Robot vacuum privacy: cameras, microphones and your data

Most new robot vacuums carry a camera, many have a microphone, and all of them map your home. That's useful for avoiding socks and cables, but it's fair to ask who else can see. Here's what has actually gone wrong, what Australian law now requires, and how to choose and set up a robot sensibly. Checked 11 October 2026.

By Domestic Robot · Editor: Christian Ganaban · Updated 14 October 2026

Researched, not testedThis guide is based on manufacturer information, Australian retailer listings and independent sources, all linked below. We haven't used these robots ourselves yet.

Quick answer

Robot vacuum cameras have been misused: photos from iRobot development units leaked in 2022, Ecovacs robots were hijacked in the US in 2024, and a 2026 flaw exposed thousands of DJI Romo cameras. Most brands now process images on the robot and have patched known flaws, and since 4 March 2026 smart devices made for Australia must meet minimum security rules. To reduce your risk: choose a robot whose camera and remote video you can turn off (or one with structured-light avoidance instead of a camera), use a unique password with two-factor login where offered, keep firmware updated, and turn off voice features you don't use.

What your robot collects

Data	Comes from	What it can reveal
Floor map	LiDAR or camera	Your home's layout, room names and furniture
Images	Front camera for obstacle avoidance	Photos of obstacles; some apps offer live video
Audio	Microphone on voice-assistant models	Voice commands; some brands send them to the cloud for processing
Account and usage data	App and cloud	Name, email, Wi-Fi network, cleaning history

LiDAR measures distances, not images. A camera-free robot still maps your home, but it can't photograph it. Our LiDAR vs camera navigation explainer covers how the sensors differ.

What has actually gone wrong

iRobot, 2022: images taken by Roomba J7-series development robots, including a woman on the toilet, were posted online by contract workers labelling AI training data (MIT Technology Review). These were test units in homes that had agreed to data collection, not retail robots, and iRobot ended its relationship with the contractor.
Ecovacs, 2024: researchers showed at DEF CON that some Deebot cameras and microphones could be accessed because a PIN was checked only in the app. In May 2024, Deebot X2 robots in several US cities were taken over and used to shout slurs (reported by ABC News in October 2024). Ecovacs blamed reused passwords and promised a security upgrade.
South Korea, 2025: government testing found weak app authentication on the Narwal Freo Z Ultra and Ecovacs Deebot X8 Pro Omni, and a remotely activatable camera on the Dreame X50 Ultra. Fixes were reported as made. Samsung and LG models rated well.
DJI Romo, 2026: a hobbyist found he could reach live cameras and microphones of thousands of Romo robots worldwide. DJI pushed patches in February 2026 and said it found no evidence of misuse.

The pattern: flaws are usually in the cloud and app, not the camera itself, and the worst cases involved weak or reused passwords.

Australia's new smart-device security rules

Under the Cyber Security Act 2024, a mandatory security standard for consumer smart devices took effect on 4 March 2026. For devices made on or after that date, suppliers must:

Not use universal default passwords. Each must be unique or set by you.
Publish a way to report security flaws, and respond to reports.
Publish a security-update support period with an end date, which can't be shortened.

That last point is worth checking before you buy: it tells you how long the brand commits to fixing security problems. Robots made before March 2026, which includes plenty still on sale, aren't covered. The rules don't limit what data a company collects; that's the Privacy Act's job, and the OAIC has urged privacy-protective defaults and opt-in consent for smart devices.

Privacy features worth looking for

Feature	Why it matters	Examples (brand claims)
On-device image processing	Obstacle photos are analysed on the robot rather than uploaded	Roborock says recognition runs on the robot and photos are stored encrypted on it; eufy says the Omni S2's avoidance works offline; Dreame says the X60 Pro Ultra keeps videos and images off the cloud
Camera and remote video off switch	Lets you disable the camera or live view	Roborock: video calls are off by default and need an app setting, a button press and a gesture password; turning off AI recognition and its voice assistant leaves the camera and mic inactive
No RGB camera	Structured light or 3D ToF sensing avoids obstacles without taking photos	Some Roborock models, such as the S8 Pro Ultra
Independent security certification	Tested against ETSI EN 303 645 or UL's IoT rating	Roborock (TÜV Rheinland, UL Diamond), Ecovacs (TÜV Rheinland, UL Diamond for the X8 Pro Omni), Dreame and eufy (TÜV SÜD) on specific models

Certifications apply to specific models and expire; Roborock's UL rating listed an expiry of 29 October 2026. Check the model you're buying, not just the brand.

Setting up a robot privately

Use a unique password for the app account and turn on two-factor login if offered. The 2024 Ecovacs hijacks relied on reused passwords.
Turn off what you don't use: remote video, voice assistant, and photo uploads for obstacle review.
Keep firmware updated. Most fixes above arrived as automatic updates.
Put smart devices on a guest Wi-Fi network if your router supports it.
Read the privacy settings, not just the policy. Many brands let you opt out of sharing data for “product improvement”.
Before selling or binning it, remove it from your account and factory reset it to clear maps.

If privacy is a deciding factor, a robot with structured-light avoidance and no camera, or one with a proper camera off switch, is a sensible choice. See our best robot vacuums in Australia for current picks, and our companion robots guide if you're weighing up a home robot that's meant to watch and listen.

For what the February 2026 DJI flaw means for Romo owners, see our DJI Romo page.

Shark says its SharkClean app data for Australian users is hosted in Sydney; see our Shark review.

Thinking of a robot that patrols the house? Our home security robots explainer covers what's on sale and the legal questions.

Companion robots and robot pets raise the same questions, often for children: see our companion robot privacy guide.

Common questions

Do robot vacuums with cameras record you?

They capture images to recognise obstacles, and some apps offer live video. Most brands say images are processed on the robot, but flaws have exposed cameras in the past. Turn off remote viewing if you don't need it.

Can robot vacuums be hacked?

Yes. Researchers and hackers have accessed Ecovacs and DJI robots, usually through app or cloud flaws or reused passwords. Keep firmware updated and use a unique password.

Do robot vacuums have microphones?

Some do, mainly models with voice assistants such as Ecovacs's YIKO and Roborock's Hello Rocky. You can usually turn voice control off.

Is there a robot vacuum without a camera?

Yes. Many robots use LiDAR for mapping and structured light or 3D sensors for obstacle avoidance without an RGB camera, including some Roborock models. Budget robots often have no camera at all.

What are Australia's rules for smart device security?

Since 4 March 2026, smart devices made for Australia must have no universal default passwords, a way to report security flaws and a published security-update support period.

Sources

Get new reviews and price drops

One email when new reviews and price drops land. No spam, unsubscribe any time.