- 01Cameras, microphones, 3D floor plans: far more than dust
- 02Where does the data go? Manufacturers at a glance
- 03From toilet photos to robot armies: 2022–2026
- 04AI training, ad profiling and the floor plan that nearly got sold
- 05Law lags behind — what authorities say
- 06From guest Wi-Fi to cloud liberation: how to protect yourself
Cameras, microphones, 3D floor plans: far more than dust
Modern robot vacuums are equipped with sensors that go far beyond picking up dust. The data collected falls into six categories: map data (2D and 3D floor plans including room dimensions, furniture outlines, doors and windows), image data (photos and videos of obstacles and rooms), audio data (voice commands and ambient sounds), network data (Wi-Fi SSID, IP addresses), usage data (cleaning times, movement profiles, error codes) and account data (email addresses, serial numbers, MAC addresses).
Cameras
Cameras are now built into most premium models. The iRobot Roomba j7/j9 uses a front camera for PrecisionVision obstacle detection and, according to former CEO Colin Angle, identifies over 80 different object types — from pet waste to shoes. The Ecovacs Deebot X1/X2/T8–T30 series includes cameras with AIVI technology (AI Visual Interpretation) and offers live video monitoring via the app. Roborock's S6 MaxV, S7 MaxV and the Saros Z70 feature dual-camera systems (ReactiveAI). The Dreame L20 Ultra and X50 Ultra also use camera navigation — security researcher Dennis Giese found an "AI Server" folder and image upload functions in the firmware.
Microphones
Microphones are found mainly in Ecovacs devices: the Deebot X1 family, T10, T20 and T30 have built-in microphones for the YIKO voice assistant, including two-way audio. Users who consent to the "voice interaction improvement programme" have their recordings sent to an Ecovacs server in China.
Local vs. cloud — what manufacturers claim and what is true
Roborock claims maps are stored exclusively on the device — however, an update to its privacy policy in July 2025 revealed that Korean customer data "may be processed in China". iRobot states that navigation images are stored only on the robot. Ecovacs, by contrast, stores maps both locally and in the cloud. Xiaomi offers a "local mode" — but it is not enabled by default.
Where does the data go? Manufacturers at a glance
| Manufacturer | Headquarters | Server locations | Rating | Notes |
|---|---|---|---|---|
| Vorwerk Kobold | Germany 🇩🇪 | EU servers | ★★★ Excellent | AV-TEST 3/3, Stiftung Warentest top rating, minimal data collection |
| iRobot / Roomba | USA (→ China*) | AWS (AES-256AES-256Advanced Encryption Standard with a 256-bit key — an encryption method considered unbreakable and used by militaries and banks. Protects data in transit.) | ★★☆ Good | *Bankruptcy Dec. 2025, acquisition by Chinese Picea Robotics for $190M |
| Roborock | Beijing 🇨🇳 | China, DE, RU, USA | ★★☆ Improved | Data sharing with Tuya Smart (Tencent-funded, Hangzhou) |
| Ecovacs Deebot | Suzhou 🇨🇳 | AWS (USA) + Alibaba Cloud (CN) | ★☆☆ Problematic | Multiple hacks, data explicitly in CN, CCPA: "sells" personal data |
| Dreame | Suzhou 🇨🇳 | Not disclosed | ★★☆ Acceptable | AI features disabled by default; T&Cs governed by Chinese law |
| Xiaomi | Beijing 🇨🇳 | NL, IN, SG, RU | ★☆☆ Poor | AV-TEST 1/3, "constant data stream to Chinese manufacturer" (AV-TEST) |
| SharkNinja | USA 🇺🇸 | US-based | ★★☆ Good | Consumer Reports: "Good" — states it does not sell data |
| DJI Romo | Shenzhen 🇨🇳 | China (plaintext) | ★☆☆ Very poor | 6,700 devices accidentally public, data unencrypted |
From toilet photos to robot armies: 2022–2026
DEF CON 32
AI training, ad profiling and the floor plan that nearly got sold
The question of whether manufacturers sell map data is central. Direct, confirmed sales of floor plan data to third parties have not been documented so far — but clear intent and indirect monetisation have.
In July 2017 iRobot CEO Colin Angle told Reuters that iRobot "could strike a deal to sell its maps to Amazon, Apple or Google". Following public outcry, he backtracked. Nevertheless, iRobot's privacy policy collected: age, date of birth, gender, salary, leisure interests, number of children and pets — data not required for a vacuum cleaner.
What Amazon's planned acquisition of iRobot would have meant
The planned $1.7 billion Amazon acquisition would have given Amazon access to the most detailed home data in the world. The Roomba J7 series had identified over 43 million objects in private homes and classified 80 types. Combined with Alexa, Ring and Blink: a comprehensive domestic surveillance network. Senator Elizabeth Warren wrote to the FTC that Amazon would thereby gain "eyes and ears inside the home". The European Commission blocked the deal in January 2024.
LidarPhone: vacuum cleaner as laser microphone
Academic research demonstrates the potential for misuse: researchers from the University of Maryland and the National University of Singapore demonstrated the "LidarPhone" attack in 2020 — the LiDARLiDARLight Detection and Ranging — a laser sensor that maps the surroundings in 3D. Creates precise floor plans of the home. Researchers showed it can even be repurposed as a microphone (the LidarPhone attack). sensor of a robot vacuum was repurposed as a laser microphone to eavesdrop on conversations. Accuracy in recognising spoken digits: over 90 per cent. A forensic analysis of the Amazon iRobot Roomba cloud (ScienceDirect, 2023) uncovered undocumented APIs that enabled extraction of the entire cleaning history and all detected objects.
Law lags behind — what authorities say
The BSIBSIBundesamt für Sicherheit in der Informationstechnik — Germany's federal cybersecurity authority. Warns against robot vacuums with cameras/microphones and recommends network isolation. (Germany's Federal Office for Information Security) has published a dedicated page on robot vacuums and warns of 3D environment mapping, camera/microphone data collection and the permanent internet connection as an attack surface. The Bundesnetzagentur has warned against smart devices with hidden camera and microphone functions — under §90 TKG§90 TKGGerman Telecommunications Act §90: prohibits devices in Germany that can covertly capture images or audio. Hidden cameras and microphones in everyday objects are therefore illegal., such devices are illegal in Germany. The LfDI Baden-Württemberg put it plainly: "Spy in your own home — robot vacuum cleaners as data sieves."
Chinese intelligence law
China's National Intelligence Law (2017) states in Article 7: "All organisations and citizens shall, in accordance with the law, support, cooperate with and collaborate in national intelligence work." The Data Security Law (2021) and Counter-Espionage Law (2023) extend these obligations. All leading robot vacuum manufacturers — Ecovacs, Roborock, Dreame and Xiaomi — are headquartered in China and subject to these laws.
From guest Wi-Fi to cloud liberation: how to protect yourself
In the manufacturer's app, cloud map synchronisation, camera/AI features and usage data sharing can usually be disabled. Ecovacs offers a physical lens cover. On Dreame devices, AI obstacle recognition, voice control and the live camera are disabled by default — check that this remains the case.
Kaspersky recommends: "Only run the robot when no family members are present" (for camera-equipped models) and setting up virtual wall barriers for sensitive rooms such as bedrooms or bathrooms.
The BSI explicitly recommends operating smart devices on a separate network (guest Wi-Fi). This prevents a compromised robot vacuum from accessing computers, NAS devices or other equipment on the main network. Most consumer routers (Fritz!Box, TP-Link, ASUS) offer guest networks with device isolation.
In addition, a Pi-holePi-holeA network-wide ad blocker running on a Raspberry Pi. Blocks connections to tracking and telemetry servers at DNS level — not just in the browser but for all devices on the network. or AdGuard Home blocks telemetryTelemetryUsage data automatically sent to the manufacturer: cleaning times, map data, error logs, network info. Runs permanently in the background, often without the user noticing. at DNS level. For Xiaomi devices, dedicated blocklists exist on GitHub that filter domains such as a.stat.xiaomi.com, api.ad.xiaomi.com and data.mistat.xiaomi.com.
Advanced users can set up dedicated IoT VLANsVLANVirtual Local Area Network — a virtual network within your router that completely separates smart home devices from computers and phones. Even if the robot vacuum is hacked, the attacker cannot reach other devices. with granular firewall rules via UniFi or OpenWrt.
ValetudoValetudoAn open-source firmware replacement for robot vacuums that completely removes cloud connectivity. All functions are retained, but no data packet ever leaves the local network. Requires technical knowledge to install. is open-source software that replaces cloud access entirely with local control. Developed by German developer Sören Beye, it runs as a "brain parasite" on the original firmware and replaces only the cloud connectivity. All features (navigation, mapping, cleaning) are retained — but not a single data packet leaves the local network.
Supported models: Dreame (D9, L10 Pro, L10s Ultra, L20 Ultra, X40 Ultra), Roborock (S5–S8, Q7 Max, Q Revo), Xiaomi, Eureka. Integration into Home Assistant via MQTT. Installation on Dreame devices requires a 3.3V UART adapter and the "Dreame Breakout PCB" — on older Roborock models it can be done wirelessly via the OTA method.
→ valetudo.cloudAnyone wanting maximum privacy can choose a robot vacuum without Wi-Fi. Models such as the Eufy RoboVac 11S MAX, Medion MD 18510 or ZACO V5s Pro operate exclusively via remote control — without any network connection. The trade-off: no app, no intelligent room management.
But also: zero data collection, zero cloud dependency, zero privacy risk. For anyone who values security over convenience, this is the most consistent solution.
A special tip: the Miele Scout RX3 has a physically removable Wi-Fi module — a unique privacy feature in a premium model.
🤖 The privacy cost of convenience
The incidents between 2022 and 2026 — from intimate toilet photos on Facebook to racist abuse shouted from hacked robots to an accidentally controllable robot army from 24 countries — are not isolated cases. They are symptoms of an industry that consistently prioritises functionality over security.
Three findings stand out. First, the claim that "data stays local" is often misleading — even Roborock, which markets this most heavily, shares user data with Chinese IoT provider Tuya Smart. Second, the iRobot case illustrates the irony of failed regulation: the EU blocked Amazon on privacy grounds, whereupon iRobot went bankrupt — and is now being acquired by a Chinese company. Third, with Valetudo, network isolation and Wi-Fi-free models, viable alternatives exist that demonstrate: thorough cleaning and data protection are not mutually exclusive — they simply require more conscious purchasing decisions.
Virtually all leading brands are now Chinese and subject to laws that can compel them to cooperate with intelligence services. Anyone buying a robot vacuum should be aware of this.