Ohme emailed me today to say they’ve updated their privacy policy. I’ve never read it. Not the one I implicitly agreed to in 2021, nor the 2024 revision, and I certainly wasn’t planning on reading this one.
Then I thought about what’s actually on the other end of that policy. It’s a box bolted to the side of my house that I touch most days and think about almost never. So I read the new policy, dug the previous version out of the Internet Archive, and compared the two. Living the dream, me.
The charger
Image from Ohme Home Pro
I had an Ohme Home Pro fitted on 3rd December 2021, a few days before my first EV, a Mini, turned up. I wrote about that car, and a bit about the charger, in Mini EV: Two Years On. The charger came free as an incentive with the car. I didn’t choose Ohme. Ohme came in the box, more or less. Hold that thought.
In December 2024 I got rid of that Mini and got a new one. It plugs into the same charger.
The charger is hooked up to my Octopus Energy account, so it knows when electricity is cheap and charges the car then. That’s the whole point of it, and it works. I plug the car in most days and walk away. The Ohme app is on my phone, but I barely open it, unless I need to override the charge plan.
I’m on Intelligent Octopus Go, which is 36.39p/kWh during the day and 6.60p/kWh off-peak. The current Mini is a Cooper SE with a 54.2kWh battery, of which about 49kWh is usable. Filling it from empty overnight costs about £3.25. Call it £3.60 once you allow for the bit that gets lost as heat while charging. Do the same at the daytime rate and it’s nearer £18.
So the box earns its keep. Which is exactly why I’ve never bothered to wonder what else it’s up to.
What it knows
Have a think about what a smart charger needs to do its job, and you’ve got a fair idea of what it knows about you. Going by the policy, that includes:
- When I’m home. The car is either plugged in or it isn’t. Five years of that is a pretty decent record of when I’m in, when I’m away, and how boringly predictable I am about it. They also collect “the location of your Ohme cable when it is plugged in”. It’s bolted to my house. I can save them the trouble.
- What I drive. Make, model and VIN, for both Minis.
- My car account. Where the car supports it, Ohme logs into the manufacturer’s service with my credentials to read the charging status. This never actually worked with the first Mini, despite several calls and emails, but they’d have been holding the login all the same.
- My electricity. Supplier, tariff, meter numbers and, where available, half-hourly consumption from the smart meter. That’s the whole house, not just the car. Every kettle, every load of washing, every time I leave the telly on.
- My phone. IP addresses, device identifiers and, new in this version, the advertising IDs Apple and Google stamp on every phone.
Mileage isn’t listed. But with five years of charging history and a login to the car, I’d be surprised if they couldn’t work it out.
None of that is sinister on its own. It’s roughly what you’d expect a smart charger to need. Add it all up though, and it’s a detailed picture of my household, held by a company I ended up with because it came bundled with a car.
What changed
The previous policy was dated 4th July 2024. The new one is dated 9th November 2026, and it’s a complete rewrite. Most of it is the same stuff shuffled into tables, with Ireland moved out into its own addendum. Here’s what actually changed.
Gone
- The promise not to sell. The old policy said: “We will never share or sell your personal data to third parties for marketing purposes.” That sentence has vanished. The new one doesn’t say they will sell your data. It just doesn’t say they won’t any more, which isn’t quite the same thing.
- A number for how long they keep it. Previously, if your account was closed or went inactive, they kept your data for seven years and then deleted it. Now it’s “a reasonable period after the end of the relationship”. No number, and nothing about deleting it at the end. Reasonable to whom?
- Limits on suppliers. The old version said suppliers only got the data they needed and weren’t allowed to use it for anything else. That’s gone too.
- Telling you about changes. Previously any change would be notified. Now they can amend the policy “at our sole discretion” and only have to tell you if they start using your data in a way that’s “significantly different”. To be fair, they did email me this time. Which is how we got here.
New
- AI. Of course there’s AI. A whole section on it. They use AI tools for document processing, data analysis, customer service routing and chatbots, and third-party AI providers “may process your personal data”. You can ask for a human to review a decision, but only where it “significantly affects you”. Who decides what’s significant isn’t spelled out.
- Marketing without asking. Email marketing used to need consent. Now existing customers can get SMS or email marketing on “legitimate interests” grounds, which means opt-out rather than opt-in. Post and automated calls are new channels too. Robocalls about my car charger. Lovely. There’s also a paragraph about marketing to people who started signing up and didn’t finish, which manages to say they haven’t consented, and that the legal basis is explicit consent, in the same sentence.
- Advertising IDs. IDFA and AAID, the identifiers used to track you across apps for ads, are now on the list. I’m struggling to think why my car charger needs to follow me around Instagram.
- My car login, used for flexibility services. Flexibility services are where Ohme shifts when its chargers draw power, and sells that flexibility to grid operators and energy markets. In 2024 that used my address, location, meter number and tariff. The 2026 list adds car login data, charging data and vehicle information.
- More stuff, mostly from installation. Photos and videos of the property and fuse box, the electrical installation certificate, the ENA application, meter IDs, crash reports, plus Apple Pay, Google Pay and PayPal details.
- New places it comes from and goes to. Car manufacturers are now a source. Microsoft 365, ECOES, “flexibility energy markets”, grant administrators such as OZEV, and due-diligence providers in a sale of the company are now named recipients. That last one is worth a moment’s thought.
My favourite bit: section 4.1 tells you which Ohme company is responsible for your data “at [LINK]”. Someone forgot to put the link in before hitting publish. We’ve all been there.
What I’m doing about it
Nothing dramatic. The charger works, the £3-ish fill-ups are the reason I have it, and ripping it off the wall over a privacy policy would be daft. But a few things are easy:
- Opting out of marketing. One unsubscribe link, or an email to [email protected]. Done before the kettle boiled.
- Turning off ad tracking on my phone. On iOS, stop apps asking to track. On Android, delete the advertising ID. That deals with the IDFA/AAID collection for every app, not just Ohme’s.
- Sending a subject access request. Under UK GDPR I can ask Ohme for a copy of everything they hold on me. It’s free, and they have a month to reply. I’m genuinely curious what nearly five years of plugging in a car looks like from their side.
I could also object to the flexibility services processing, but I suspect the answer would be that it’s part of how the smart charging works. I’ll see what the subject access request turns up first, and write that up when it arrives.
The box has been on the side of the house since 2021. It’s about time I found out what it’s been saying about me.
Fancy switching to Octopus? Here’s my referral link. If you sign up we can split £100 with with this link. Or £150 if you’re signing up a business.