies usually have one month to respond, according to the ICO.
• Object where you can. Marketing to existing customers and “preferences” analysis rely on Ohme’s legitimate interests, which you can object to. Pope is also weighing an objection to the energy flexibility services, but that data is part of how smart charging works.

If Ohme’s answer doesn’t satisfy you, the policy names the UK’s ICO and, for customers in Ireland, the Data Protection Commission as the regulators to complain to.

We’re asking Ohme why it removed the sentence, whether it shares or sells customer data for marketing, and how the new app terms apply to Home Assistant users, and will update this article when it replies.