Companion robot privacy: what they record and how to protect your family

Companion robots are built to watch, listen and remember: that's how they recognise faces and chat. It also makes them some of the most personal devices in a home, often used by children and older people. We read the privacy policies of the robots Australians buy most, looked at what's gone wrong, and set out what Australian law now requires. Checked 31 October and 1 November 2026.

By Domestic Robot · Editor: Christian Ganaban · Updated 1 November 2026

Researched, not testedThis guide is based on makers' privacy policies, Australian law and regulator pages, and published security research, all linked below. We haven't tested these robots' data handling ourselves.

Quick answer

Most AI companion robots send voice and sometimes video to the cloud, and several makers say little about where it goes. In October 2026 a researcher found Eiliko, an AI companion robot from Eilik maker Energize Lab, exposing millions of chat logs and household profiles, including children's details; in February 2026 US senators found a public database of Miko's replies to children, which Miko denies was a breach. Before you buy, check the policy for what's recorded, where it's stored and how to delete it. Since 4 March 2026, smart devices made for Australian homes must meet basic security rules: no universal default passwords, a way to report flaws, and a stated support period. The safest companion for privacy is one with no camera or internet at all, such as the Joy for All cat.

What popular companion robots collect

Robot	What it can collect	What the maker says	Deleting your data
Loona (KEYi)	Camera, microphones; GPT-4o voice chat in the cloud	Policy (Feb 2023) doesn't explain camera, face or voice data, or where it's stored	Email [email protected]
Miko 3 / Miko Mini	Camera for on-device features (can be switched off); mic on tap or wake word	Says it stores no voice recordings or facial recognition data; kidSAFE seal, follows US COPPA	Parents can delete data in the app
Enabot EBO X	Live and recorded video, audio for calls, photos, location, device IDs	Cloud video stored only if you turn it on; encryption and server location not stated	See the policy
Vector (Anki)	Camera, microphones; voice requests sent to the cloud	Common Sense Privacy rates its policy “Warning”; voice and face data treated as biometric	On request
ElliQ (Intuition Robotics)	Cameras, microphones, transcripts, health information you share	Stored with third-party cloud providers, possibly overseas; kept at least six years after service ends	Email [email protected]
Joy for All cat	Touch and motion sensors	No app, Wi-Fi or account needed	Nothing to delete

From each maker's privacy policy or safety page, checked 31 October 2026. Policies change; read the current one before you buy. We haven't confirmed that ElliQ is sold in Australia.

What has gone wrong

Eiliko chat logs exposed (October 2026). A researcher reported to The Verge that Energize Lab's Eiliko AI companion was exposing millions of conversations and household profiles, with names, ages and relationships, plus photos and audio clips at public web addresses; reported numbers vary between sources. Malwarebytes advised owners to take the robots off Wi-Fi until fixes are confirmed. Energize Lab hadn't responded substantively when it was reported. It's unclear which Eilik-family models are affected; if you own one, disconnect it from Wi-Fi until the maker explains.
Miko replies database (February 2026). US senators found an unprotected database of thousands of the robot's audio replies to children, often including the child's name. Miko denied a breach and says it doesn't store children's voices; it added an off switch for its AI features soon after.
Moxie stopped working (December 2024). When its maker Embodied closed, the US$799 children's robot was expected to stop working once its cloud services ended, with no refunds. A robot that depends on one company's servers can lose its features overnight.
Camera robots hijacked (2024). Researchers at DEF CON showed some Ecovacs robot vacuums could be taken over by Bluetooth and their cameras switched on, and owners in the US reported vacuums being used to watch and abuse them. Our robot vacuum privacy guide covers it.
Humanoids too. Researchers reported in 2025 that the Unitree G1 humanoid sent data to overseas servers without explicit consent; see our G1 guide.

Your rights in Australia

Smart-device security rules. Since 4 March 2026, under the Cyber Security Act 2024, consumer smart devices supplied in Australia must have no universal default passwords, a published way to report security problems, and a published support period with an end date. Devices made before that date don't have to comply. Ask the seller for the support period before you buy.

Privacy Act. Businesses covered by the Privacy Act 1988 must tell you what personal information they collect and let you ask for access and correction. Since 10 June 2025, people can also sue for serious invasions of privacy, such as intrusion into their home, under a new statutory tort. From 10 December 2026, privacy policies must explain when decisions are made by computers using your data.

Children's Online Privacy Code. The privacy regulator, the OAIC, is drafting a code for online services likely to be used by children, and lists consumer internet-connected devices among the examples. It must be registered by 10 December 2026. eSafety's August 2026 research found 8% of Australian children aged 10 to 17 had used an AI companion, and a third had shared personal information with AI assistants or companions.

This is general information, not legal advice. Overseas makers without an Australian presence can be harder to hold to account.

Before you buy: questions to ask

Does it have a camera? Can you switch it off, or cover it?
Is voice processed on the robot or in the cloud, and in which country?
Are recordings or chat logs kept? For how long? Can you delete them yourself?
Is the policy written for this product, or just the company's website?
What's the published support period, and what happens if the company's servers shut down?
For a child's robot: are there parent controls, and does it work without an account in the child's name?

Setting up a companion robot privately

Create the account yourself, with a strong unique password and two-step login if offered; use a parent account for children.
Put the robot on a guest Wi-Fi network if your router has one, away from computers and phones.
Turn off features you don't need: cloud video, remote viewing, face recognition, AI chat.
Keep it out of bedrooms and bathrooms, and charge it where its camera faces a wall.
Install updates, and check the maker's news page now and then for security notices.
When you sell or give it away, delete your data, factory reset it and remove it from your account.

Privacy-friendly choices

If privacy is your main worry, choose the least connected robot that does the job. Offline robot pets and simple robotic cats have no camera or internet. Among AI robots, look for a camera you can switch off and clear deletion controls. Our robot pets for kids guide notes what each records, and best companion robots in Australia compares our picks, including the Loona, Vector and Enabot EBO X reviews.

Humanoids raise bigger versions of the same questions, including remote operators: see humanoid robot safety at home.

A worked example: what ElliQ's privacy policy says.

Common questions

Do companion robots record you?

Many can. AI robots such as Loona, Vector and EBO X have cameras and microphones and send voice or video to the cloud for some features. Simple robotic pets like the Joy for All cat don't connect to the internet.

Are AI robots for kids safe for privacy?

It depends on the robot. Check what it records, whether you can switch off the camera and AI features, and how to delete data. There were reported data exposures involving Miko (disputed) and Energize Lab's Eiliko in 2026.

What are Australia's rules for smart device security?

Since 4 March 2026, consumer smart devices supplied in Australia must have no universal default passwords, a way to report security flaws and a published support period.

Can I delete what a companion robot has recorded?

Under the Privacy Act you can ask covered businesses for access and correction, and most makers offer deletion on request or in the app. Check the policy before you buy.

Which companion robots don't need Wi-Fi?

Offline robot pets and the Joy for All cat work without Wi-Fi or an app. AI chat robots need an internet connection for their main features.

Sources

Get new reviews and price drops

One email when new reviews and price drops land. No spam, unsubscribe any time.