What we found
Dreame X40 Ultra Robot Vacuum (RLX63CE): FChina's National Intelligence Law says every Chinese company must hand over data when intelligence asks.
Dreame is headquartered in Beijing, subject to China's National Intelligence Law Article 7 compelling cooperation with intelligence. LiDAR maps, interior photos, and occupancy patterns are all legally accessible to Chinese intelligence without warrant or notification.
Ecovacs Deebot Platform: FYour robot vacuum took photos inside your home and sent them to China.
In 2023, ABC Australia reported that Ecovacs robot vacuums were capturing photos inside people's homes — including images of people, pets, and private spaces — and sending them to servers accessible by Ecovacs employees. Some images were used to train the company's AI models. Ecovacs' privacy policy at the time allowed users to "voluntarily" participate in a product improvement programme, but investigators found the opt-in was buried in setup and the data flow continued regardless. Photos from inside Australian homes were found on Ecovacs' training datasets, labelled by outsourced workers.
Ecovacs Deebot X2: DHackers drove these around homes yelling racial slurs through the speaker. Camera accessible remotely.
CVE-2025-30200 reveals the AES encryption keys are hard-coded and predictable, derivable from device identifiers. The encryption Ecovacs touts as protecting user data is fundamentally broken — anyone who knows the serial number can decrypt camera feeds, audio, and map data
AI Ultra Robot Vacuum RV2502AE: DSharkNinja says they don't sell your data, but their own privacy policy admits they share it with advertising companies.
SharkNinja privacy policy simultaneously discloses that technical and inferred data are "shared (for advertising), not sold" with marketing platforms and analytics vendors. The SharkClean app (v6.13.0) embeds Bugsnag crash reporting and MixPanel analytics trackers, which collect device usage patterns, home mapping interactions, and behavioral data. MixPanel specifically enables user behavior analytics and targeted advertising. Sharing data with advertising platforms for targeted marketing is functionally equivalent to selling it — the distinction is semantic, not substantive.
Roomba (Platform): DiRobot's privacy page said: "Images used for navigation are NOT sent to the Cloud." A Roomba J7 photographed a woman sitting on a toilet.
MIT Technology Review reported in December 2022 that a Roomba J7 series robot captured images of a woman sitting on a toilet. The images were shared with Scale AI, a data labeling company, where gig workers in Venezuela viewed and annotated them. Scale AI contractors then posted the intimate images on private Facebook groups and Discord servers. Additional leaked images included: a child's face in close-up and rooms showing personal belongings and living conditions. iRobot claimed the images came from "special development robots" given to employees and paid testers who signed consent forms. However, the consent forms did not mention that intimate images would be shared with overseas gig workers or posted on social media. The distinction between "development robots" and consumer robots is irrelevant to the woman whose toilet photo ended up on Discord.
V15 Detect: DDyson's robot vacuum camera captured a woman sitting on a toilet, and that image ended up with third-party contractors labeling training data.
In 2022, leaked images from Dyson's robot vacuum prototypes showed the onboard camera capturing a woman on a toilet — shared with data labeling contractors. Dyson confirmed the images were real but claimed they came from development units. Same sensor architecture planned for future products.