I have recently learned about a high-tech premium bed base that incorporates Bluetooth speakers, plus massage actuators and other features controllable via a smartphone app.
Like many insecure Bluetooth speakers, the ones in the bed base will pair with any Bluetooth device without any form of authentication, not even a pairing button.
This basically allows anyone with a smartphone to:
Walk within Bluetooth range of the device (for example from the street)
Open their phone and notice the device advertising itself on Bluetooth
Click on it to select it as audio output device
Play any kind of audio file on it
There is no microphone, so it is not possible to remotely record audio. This is not like insecure Bluetooth headsets which allow anyone within range to connect and use the microphone to record.
Neither hacking nor password is necessary to perform this feat, as the device advertises itself as available for connection, and simply accepts all incoming pairing requests. It may even be possible to control the bed position and massage features remotely.
Now I'm wondering what the legal implications are:
For someone who does not own the device, yet connects to it (perhaps by mistake) and plays audio on it without the owner's consent, or manages to remotely control the motors...
For the manufacturer: is it legal to even sell this? Can the buyers sue the manufacturer after the neighbor's kids decide to make the bed speakers play heavy metal at 4AM every night, rendering the bed base features unusable?
For the owner: I know if someone hosts an insecure WiFi and someone else connects to it and uses it for nefarious purposes, the owner of the insecure WiFi can face consequences. In this case the device uses Bluetooth not WiFi, and it is not connected to the internet, so this should not apply... unless maybe?
I'm definitely not planning to buy one of these (nor prank it) anyway, so I'm not focusing on any particular jurisdiction.