Robot vacuums can threaten privacy: what they collect and how to protect your data
Modern robot vacuums can build home maps, keep cleaning histories and even record audio or video. Tech outlet Engadget advises checking the manufacturer's privacy policy before buying and limiting remote features.
Smart robot vacuums that connect to a manufacturer's servers over the internet can gather far more data than owners may expect. Tech site Engadget reports on the issue, stressing that data collection and privacy protection are not the same thing. Depending on the model, a device may build floor maps, store cleaning histories, and include a microphone or remote video viewing.
What gets sent to the manufacturer
Devices that let users check progress while away often communicate through the maker's servers. The privacy policy of US manufacturer iRobot says connected models may send more than floor maps, including room names, floor types, detected objects, the robot's movements and Wi-Fi network details. The author notes that owners may have no idea such a steady stream of data is leaving their home.
The DJI security incident
A recent case shows the risks are real. Sammy Azdoufal, while trying to control his own DJI Romo vacuum remotely, accidentally gained access to roughly 7,000 such devices around the world. DJI says it fixed the backend permission flaw with two updates on February 10, 2026. The server recognised a legitimate customer but failed to limit that customer to their own device. Azdoufal used the Claude Code tool to help analyse the device's communications, but the weakness lay in the security checks.
What users can do
According to Engadget, there is no clear winner among privacy-friendly models, but such a vacuum should minimise the information leaving the home. Buyers should read the privacy policy beforehand and look at how navigation and image processing are handled on the device. Mandatory cloud features should be a deal-breaker. A camera-free model avoids part of the exposure, though it may still create maps and send account data. As an example of a local-first approach, the article cites Matic, whose policy says maps are streamed to the app over home Wi-Fi and processing happens on the robot.
People who already own a robot vacuum are advised to set a strong password, enable two-factor authentication, keep the firmware up to date and disable unneeded remote viewing.
