Your smart TV, router, printer, and thermostat are quietly sending data to manufacturers and data brokers right now. The industry calls it "telemetry." In plain terms, it's surveillance — usage patterns, device inventories, viewing habits, and network activity, collected continuously and shared with third parties.
None of this requires you to have done anything wrong, or even anything unusual. It happens by default, out of the box, the moment a device connects to your WiFi. Most of it is buried in a privacy policy nobody reads, phrased in language designed to sound routine rather than alarming: "to improve your experience," "for product development purposes," "with select partners." What that actually means, in most cases, is a steady stream of metadata — what you watch, when you're home, what other devices are on your network, how you use the product — flowing out to servers you'll never see, for purposes you were never meaningfully asked to consent to.
This guide walks through four levels of defense, from a five-minute browser fix to a full homelab-grade setup. Pick the level that fits your skills and time. Even Level 1 alone makes a real difference.
Three concrete reasons this is worth an afternoon of your time:
The data compounds. A single data point is nearly meaningless on its own. But telemetry is collected continuously, indefinitely, and correlated across every device in your house. Months of continuous collection builds a genuinely detailed picture of your household's habits, presence, and schedule.
You don't control where it goes after collection. Most telemetry doesn't stay with the manufacturer. It's routed to analytics platforms, advertising networks, and data brokers, who aggregate it with data from other sources and resell it.
Blocking it costs you almost nothing. Unlike a lot of privacy trade-offs, blocking telemetry rarely breaks the actual functionality of a device. What stops working is the surveillance layer riding alongside the feature you actually wanted.
Amazon's eero WiFi system is one of the most aggressive data collectors you can plug into your home network. It continuously transmits device inventory and usage data back to Amazon's servers, and Amazon's own privacy policy openly states this data is shared with third parties.
This isn't unique to eero — most consumer smart-home gear behaves the same way. Eero is simply one of the most visible and well-documented examples, in part because it sits at the center of the network by design.
The easiest and fastest win. Covers web browsing only, but it's where most casual tracking happens.
uBlock Origin intercepts requests to known ad and tracking domains before they load — the tracking script never runs at all. Switching your DNS to an encrypted, filtering resolver adds a second layer, blocking requests at the DNS level before your device can even look up the tracking server's address.
This only protects the browser it's installed in, on the device it's installed on. Your smart TV, other apps, game console — none of that traffic goes through your browser. That's exactly the gap Level 2 closes.
Filtering at the router covers every device on your network without installing anything on each device individually.
Once set at the router, every device that connects inherits that DNS setting automatically via DHCP — one change, applied once, covers the whole house. This is the highest-leverage change in this entire guide relative to the effort required.
Run a dedicated DNS filtering server on your network — a real-time dashboard, custom block lists, and far more control than router-level DNS redirection alone.
Pi-hole has the larger, longer-established community and the most third-party guides and blocklists. Its interface leans toward raw data — query logs, top blocked domains, per-client stats.
AdGuard Home ships with a more polished interface out of the box, includes built-in parental control, and supports encrypted DNS (DoH/DoT) natively for both upstream and serving your own devices.
Spend time in the query log after the first few days of normal use. You'll see a running block percentage, the domains generating the most blocked requests, and which devices on your network are the most persistent about phoning home.
A real, working setup — built through hands-on technical collaboration — not theory.
This layered approach matters because DNS filtering alone has a blind spot: any device hardcoded to use a specific IP address instead of a domain name skips DNS-based filtering entirely. IP-level blocking at the router firewall catches that traffic even when DNS filtering can't see it coming.
Putting IoT devices on their own VLAN, separate from trusted computers and phones, adds protection that has nothing to do with DNS filtering. If one of those devices is ever compromised, VLAN isolation prevents it from reaching your trusted devices. This is defense in depth: DNS filtering blocks known trackers, IP-level firewall rules catch what DNS misses, and VLAN isolation limits the blast radius of anything that gets through both.
| Blocklist | Purpose |
|---|---|
| HaGeZi Multi Pro | All-around telemetry and ad blocking |
| OISD Big | Broad ad and telemetry coverage |
| WindowsSpyBlocker | Microsoft/Windows telemetry domains |
| Perflyst Smart-TV Blocklist | Smart TV telemetry (Samsung, LG, Roku, Hisense, etc.) |
| HaGeZi Samsung Tracker | Samsung-specific tracking domains |
| HaGeZi Windows/Office Tracker | Microsoft Office telemetry |
| HaGeZi Threat Intelligence Feeds | Known malicious/tracking infrastructure |
| Phishing URL Blocklist | Phishing protection |
| Stalkerware Indicators List | Blocks known stalkerware command-and-control domains |
Overlapping lists are normal and not wasteful — different maintainers catch different domains at different speeds. Update frequency matters more than list count; periodically check for lists that have gone stale (no update in 6+ months).
Manufacturer-specific ACR (Automatic Content Recognition) vendors often slip past general blocklists. Watch your query log for unexpected outbound domains from smart TVs and add custom rules as needed. Example — blocking a Hisense third-party ACR vendor:
||vidonme.cn^
ACR works by taking periodic snapshots or audio fingerprints of whatever is currently displayed on screen — including content from an HDMI-connected device — and matching that against a database to identify exactly what you're watching, when, and for how long. It's usually enabled by default and buried deep in TV settings, which is why blocking its domains at the DNS level is more reliable than hunting for a toggle in the UI.
DNS blocking at the router only catches WiFi traffic. Phones can also be covered over cellular using a local VPN-based blocker (AdGuard or Blokada app), so telemetry is blocked even off the home network. This works differently from a traditional VPN — it creates a local tunnel on the device itself purely to inspect and filter DNS requests before they leave the phone, without your browsing traffic ever leaving your device through a third party.
A well-tuned setup like this blocks 25–30% of ALL network traffic — most of it telemetry you never knew existed. That's measured directly from the AdGuard Home dashboard, not a marketing number.
DNS blocking can't reach telemetry baked into the OS itself. For full coverage on Windows PCs, run all three together:
At Level 1 or 2: browse to a known ad/tracker-heavy site and check your browser's network inspector or uBlock Origin's badge count for blocked requests.
At Level 3 or 4: watch the query log live while a smart TV is powered on and idle — you should see periodic outbound query attempts to known telemetry domains getting blocked, even with nothing actively "in use."
A useful habit: check the dashboard's block percentage weekly for the first month, then monthly after that. A sudden drop with no configuration change usually means something is bypassing your filter.
A smart TV app / streaming service stopped working after filtering. Check your query log for what was blocked right before the failure, and add a specific allow-list exception for that one domain rather than disabling the whole blocklist.
My block percentage dropped to near zero overnight. Almost always a DNS bypass — check your router's secondary/fallback DNS setting, and confirm no device has its own hardcoded DNS server (common on some Android and Chromecast devices).
A blocklist I added didn't change anything. Confirm the list actually loaded and updated — a list that failed to download silently sits at zero blocked domains.
I flashed DD-WRT and now my router won't boot. Recovery depends entirely on the specific router model — consult that model's specific recovery documentation.
DNS-level filtering adds negligible latency — single-digit milliseconds. If anything, blocking ad and tracking scripts often makes pages feel faster.
No. Each level stands on its own. Most households get the large majority of the benefit from Level 2 or 3 alone.
In the large majority of cases, no — blocking telemetry doesn't touch domains required for core functionality.
Yes. You're configuring how your own network resolves domain names and what your own devices are allowed to connect to — the same category as an ad blocker or a firewall rule.
Those are genuinely harder to cover, since they use the cellular carrier's own DNS. The mobile-specific local VPN blocker described in Level 4 is currently the most practical option.
You don't have to jump straight to Level 4. Each level is a real improvement on its own, and you can build up over time.