Vonovia, Data Privacy, and Smart Smoke Detectors: What You Need to Know

What is the dispute over Vonovia’s smoke detectors about?

Vonovia, Germany’s largest housing company, is gradually fitting its flats with a new smoke detector: Techem’s “Multisensor Plus”. The device not only warns of smoke but can also measure the room climate. Since late 2024, this has caused disputes over data privacy and over whether tenants have to accept the installation and pay higher rent for it.

In this article, you will learn what data the device collects, what rights tenants have, what the first court rulings say and what companies can learn from the case for their own use of connected devices.

What is the “Multisensor Plus”?

The Multisensor Plus combines several functions in one device:

• Smoke detector (required by law)
• Heat detector, mainly for the kitchen
• Carbon monoxide warning
• Room climate measurement of temperature and humidity, with a ventilation hint via LED

The devices in a flat are connected by radio, so an alarm can be heard in every room. Techem checks their function remotely at regular intervals. Tenants who consent can also see the room climate values in the “Mein Vonovia” app. According to Vonovia, there are no cameras or microphones.

What data does the smoke detector collect?

The key is the difference between the basic functions and the comfort functions:

• Without consent: According to Vonovia, the Multisensor Plus is installed so that no room climate data is stored or transmitted. For remote maintenance, the device only transmits information about its status.
• With consent: According to Vonovia’s privacy information, the device measures temperature and relative humidity every two minutes, calculates hourly averages and stores them for up to three years.

Why room climate data is personal data

Temperature and humidity seem harmless. Assigned to a specific flat, however, they show when someone airs the rooms, heats, showers or cooks – and therefore when someone is at home. This makes them personal data within the meaning of the GDPR. Stored over three years, they paint a fairly detailed picture of a household’s habits. Similar questions arise with other smart home devices, such as Amazon Alexa.

What the data protection authority says

In November 2024, the data protection authority of North Rhine-Westphalia made it clear: smoke detectors with climate monitoring may only be installed with their additional functions switched off unless tenants have given prior, voluntary consent. Voluntary also means that consent must not be tied to the tenancy agreement and must be as easy to withdraw as to give (Art. 7 GDPR).

What rights do tenants have?

Refusing or withdrawing consent

Tenants do not have to agree to the room climate functions; the smoke detector works without them. Consent that has been given can be withdrawn at any time, in the “Mein Vonovia” app or in writing to Vonovia. For data already stored, tenants can request information under the GDPR right of access and demand its deletion.

Objecting to the installation

Tenants always have to accept a smoke detector, as it is required by law. Whether this also applies to the Multisensor Plus depends on whether its installation counts as a modernisation under German tenancy law (Section 555b of the German Civil Code). A landlord has to announce a modernisation in writing at least three months in advance (Section 555c). Hardship, such as an unreasonable financial burden, must be raised by the end of the month following receipt of the announcement (Section 555d).

Tenants’ associations advise objecting to the Multisensor Plus and requesting a conventional smoke detector without additional sensors instead. In Witten, Vonovia switched to such standard devices after objections. If in doubt, tenants should seek advice from their local tenants’ association.

What does the Multisensor Plus cost tenants?

Vonovia passes on the costs to tenants as a modernisation. German law allows 8% of the modernisation costs per year (Section 559 of the German Civil Code). The landlord has to deduct the share that would have been incurred anyway for replacing an old smoke detector. According to Vonovia, one Multisensor Plus costs around 135 euros. How much the rent rises depends on the number of devices in the flat:

On top of this come costs for remote maintenance, which can be passed on through the service charges.

What do the courts say?

Many tenants have objected to the installation. In Dortmund-Mengede, for example, several households objected in 2025 with the support of the local tenants’ association. They considered the rent increase unjustified because the old smoke detectors still worked, and raised data protection concerns.

In 2026, the first courts ruled – in opposite directions:

• Herne local court, June 2026 (case no. 34 C 18/26): The installation is a modernisation; the tenant has to accept it.
• Spandau local court, 4 September 2026 (case no. 5 C 85/26): The installation is not a modernisation. The additional functions do not noticeably improve the value of the home, and replacing the smoke detector is mere maintenance. The tenants do not have to accept the installation, and there is no rent increase.

An appeal has been allowed in both cases. There is therefore no consistent line yet.

What companies can learn from the case

The dispute is not only relevant to the housing industry. Anyone who uses connected devices, sensors or apps – in buildings, in the office or at customers’ premises – faces the same questions:

1. Privacy-friendly default settings: Functions that go beyond the actual purpose are switched off by default (Art. 25(2) GDPR).
2. Voluntary consent: It is obtained separately from the contract, explained clearly and can be withdrawn at any time.
3. Data protection impact assessment: Anyone who systematically collects data from homes or workplaces assesses the risks in advance in a data protection impact assessment.
4. Justified retention period: How long data is stored follows from its purpose. After that, it is deleted.
5. Contractually binding service providers: Metering or maintenance providers need a data processing agreement.
6. Open communication: Unclear information creates mistrust, as the debate about the “spy smoke detectors” shows.

Conclusion

The Multisensor Plus shows how quickly a safety device can become a data protection issue. For tenants, the room climate functions are voluntary, and whether they have to accept the installation and rent increase is still legally open.

For companies, the case is a lesson. Anyone who collects data from private spaces needs privacy-friendly default settings, clean consent and a documented risk assessment – before the first complaint arrives.

Want to introduce connected devices or new tools in a privacy-compliant way? With heyData’s external data protection officer, you review consent, impact assessments and contracts with service providers before problems arise.

Take the first step: Book a free demo now