What the app knows

The case that made this a consumer question

In 2016 the Canadian maker of We-Vibe was sued over its app. The claim was that the app collected information about how the product was used, beyond what buyers understood they were agreeing to. In 2017 the company settled the class action for around $3.75 million, with individual payments of up to $10,000 for users whose data had been collected.

Two things about that case are worth keeping.

The first is that the product worked. Nobody claimed the toy was faulty. The complaint was entirely about what happened after the phone connected — which is the part of the purchase no review covers.

The second is that it was settled, not decided. There is no court ruling saying what a connected toy may collect. Which means the answer to "is this allowed" is not settled law; it is whatever the privacy policy says, and whatever a regulator decides to enforce.

What a connected toy can actually record

Not a hypothetical list — this is what any app with these permissions can assemble:

Pairing events. When a device connected, to which phone, and how often.

Sessions. Start and stop times, duration, and the gap between them. This is the one that reads as trivial in an engineering log and as intimate in a database.

Settings. Intensity, pattern, and how often they were changed.

Account details. An email address, and whatever else registration asks for.

Device and network metadata. Phone model, operating system, and an approximate location derived from an IP address.

None of these are necessary to make a motor vibrate. They are necessary to make a product that can be improved, marketed, and analysed — which is a legitimate business goal, and also the reason the data exists at all.

"We don't sell your data" is not the whole answer

That sentence is usually true and rarely sufficient. Data can leave a company without being sold:

Breach. A database that exists can be copied. The question is not whether a company intends to lose it but what happens to it if the company does.

Third-party code. Most apps include analytics and crash-reporting libraries written by other companies. What those libraries collect is often defined by their own terms, not the toy maker's.

Retention. "We keep it for as long as necessary" is the standard wording, and it is compatible with keeping it forever.

Legal requests. A record that exists can be requested. A record that was never created cannot.

Under UK and EU data law, information about sexual activity falls into the most protected category there is — special category data. That category cannot be processed on the basis of ordinary commercial interest; it requires explicit consent, and consent has to be specific and withdrawable. That is a stronger standard than most privacy policies are written to, which is why reading one is worth ten minutes.

What has changed since 2017

Two things, and both help you.

The law got teeth. GDPR and the UK equivalent impose obligations that did not exist in 2016: stated purposes, retention limits, the right to have data deleted, and fines calculated against global turnover.

Independent testing started scoring it. Stiftung Warentest, the German consumer organisation, rated the Satisfyer Pro 2 Generation 3 "good" (1.7) in its November 2025 issue. It tested the product against models from Lelo, Fleshlight, Womanizer and Svakom, and the scoring dimensions were material quality, data protection and ease of use.

That last one is the significant part. A consumer organisation treating data protection as a product attribute — scored alongside the silicone — moves it from a privacy argument into an ordinary buying decision. It also means there is now a number you can compare, which is more than most reviews offer.

How to choose around it

Decide whether you need the app at all. Most connected toys still work as standalone devices; the app adds remote control and patterns. If you do not need remote control, buying a non-connected model removes the entire question, and often removes a hundred pounds from the price as well.

If it is app-optional, use it that way. Installing the app, pairing, and then declining the account is usually possible. Data that was never tied to an identity is much less interesting to everyone.

Read four things in the privacy policy. Whether the product works without an account. The stated retention period, in months or years rather than "as long as necessary". The named company and its jurisdiction — the same company-number question as anywhere else, and it tells you which regulator you would complain to. And whether third-party libraries are listed by name.

Assume a breach, not a betrayal. The realistic risk model is not that a company decides to publish your usage. It is that a database is copied, or a subcontractor's system is. That framing makes retention the thing you care about most.

A five-minute check before you buy

The app store listing is the fastest source, and almost nobody uses it.

Both Apple and Google now require apps to declare what they collect and whether any of it is used to track you across other companies' apps and websites. Open the listing for the app named on the box and read the privacy or data safety section. Three things to look for:

Is there an account requirement? If the app cannot be used without registering, the data is tied to an identity from the first minute. If it works as a guest, most of the question disappears.

Is data "linked to you"? Apple separates data that is not linked to your identity from data that is. The second category is the one that follows you, and it is usually a much shorter list than the first.

Is any of it used for tracking? That is the category that leaves the company and reaches advertisers. A product can collect a lot and track nothing; the distinction matters more than the total volume.

The listing is a declaration rather than an audit — it is written by the company, published under store policy, and not verified line by line. But it is shorter than a privacy policy, it is standardised, and it is the single most useful five minutes available here.

What this does not mean

It does not mean connected toys are unsafe, or that the brands selling them are acting in bad faith. Remote control exists because couples asked for it, and the data collected is mostly the exhaust of making an app work.

It does not mean a settlement in 2017 describes how any company operates now. Nine years is several privacy regimes ago.

And it does not mean you should avoid the category. It means that for the first time, there is a second axis to judge these products on — and one of the few axes where a small brand can beat a large one, because not collecting data is cheap.