Google’s acquisition of Nest for $3.2 billion this week has been heralded as the company’s big move into home automation. Nest has made overtures about customer privacy, but given the size and profitability of its new owner’s advertising and personal data business, the new relationship needs a closer examination.

Certainly, Nest’s products—currently a thermostat and a smoke detector—have potential in their own right, and Google is getting a new slate of devices to sell in the deal. But along with the devices, Google is getting access to new types of data it can put to very good use along with a new set of very interested customers. And like other types of data collection, this has potentially negative consequences for consumers.

What Nest says, and what Nest is actually saying

It makes sense to begin with a close read of what Nest actually says it will do with customers’ data under Google. A quote from an FAQ with Nest founder Tony Fadell:

Will Nest customer data be shared with Google? Our privacy policy clearly limits the use of customer information to providing and improving Nest’s products and services. We’ve always taken privacy seriously and this will not change.

First, to say a company takes privacy seriously makes no guarantees about what it will do with your data. It’s clear at this point that what a privacy policy says has no bearing on what the company may do tomorrow, next year, or five years from now.

Google also takes privacy seriously, but that did not stop it from consolidating its data silos or forcing Google+ into places it didn’t used to be. YouTube logins weren’t going to change under Google ownership until they did. Your most frequent contacts were your own business until Google Buzz broadcasted them to the public. Your reviews of a new store or restaurant were written for businesses you liked, until they were written for advertisements by Google. All it takes is for Google to dream up a new use for the information that’s streaming in, and a few privacy-policy sentences later—not even, in the case of Google Buzz—data that was once drifting into a black hole is being repackaged and sold to a third party or informing a new feature.

Second, “providing and improving Nest’s products and services” is a pretty broad range of permissions. Google could consider taking Nest’s silo and interfacing it with all the other location data it has on a customer in order to be absolutely sure of where you are as an “improvement” for instance. Another “improvement” could be sharing your energy use (ineffectively anonymized, of course) with every energy provider in your area so that you can be appropriately advertised to, making you aware of all your options. Nest and Google are just trying to make sure you have the best energy provider to use with your Nest. Right? Fadell doesn’t answer the question posed to him, and he never says no. Nest’s data is going to be for Google’s taking, provided it meets the dubious purpose of “improving” or “providing” Nest services.

In light of all the information Google already has on us, a shallow, knee-jerk reaction to its acquisition of Nest might be, so what? It already knows where we are through smartphone GPS more or less all the time. I can do Google one better: it certainly knows my location from my Wi-Fi router, and it knows the one address I type into Google Maps 95 percent of the time. Google knows where I live, certainly. But that doesn't mean even Nest’s current products, let alone future extensions of its portfolio, can’t augment Google’s data arsenal in a very valuable way.

Who will buy the data Nest has to sell?

We’ve already mentioned one benefactor: energy providers. Nest made several partnerships with electric companies in 2013 that would provide a Nest device and some bill discounts to customers if they were able to lower their power consumption. Google will now be cut in on this relationship, along with the growing number of energy suppliers that many customers can now swap between (see: Ambit, Agway, Citizens Choice).

In this new position, Google can not only collect data on energy use that it can sell to these companies (more to the point, sell to each others’ competitors), but it may also be able to now deliver different customers as targets for advertising. Energy companies will be able to target their marketing much more effectively, possibly even tailored to the user. And for companies to do business with, energy providers are not small fish: Ambit Energy made $1.022 billion in 2012.

Another big market Google can wedge itself into that takes even better advantage of Nest’s place in the home is with insurance companies. Nest device information, while redundant with some of Google’s info, is unique in some ways.

The Nest Protect, the company’s smoke detector, will be able to tell Google unequivocally when there has been a home fire or a carbon monoxide leak, even when the home owner does not report it. A Nest thermostat could tell when the heat breaks, and by extension, when the pipes freeze or when the power goes out. This is all information that insurance companies would love to get their hands on. And insurance is not a small business: the top five companies in direct premiums written for home insurance made a collective $171 billion in revenue in 2011 (though not all of it was through home insurance).

Not everyone has a Nest? It doesn’t matter.

Nests are currently positioned as a luxury item for people with a home automation fascination. But as we mentioned above, the company has already struck deals with electric companies to help expand its reach.

With Google’s resources, Nest’s partnerships could expand still further to development contractors, commercial builders, or really any person or company who makes structures that people live and work in. Soon enough, the Nest will hardly need an invitation into a home; it, or products like it, will be as standard an inclusion as dumb programmable thermostats are now.

Why this is all a problem

Insurance is a data-driven industry, and it could eat up what Nest has to offer. The unreported fires seen by Nest that we mentioned earlier could result in higher insurance premiums; so could a spate of burglaries detected by a Nest thermostat's motion sensors while the devices are set to "away."

This is all to say nothing of possible extensions of Nest’s product line. Home security would be a natural next step and another area of interest for insurers. Insurance, an industry built on statistics, could benefit in a big way from data that is both more timely and less at the discretion of the customer than self-reports are.

It may sound like a stretch for anyone to put data to use like this, but it's already happening: there is the infamous example of when Target started sending a pregnant teenager baby-related coupons before her father even knew she was pregnant. Consumer data companies also cull domestic violence shelter mailing lists or lists of seniors with dementia to feed marketing categories like "fragile families" or "rough retirement: small town and rural seniors," which predatory financial institutions might use to see who they can rope into high-interest loans or credit cards.

The potential for home automation is certainly cool, and there is hardly a company out there that can stop talking about it. But it’s a shrewd move for Google. To say that the privacy implications are negligible, the potential for discrimination is nonexistent, and that Nest can’t tell Google anything it doesn’t already know is naive.