Amazon Smart Home: Four Years of Security Updates, and the Dates They End

Affiliate disclosure: we may earn a commission if you take out a product through links on this page. It costs you nothing extra and does not influence how providers are listed.

Amazon guarantees software security updates on an Echo for at least four years from the day you buy it new from Amazon as the seller on Amazon.co.uk, and Ring makes the same four-year promise on its doorbells and cameras. Both then publish a hard end date for every model, and those dates run as far out as 31 December 2031 on the newest Ring cameras. Every figure here comes from Amazon's and Ring's own support pages and was checked on 27 September 2026.

Publishing the dates at all puts Amazon in the better half of this market. When Which? surveyed 128 connected-product brands in June 2024, weeks after the law requiring that disclosure took effect, 29 of them - 23% - had published nothing usable or did not reply, and a further 23 offered a policy with no end date in it. Amazon's tables name the model and give the day. The estate they cover is large: the company says 56 million smart home devices are connected to Alexa across the UK, and Ofcom's Technology Tracker found a smart speaker in 41% of British households.

One thing to hold on to before reading a single listing. That four years is Amazon's promise about hardware Amazon itself makes - Echo, Fire TV, Ring and Blink. Most of the smart-home catalogue is other companies' products sold by other companies, and each of those carries whatever update period its own manufacturer chose to publish. In law Amazon is a distributor there rather than a manufacturer, and a distributor's duty is a different and much thinner one.

Four years from the till, and the day it stops

The commitment is written the same way across the three ranges. Amazon's Echo page promises "software security updates until at least four years from when you bought it new, from Amazon as the seller, on Amazon.co.uk", or until a later date published against the model - whichever comes last. Fire TV carries the identical wording. Ring's is "at least four years from when you bought it new", again with a published date as the floor.

The tables behind those sentences are short and blunt. Every Echo falls on one of two dates. 31 December 2029 covers the Echo Dot 3rd, 4th and 5th generation, the Dot Kids, the Dot with Clock, the Echo Show 10 3rd generation, the Show 8 1st and 2nd generation, the Show 5 2nd generation, the Show 15 1st generation, the Show Kids 3rd generation, the Echo Link, the Link Amp, the older Echo Studio and the Echo Sub. 31 December 2030 covers the Echo Pop, the Echo 4th generation, the Show 5 3rd generation, the 2025 Show 8, the Show 11, the Show 15 2nd generation, the Show 21, the Echo Hub, the 2024 Echo Spot, the 2025 Echo Studio and the Echo Dot Max. Fire TV is simpler still: almost the whole range ends on 31 December 2030, with the first-generation Fire TV Stick 4K alone on 2029.

Set the dates against the prices Amazon announced on 30 September 2025 and the guarantee acquires a unit cost. An Echo Dot Max is £99.99 and an Echo Studio £219.99, both supported to 31 December 2030 - five years and three months from launch, which on the Studio is about £42 a year of guaranteed patching. The Echo Show 11 is £219.99 and the Show 8 £179.99 on the same date. The adjustable stand, if you want one, is £34.99 and has no software in it at all.

The "whichever is later" mechanic is worth following through, because it decides which number applies to you. Buy an Echo Dot Max in September 2026 and four years from purchase lands in September 2030, three months short of the published date, so the published date governs and you get four years and three months. Buy the same device in 2029 and the published date has almost gone, so the four years governs instead and support runs into 2033. The promise is generous late in a product's life and barely binding early in it.

Ring is candid about what sits on the far side of the date, in wording most manufacturers would have left out: "After that time, we may continue to provide software security updates for as long as we can (subject to technical and other limitations)", followed by the line that matters most - "the update period is not a guarantee as to how long your device will last". That is an honest sentence about a four-year floor under a device screwed to a door frame.

The law that made them print a date

None of this was voluntary. The Product Security and Telecommunications Infrastructure Act 2022 took Royal Assent in December 2022, and the regulations that put it to work - the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023, SI 2023 No. 1007 - were signed on 14 September 2023 and came into force on 29 April 2024. A further amendment on 25 February 2025 added vehicle exemptions.

Three duties fall on the manufacturer, and they are narrow enough to check. Passwords must be unique to the product or set by the user, and a product-unique password may not be built from an incremental counter, from publicly available information, or from a product identifier unless it is encrypted. There must be a published point of contact "to allow a person to report to the manufacturer security issues", with stated timelines for acknowledging a report and for status updates on it. And the defined support period must be published: the minimum length of time, expressed as a period with an end date, for which security updates will be provided, in language a buyer can understand without technical knowledge, and available without giving personal data or asking first.

That last clause is why a page like Amazon's exists and why you should be able to find one for any connected product on sale here. It is also where the regime draws an odd line. Schedule 3 excepts a short list of products: those covered by relevant EU legislation for the Northern Ireland market, electric vehicle smart charge points, medical devices, smart meter products assured under National Cyber Security Centre schemes, and desktop and laptop computers along with tablets that have no cellular connection. So the laptop you use to set the whole smart home up is outside the rules that govern the smart plug it is talking to.

Enforcement belongs to the Office for Product Safety and Standards. Its powers under the Act run from a compliance notice under section 28, through a stop notice under section 29 - which may be issued without prior notice where there is an urgent need - to a recall notice under section 30 requiring arrangements for the return of the products. The money at the end of that ladder is serious: the maximum penalty is the greater of £10 million or 4% of the person's qualifying worldwide revenue for their most recent complete accounting period, with daily penalties of up to £20,000 while a breach continues.

Ask for the statement of compliance - Ring's is online, signed and dated

There is a second document the regime creates, and it is the one a shopper has a direct claim on. Section 22 stops a distributor making a relevant product available in the UK unless it is accompanied by a statement of compliance. The Government's own guidance concedes that the Act "does not define the terms 'document' or 'accompany'", so it can be paper in the box or something digital, and each business works out how to satisfy it. The contents are prescribed: the product, the manufacturer, a declaration of conformity, the defined support period, the signatory and where and when it was issued.

Ring publishes its. The UK statement is version 2.3, filed by Ring LLC of 12515 Cerise Ave, Hawthorne, CA 90250, USA, first issued on 29 April 2024 - the day the regime began - and signed on 27 March 2026 by Jason Mitura, VP. It covers 31 products across indoor, outdoor, spotlight, floodlight and peephole cameras, wired and battery doorbells, chimes, alarm components, an intercom and access control units, and it declares that they "are in conformity with the relevant statutory requirements for sale in the United Kingdom, including: the security requirements; and the compliance requirements, of the Product Security and Telecommunications Infrastructure Act 2022".

Read it beside the support page and the two do not say the same thing. The statement promises "guaranteed software security updates until at least four years after the device is last available for purchase". The support page promises four years from when you bought it new. Those are different clocks, and the statement's is the kinder one for anyone buying early in a product's life, because a device is typically on sale for years after your purchase. Which? recorded Ring in June 2024 as giving four years after discontinuation, which is the statement's version rather than the shop's. Both are Ring's own words and both are current; printing them together is fairer than picking one.

The dates inside the statement are mostly 31 December 2030 or later, with three exceptions worth knowing before buying old stock: the Stick Up Cam Elite and the Video Doorbell Elite run to 2029 and the second-generation Video Doorbell to 2028. Devices whose support has already lapsed are simply absent, because the document covers what is still sold - which is correct, and is also why a statement of compliance tells you nothing about the doorbell already on your wall.

No equivalent public UK statement of compliance could be found for Echo, Fire TV or Blink, only the security-update help pages. That may well exist somewhere in the packaging or the app; it could not be established from outside and needs confirming with Amazon.

67 entries on the recall register, and none of them found by searching for wi-fi

Britain's public register of unsafe products is at gov.uk, and it is worth running before any purchase in this category. Searched on 27 September 2026 it returned 67 reports for the word smart, 13 for camera, one for doorbell, and nothing at all for wifi.

The freshest entry with a household name on it is the Silentnight Smart Wi-Fi Plug, model A6, EAN 5012701485418, recalled on 27 March 2026 after being sold from 2017 to 2022 - individually, in packs of four, six and eight, and bundled with Silentnight electric blankets. The register records a serious risk of electric shock because the mains plug did not meet the dimensional requirements of BS 1363, breaching the Electrical Equipment (Safety) Regulations 2016 and the Plugs and Sockets etc. (Safety) Regulations 1994. It was made in China, recalled by Comfy Quilts on 0330 107 1052, and notified by local authority Trading Standards. Nine years is a long time for a plug to be on bedside tables.

A second entry shows the other way these devices fail. A Cloud Storage Intelligent Camera, published on 19 January 2026 and notified by OPSS itself, carried a serious electric shock and fire risk: no fuse in the plug, live parts reachable without tools, and transformer windings touching each other. That import was rejected at the border and destroyed, so it never reached a customer.

Now notice what the register does not hold. Every one of those 67 entries is about electricity, flammability or a physical hazard. Not one is about a software vulnerability, an unpatched device or a default password - the things the 2024 regime was written for. Product safety has a public register with a search box; product security has a statute, a regulator and no register at all. OPSS's own enforcement page for the connectable products regulations, updated on 8 August 2025, sets out the compliance notices, stop notices, recall notices, monetary penalties, forfeiture orders and court orders available to it, and names not one case. Whether the £10 million ceiling has ever been approached is not something a shopper can find out.

A doorbell camera makes you a data controller at your own gate

The part of a smart doorbell nobody mentions on a product page is that pointing one at the street brings you inside data protection law. The Biometrics and Surveillance Camera Commissioner's guidance on domestic CCTV, first published on 20 October 2016 and last updated on 21 May 2026, puts it plainly: "If your CCTV system captures images of people outside the boundary of your private domestic property - for example, from neighbours' homes or gardens, shared spaces, or from public areas - then the GDPR and the DPA will apply to you."

What follows from that is short and practical. You should be transparent about the recording, which the guidance describes as "putting up a notice informing people that recording is taking place". You should not keep footage indefinitely - "you should not store any information or images for longer than is necessary to protect your property which means you should delete the information once it is no longer required". And you have to honour the rights of the people you have filmed, because if you do not "you may be subject to appropriate regulatory action by the ICO, as well as potential legal action by affected individuals".

The deadline attached to that last duty is a real one. The Information Commissioner's Office gives an organisation - or a householder who has stepped into this position - no later than one calendar month from the day the request is received, extendable to a maximum of three calendar months where the request is complex or where more than one has been made. The month runs to the same date in the following month, rolls to the next working day if it falls on a Saturday, Sunday or bank holiday, and becomes the last day of the month where no matching date exists.

Put that beside the retention the subscription sells. Every Ring plan, from £4.99 a month upwards, offers "Up to 180 Days of Video Playback". Six months of recordings of a pavement is not obviously "no longer than is necessary to protect your property", and it is the householder rather than Ring who has to reconcile the two. None of the hardware prices announced on 30 September 2025 - the Ring Wired Video Doorbell Pro at £219.99, the Wired Video Doorbell Plus at £159.99, the Outdoor Camera Pro at £179.99, the Floodlight Cam Pro at £249.99, the Indoor Cam Plus at £49.99, the Blink Mini 2K+ at £39.99, or the Blink Outdoor Floodlight Camera and Blink Arc at £89.99 each - includes an answer to it.

What the microphone is doing between wake words

Amazon's own privacy page for Alexa and Echo devices is more specific than most people expect, and it answers the question the marketing never raises. By default, "No audio is stored or sent to the cloud unless the device detects the wake word (or Alexa is activated by pressing a button)". When it does, "a recording of what you ask Alexa is sent to Amazon's cloud, where we process your request".

Three of the controls are hardware or near enough. A light ring turns blue, or a blue bar appears on an Echo Show, whenever the device is streaming to the cloud. An Echo can be set to play a short audible tone every time audio is sent. And the microphone button does something better than a software switch: press it and "the power to the microphones is disconnected and a dedicated red light is illuminated".

On retention, Amazon offers automatic deletion of voice recordings, text transcripts and typed requests "after a specified period of time (3 or 18 months)", or the option "to not save any voice recordings" at all, with manual review and deletion under More then Alexa Privacy in the app. Eighteen months is the default-shaped option and three months is the one worth choosing.

The distinction to hold on to is that not saving is not the same as not sending. The setting governs the copy Amazon keeps, not the journey the audio makes; the same page says the recording goes to the cloud to be processed. Anyone who wants speech recognition to happen inside the room is asking for something this product does not offer.

On the security of the hardware itself, the only independent testing found is old and should be read that way. Which? commissioned ethical hackers to attack eight connected devices in a mocked-up home and published the result on 1 June 2022: 37 vulnerabilities across the eight, of which 12 were rated high risk and one critical, with a first-generation Echo among them and remote microphone access among the findings. That is four years ago and first-generation hardware, and no comparable test of the current range has been published since.

The subscription can cost more than the camera

The hardware is the cheap half. Ring's UK plans run Solo at £4.99 a month or £49.99 a year for one device at one address; Multi at £7.99 or £79.99 for every device at that address, adding multi-camera live view and a daily event summary; Pro at £15.99 or £159.99, adding video descriptions, single event alerts, video search and familiar faces; and Guard Response at £29.99 or £299.99. All four carry up to 180 days of video playback.

Guard Response is the newest and the most interesting, announced on 15 July 2026. It sends a licensed guard from RSPNDR, usually within 30 minutes, around the clock, with no charge per dispatch - automatically if a registered Ring Alarm goes off, or on demand from a doorbell or camera. The guard walks the outside of the property checking doors, windows, gates and passages, can call the emergency services, and sends a report afterwards with images. The limits are published and sensible: guards cannot go inside without explicit consent, cannot detain anybody, and have no access to your Ring footage. It is a limited release in Birmingham, Bristol, Manchester and Cardiff, so for most of the country it is not yet a product at all.

Two sums are worth doing before subscribing to anything. Paid monthly, Guard Response is £359.88 a year against £299.99 paid annually, so the monthly option costs £59.89 more for the same service - and £359.88 in year one is more than the £249.99 Floodlight Cam Pro it is watching over. The same gap scales down: Solo is £59.88 a year monthly against £49.99 annually. Guard Response includes Ring Pro, which is £15.99 a month bought alone, so the guard service itself is the other £14 a month.

The assistant has a price now too. Alexa+ reached the UK in Early Access on 19 March 2026 at £19.99 a month once that period ends, free for every UK Prime member, and running on the Echo Show 8, Echo Show 11, Echo Dot Max, Echo Studio, Fire TV and a browser at alexa.com. £19.99 a month is £239.88 a year, which is a good deal more than Prime's £95 for twelve months - so the cheapest route to Alexa+ is a Prime membership rather than the product itself, which is presumably the point. Amazon puts the scale of what it is upgrading at 114 billion customer interactions with Alexa in the UK over the past three years.

Whose four years is it, when the seller is not the maker?

Almost everything else in this part of the shop belongs to somebody else, and Amazon's own seller price list shows how the category is sorted. A smart-home device can land on either side of a wide line: Consumer Electronics takes 7%, Electronic Accessories 15% up to £100 and 8% above, Home Products 8% at or below £20 and 15% above, Tools and Home Improvement 13%, and anything unclassified 15%, all with a 25p minimum. A £39.99 wireless camera therefore costs its seller £2.80 in one category and £6.00 in another, on identical hardware. Selling plans are £25 a month or 75p an item on top.

What the law asks of Amazon on those listings is not to publish the support period - that duty sits with the manufacturer - but not to make the product available without the statement of compliance that carries it. The Smart Technology (Product Safety) Stakeholder Group's guidance, updated on 29 April 2024, states the duty in the same terms and adds that it bites on everything made available in the UK "regardless of source or method of sales". Whether a given marketplace listing actually surfaces that number to a shopper could not be verified here, because amazon.co.uk refuses automated access; it needs checking in a browser, and it is the single most useful thing a buyer could ask for.

The reason it matters is what the rest of the market does with the same obligation. Which?'s June 2024 survey of 128 brands found 76 - 59% - publishing a clear period, and the spread among them was enormous. One year on AEG tumble dryers, Beko washing machines and dishwashers and Grundig ovens. Two years on Hisense dishwashers, Hive radiator valves and Hubble and Owlet baby monitors. At the other end, ten years from Bosch, Miele and tado°, eight from Fairphone, and seven from Google and Samsung phones, Epson printers and Ezviz doorbells. TP-Link gave three years from discontinuation on smart plugs; Samsung and LG gave five years from launch on televisions; Apple gave a five-year minimum on an iPhone. Amazon's four years from purchase sits in the middle of that, and is measured from a better starting point than most.

Set the periods against how long the things actually live and the problem is obvious. An earlier Which? survey, of 119 brands across 20 smart categories in November 2022, found only 49% giving a clear minimum support period, and estimated average lifespans of 13 years for a dishwasher, 13 for an inkjet printer, 11 for a washing machine and 6.8 for a television. A one-year update policy on an appliance with a thirteen-year life is not a policy. Of 1,051 Which? members asked in October 2022, about nine in ten said security updates mattered when buying a smart product.

And the worst case is not a lapsed update but an abandoned platform. On 25 July 2022 Hive told customers it was discontinuing the Hive View and View Outdoor cameras, the Homeshield burglar alarm with its sirens, keypads and sensors, and its leak sensors, with support ending on 1 September 2023 for the sensors and 1 August 2025 for the cameras and alarms, and subscriptions honoured for a minimum of two years. That is a different company and not a criticism of Amazon; it is the thing a published, dated, four-year floor is insurance against, and it is why the floor is worth reading before you buy rather than after.

Figures were taken from each provider's own published terms on 27 September 2026. Variable rates can change at any time — confirm the current rate with the provider before applying.