BC Hydro Is Offering Free Smart Thermostats. What Should Families Know Before Signing Up?
Caveat - We’re privacy hawks here at The White Hatter, and that’s the perspective we bring to this article. We see the appeal of free thermostats and understand why BC Hydro wants to reduce demand during peak periods. Before bringing a connected device into our homes, though, we want to know who can adjust it, what information it shares, and how much control families keep once it’s on the wall. Before signing up and installing these free smart thermostats BC residents may want to read this first.
A free thermostat is an appealing offer, especially heading into a B.C. winter. But when that thermostat connects to the internet and allows your utility to adjust the heat remotely, there are a few questions worth asking before you replace the one on your wall.
Those questions came up when an email from BC Hydro’s Power Smart team landed in our inbox. Eligible residential customers with electric baseboard heating can order up to five free smart thermostats from Canadian brands Mysa or Sinopé, with free shipping. Customers enrol in Peak Saver at checkout and can earn a $50 seasonal bill credit per household (1).
One line in the email caught our attention. During periods of high electricity demand, BC Hydro said it would “automatically lower your thermostat.” We wanted to know what families agree to when they sign up, how they can take control during an event, and what the manufacturers say about the information their products collect.
What happens when BC Hydro adjusts your heat?
We understand why BC Hydro is doing this. If enough households use a little less electricity at the same time, it helps ease demand on the grid. A connected thermostat lets households participate automatically.
During a Peak Saver event, BC Hydro says it may adjust an enrolled thermostat’s setting automatically and remotely by one to three degrees Celsius for up to four hours. You can override the adjustment or opt out of an event at any time. If you opt out of more than half the events in a season, you may lose eligibility for the $50 seasonal reward (1).
Now picture a babysitter at your house with a child who’s sick, or a grandparent who’s home during the day. If the room feels too cold, can they turn up the heat at the wall? Do they know how? It’s easy to picture yourself opening the app and making an adjustment. It’s worth picturing what happens when someone else is home and you’re unavailable.
What hacked supermarket fridges can teach us
In November 2026, attackers remotely raised temperatures in connected refrigeration systems at supermarkets across Europe, forcing some stores to throw away food. In an earlier wave of attacks in France, officials said attackers exploited known vulnerabilities. A change made over the internet had a physical consequence that store employees had to deal with on site (2).
That’s what makes the example relevant to families. A supermarket fridge and a home thermostat serve different purposes, but both are connected to the internet and use software to control temperature. Peak Saver gives BC Hydro permission to make temporary adjustments. The supermarket attacks raise a separate question about connected devices that control something we depend on. How does the manufacturer keep someone without permission from changing the settings?
AI adds another layer. In its Project Glasswing research, Anthropic reported that an AI model found previously unknown software flaws and, in some cases, developed working ways to exploit them. Security teams can use that capability to find and fix flaws sooner. As similar tools become more widely available, attackers could use them to uncover weaknesses in the software behind connected devices. For a thermostat you might leave on the wall for years, we’d want to know how long the manufacturer will provide security updates and how those updates reach the device (3).
What did we find in the privacy policies?
A heating schedule can offer clues about when people are home, when they go to bed, or when the house is usually empty. What a company can learn depends on what the device records and what gets shared. We’d ask what stays on the thermostat, what goes to the manufacturer, and what BC Hydro receives through Peak Saver (4).
Mysa says it may process, store, or transfer personal information outside Canada, where authorities may be able to obtain it under local law. Its policy also says third-party partners may use cookies and similar tools on the Mysa website to collect browsing activity over time and across sites, including to build advertising audiences. That disclosure concerns website browsing. We’d like Mysa to ask visitors to actively opt in to optional advertising tracking. (5)
Sinopé also says it may transfer or store personal information outside Canada. Its policy explains that service providers abroad may have to disclose information under local law and invites customers to ask where those providers are located. It also explains what happens when you reset the device. A factory reset can delete data stored on the thermostat. Deleting personal information stored in Sinopé’s cloud requires a written request (6).
Both policies allow some personal information to be handled outside Canada. From the public policies, we couldn’t establish where all data from these particular Peak Saver installations is stored or which providers control it (5)(6).
Why the server’s location is only part of the question
Under the U.S. CLOUD Act, a covered provider subject to U.S. jurisdiction can be required through applicable legal process to disclose specific data in its possession, custody, or control, even if the data is stored abroad. That gives families two questions to ask. Where is our information stored? Which providers have custody or control of it? Answering those questions for these thermostats would require more detail about the services behind the offer (7).
Six questions we’d ask before ordering
1/ Can anyone caring for our family adjust the heat at the wall? Ask what works without a phone, Wi-Fi, or access to the manufacturer’s online service.
2/ How do we override a Peak Saver event or leave the program? Find out what each choice means for the seasonal credit and which features you can still use if you un-enrol.
3/ What information does each organization receive? Ask whether BC Hydro or the manufacturer receives temperature readings, schedules, or device activity, where that information goes, and how long it’s kept.
4/ How is remote access protected, and how long will this model receive security updates? Ask whether the account supports two-step verification and whether updates install automatically.
5/ What happens to our information when we move or replace the thermostat? Find out how to unlink the device from your account, reset it, and request deletion of data stored online.
6/ Did BC Hydro consult with the BC Privacy Commissioner’s office before offering this program, and if so, what did they say? We were unable to confirm from public records whether BC Hydro consulted B.C.’s Office of the Information and Privacy Commissioner before launching its free smart thermostat offer. In an earlier investigation of BC Hydro’s smart meter program, the commissioner’s office recommended that BC Hydro submit privacy impact assessments for new or expanded smart-grid features before they go live (8). We’d like BC Hydro to clarify whether it completed or updated an assessment for this offer, whether it shared that assessment with the commissioner’s office before launch, and whether customers can read a public summary.
If you’ve already installed a connected thermostat, try adjusting it at the wall and show the people who care for your home or children how to do it. Use a unique password for the account, turn on two-step verification if it’s available, and check how the thermostat receives security updates.
So What Is Our Recommendation?
We’d hold off on signing up until we had clear answers about what data is shared, if that data is accessible outside of Canada and who has access, how long the thermostat will receive security updates, and how everyone who needs to can adjust the heat. If someone in your household depends on a steady temperature or regularly receives care at home, we’d give those answers more weight than the seasonal credit.
There’s a digital literacy conversation here for our kids, too. The next time your family sees an offer for a free connected device, ask them what you get and what you agree to in return. A thermostat makes that conversation concrete. Who has access to the information collected, who can turn up the heat, what could the device reveal about your family’s routines, and who takes care of it after it goes on the wall?
Remember, with convenience comes vulnerability!
Digital Food For Thought
The White Hatter
Facts Not Fear, Facts Not Emotions, Enlighten Not Frighten, Know Tech Not No Tech
References
